Idea: 1. Connect to SQL Server2, write binary data 3 to the temporary table, export data in the table and save as file
Step 1, 2 can be implemented using ADO, which is very convenient to use VB. Step 3 Using the TextCopy command, note that this command is only in SQL Server 2000, calling TextCopy.exe to use xp_cmdshell or command to run a command to run without xp_cmdshell. This feature is difficult to use when developing injection, because step 2 is difficult to implement in the injected environment, if SQL Server and IIS are on the same machine, I think there are two ways to upload: 1, with sysadmin permissions If you don't have to say more, it is convenient to echo an ASP pony. 2, with DBO's default permissions, if you can write Trojan content into the temporary table, then generate an ASP Trojan with the Backup Database to File command. Source code is no longer available, you need example software, please contact me: Please leave your email address.
