https://github.com/Ryze-T/Sylas

数据库综合利用工具
https://github.com/Ryze-T/Sylas

Last synced: 7 months ago
JSON representation

数据库综合利用工具

• Host: GitHub
• URL: https://github.com/Ryze-T/Sylas
• Owner: Ryze-T
• Created: 2022-01-23T14:14:28.000Z (over 3 years ago)
• Default Branch: main
• Last Pushed: 2022-02-16T14:41:50.000Z (over 3 years ago)
• Last Synced: 2024-08-05T17:40:34.984Z (11 months ago)
• Size: 5.86 KB
• Stars: 530
• Watchers: 7
• Forks: 56
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• StarryDivineSky - Ryze-T/Sylas
• awesome-hacking-lists - Ryze-T/Sylas - 数据库综合利用工具 (Others)

README

        
# Sylas

数据库综合利用工具，预计春节后完成初版。


原理及使用说明


http://ryze-t.com/posts/2022/02/16/%E6%95%B0%E6%8D%AE%E5%BA%93%E8%BF%9E%E6%8E%A5%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7-Sylas.html

![image-20220123221805610](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220123221805.png)

## Postgresql

### 2022-2-15

完成文件读取、webshell上传、命令执行功能

## MSSQL

### 2022-2-14

增加CLR命令执行

![image-20220214023321058](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220214023321.png)

### 2022-2-13

增加读取文件功能：

![image-20220213181226555](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220213181226.png)

完成两种执行命令方式

![image-20220213000948591](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220213000948.png)

![image-20220213001019362](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220213001019.png)

### 2022-2-12

完成两种写shell方式

![image-20220212004116823](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220212004116.png)

### 2022-2-11

完成目录查看功能

![image-20220212003632520](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220212003632.png)

## Oracle

### 2022-2-10

完成文件上传功能

### 2022-1-23

完成文件查看功能与当前数据库目录获取：

![image-20220123222601344](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220123222601.png)

### 2022-1-22

完成命令执行功能----DBMS_SCHEDULER（无回显）

虽然无回显，但通过查询日志可判断命令是否执行成功：

![image-20220123222346159](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220123222346.png)

### 2022-1-21

完成命令执行功能----DBMS_XMLQUERY（可回显）

![image-20220123222004222](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220123222004.png)

针对windows，提供四个快速执行功能：进程信息、用户枚举、补丁信息、系统版本：

![image-20220123222131176](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220123222131.png)

![image-20220123222109562](https://gitee.com/tboom_is_here/pic/raw/master/2021-10-21/20220123222109.png)