What if MSSQL is encountered during penetration: db_owner?

Author: Nobug32

A small problem I encountered in a certain penetration work. The permission setting is very BT and can only be wandering in the current directory. It is conceivable to call mongoshell, the general method will lose the effect, but its database is indeed MSSQL, the permission should not be too high

SrvRoleMember:Db_owner

Sure enough, after checking it, we found that db_owner has the permission. In fact, most of our friends can go here to show that you still have enough ideas and analysis capabilities, so we can carry out our log backup and Elevation of Privilege operations, if you do not understand this, you can refer to the following explanations:

SQL contains the LogBackup function. You can call it to execute the following command:

Create table [bin_cmd] ([cmd] [image]); declare @ a sysname, @ s nvarchar (4000) select @ a = db_name (), @ s = 0x62696E backup log @ a to disk = @ s; insert into [bin_cmd] (cmd) values (www.tosec.cn); declare @ B sysname, @ t nvarchar (4000) select @ B = db_name (), @ t = e: 1.asp backup log @ B to disk = @ t with init, no_truncate; drop table [bin_cmd];

It means to back up our website to the 1. asp file under the e disk. Of course, we can back up some dangerous commands to the system startup items through this call, so as to achieve some Elevation of Privilege operations.

We continue to find that we need to wait for the Administrator to log on or restart, but the Administrator may not log on for a long time. Of course, we can only use some very effective means. DDOS is not mentioned here, but database load. Yes, what we need is to increase the database load. Of course, some conditions are required, that is, we need an injection point or a place where SQL commands can be executed (; wHiLe 1 <9 bEgIn sElEcT cHaR (0) eNd --), we can execute the command in parentheses, which means to convert the values in the range until the server resources are exhausted, of course, if the administrator limits this, it will not be able to achieve the effect, for example, the execution time of ASP.