{"id":89,"date":"2016-08-24T23:09:10","date_gmt":"2016-08-24T15:09:10","guid":{"rendered":"http:\/\/ayonel.me\/?p=89"},"modified":"2016-08-25T09:51:04","modified_gmt":"2016-08-25T01:51:04","slug":"do_some_hack","status":"publish","type":"post","link":"https:\/\/ayonel.malash.net\/index.php\/2016\/08\/24\/do_some_hack\/","title":{"rendered":"SQL\u6ce8\u5165\u5b9e\u6218"},"content":{"rendered":"

\u6211\u76f8\u4fe1\u6bcf\u4e2a\u7a0b\u5e8f\u5458\u5fc3\u91cc\u90fd\u6709\u4e00\u4e2a\u9ed1\u5ba2\u68a6\uff0c\u6211\u4e5f\u4e0d\u4f8b\u5916\u3002\u672c\u79d1\u56db\u5e74\uff0c\u820d\u53cbmalash\u5927\u795e<\/a>\u5929\u5929\u9068\u6e38\u5728\u5b66\u6821\u7684\u5404\u79cd\u670d\u52a1\u5668\u4e4b\u95f4\uff0cxss,sql\u6ce8\u5165\uff0cshell\u63d0\u6743\u4fe1\u624b\u62c8\u6765\uff0c\u8bf7\u5141\u8bb8\u6211\u518d\u6b21\u732e\u4e0a\u6211\u7684\u819d\u76d6\u3002
\n\u597d\u4e86\uff0c\u5e9f\u8bdd\u4e0d\u591a\u8bf4\u3002\u6700\u8fd1\u518d\u770b\u4e00\u4e9bweb\u5b89\u5168\u76f8\u5173\u7684\u4e1c\u4e1c\uff0c\u5bf9sql\u6ce8\u5165\u7684\u539f\u7406\u4e5f\u6709\u4e86\u66f4\u4e3a\u6df1\u523b\u7684\u7406\u89e3\uff0c\u4f46\u7eb8\u4e0a\u5f97\u6765\u7ec8\u89c9\u6d45\uff0c\u6211\u7684\u56db\u5341\u7c73\u5927\u5200\u65e9\u5df2\u9965\u6e34\u96be\u8010\u4e86\u3002
\n0x00 \u5bfb\u627e\u730e\u7269<\/strong>
\n\u5176\u5b9e\u8fd9\u4e2a\u730e\u7269\u6211\u5fc3\u91cc\u65e9\u5c31\u6709\u4e86\uff0c\u8fd9\u6b21\u5c31\u662f\u62ff\u4ed6\u6765\u7ec3\u624b\u3002\u9274\u4e8e\u548c\u8c10\u539f\u56e0\uff0c\u6682\u4e0d\u516c\u5e03\u76ee\u6807\u3002<\/p>\n

0x01 \u5148\u6765\u70b9\u5c0f\u6d4b\u8bd5<\/strong>
\n\u672c\u6765\u8fd8\u60f3\u5148\u4ece\u627e\u51fa\u7ba1\u7406\u5458\u767b\u5f55\u9875\u9762\u5f00\u59cb\uff0c\u90fd\u5df2\u7ecf\u4e0b\u597d\u4e86\u8def\u5f84\u626b\u63cf\u5de5\u5177\u3002\u4f46\u662f\u5f53\u65f6\u8036\u7a23\u7684\u5149\u8292\u7167\u4eae\u4e86\u6211\uff0c\u624b\u6296\u4e86\u4e00\u4e0b\uff0c\u5728\u76ee\u6807\u57df\u540d\u540e\u63a5\u4e86\u4e2a\u2018\/admin\u2019,\u5c31\u76f4\u63a5\u8df3\u8f6c\u5230\u7ba1\u7406\u5458\u767b\u5f55\u9875\u9762\u4e86\uff0c\u65e0\u8bed\u3002\u3002\u3002\u3002
\n\"881F332B-CB90-4D8B-907A-024CD7E1BF47\"
\n\u8fd9\u4e00\u4e0b\u5c31\u4ee4\u5076\u4fe1\u5fc3\u5927\u589e\uff0c\u6709\u7b80\u5355\u6d4b\u4e86\u4e00\u4e0b\uff0c\u9a8c\u8bc1\u7801\u662f\u6302\u4e86\uff0c\u591a\u6b21\u63d0\u4ea4\u9a8c\u8bc1\u7801\u4e0d\u4f1a\u5237\u65b0\uff0c\u8fd9\u7b80\u76f4\u662f\u723d\u7684\u4e0d\u8981\u4e0d\u8981\u554a\u3002\u5e76\u4e14\u5bf9\u7ba1\u7406\u5458\u7528\u6237\u540d\u7684\u6b63\u786e\u4e0e\u5426\u8fd8\u6709\u63d0\u793a\uff0c\u7b80\u76f4\u4e86\u3002\u3002\u3002
\n\u8f93\u5165\u9519\u8bef\u7684\u7ba1\u7406\u5458\u7528\u6237\u540d\uff0c\u4f1a\u63d0\u793a:
\n\"2643AB97-03F2-412B-8C89-0D08923E9353\"
\n\u5728\u7ba1\u7406\u5458\u5904\u8f93\u5165admin,\u5219\u63d0\u793a\uff1a
\n\"admin\"
\n\u8fd9\u540e\u53f0\u8fd8\u771f\u662f\u8d34\u5fc3\u554a\u3002
\n0x02 burpsuite\u767b\u573a
\n<\/strong>\u5230\u8fd9\uff0c\u9a8c\u8bc1\u7801\u662f\u6302\u7684\uff0c\u53c8\u77e5\u9053\u7528\u6237\u540d\uff0c\u5c31\u552f\u72ec\u5dee\u4e00\u4e2a\u5bc6\u7801\u4e86\u3002\u7528burpsuite\u795e\u5668\u622a\u5305\u5e76\u66b4\u529b\u7834\u89e3\uff0c\u5927\u7ea6\u8dd1\u4e862\u4e2a\u591a\u5c0f\u65f6\uff0c\u57fa\u672c\u7684\u5e38\u89c1\u7684\u5b57\u5178\u90fd\u8dd1\u5b8c\u4e86\uff0c\u8fd8\u662f\u6ca1\u8dd1\u51fa\u6765\u3002\u6211\u77e5\u9053\u8fd9\u6761\u8def\u73b0\u5728\u662f\u884c\u4e0d\u901a\u4e86\u3002\u770b\u6765\u5f97\u6362\u4e00\u4e0b\u601d\u8def\u3002
\n0x03 \u627e\u51fa\u540e\u53f0\u6846\u67b6
\n<\/strong>\u90ae\u4ef6\u5ba1\u67e5\u4e86\u4e00\u4e0b\u7ba1\u7406\u5458\u767b\u5f55\u9875\u9762\u7684\u6e90\u7801\uff0c
\n\"AF454890-A7B2-4C71-9C7F-3B46DF157715\"
\n\u8868\u5355\u63d0\u4ea4\u6a21\u5757\u540d\u662fxdcms\uff0c\u5927\u6982\u767e\u5ea6\u4e86\u4e00\u4e0b\uff0c\u8fd9\u662f\u4e00\u4e2aphp\u5199\u7684cms\uff0c\u5728\u6211\u5927\u4e4c\u4e91(\u5929\u4f51\u6211\u4e4c\u4e91, \u4e16\u7eaa\u4f73\u7f18\u4e0d\u8981\u78a7\u83b2)\u4e0a\u627e\u4e86\u4e00\u756a\uff0c\u8fd9\u6846\u67b6\u7b80\u76f4\u60e8\u4e0d\u5fcd\u7779\u554a\uff0c\u7ffb\u4e86\u51e0\u9875\u90fd\u6ca1\u7ffb\u5b8c\u3002
\n0x04 Sql\u6ce8\u5165
\n<\/strong>\u9010\u4e2a\u8bd5\u4e86\u597d\u51e0\u4e2a\u6f0f\u6d1e\uff0c\u7ec8\u4e8e\u627e\u89c1\u4e86\u4e00\u4e2a\u80fd\u7528\u7684\u3002\u76f4\u63a5\u4e0a\u4ee3\u7801\uff1a
\n\u7528\u6237\u540d\u8f93\u5165\uff1a<\/p>\n

admin' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14 FROM (SELECT count(1),concat(round(rand(0)),(SELECT concat(username,0\u00d723,password) FROM c_admin LIMIT 0,1))a FROM information_schema.tables GROUP by a)b#<\/div><\/div>\n

\u5bc6\u7801\u968f\u610f\u586b\uff0c\u5199\u4e0a\u9a8c\u8bc1\u7801\uff0c\u70b9\u51fb\u767b\u5f55\uff1a
\n\"result\"
\n\u53ef\u4ee5\u770b\u5230\u5df2\u7ecf\u7206\u51fa\u4e86\u52a0\u5bc6\u7684\u7ba1\u7406\u5458\u5bc6\u7801\uff0c\u8fd9\u4e2a\u5bc6\u7801\u662f\u4e24\u5c42md5\u52a0\u5bc6\u3002
\n0x05 \u4e07\u80fd\u7684\u6dd8\u5b9d
\n<\/strong>cmd5\u4e0a\u89e3\u90a3\u4e2amd5\u4e32\u6ca1\u89e3\u51fa\u6765\uff0c\u8fd8\u662f\u4e07\u80fd\u7684\u6dd8\u5b9d\u7ed9\u529b\uff0c\u8fd9\u513f\u5c31\u4e0d\u7ed9\u5e7f\u544a\u4e86\u3002\u8fdb\u53bb\u4e4b\u540e\uff0c\u4e5f\u6ca1\u5565\u597d\u770b\u7684\uff0c\u8fd8\u662f\u4e3a\u4e86\u548c\u8c10\uff0c\u5c31\u4e0d\u653e\u56fe\u4e86\uff0c\u5927\u5bb6\u81ea\u884c\u8111\u8865\u3002
\n0x06 \u603b\u7ed3
\n<\/strong>\u7b2c\u4e00\u6b21\u9ed1\u7f51\u7ad9\uff0c\u5fc3\u60c5\u8fd8\u662f\u5f88\u6fc0\u52a8\u7684\u3002\u4e5f\u8e29\u4e86\u5f88\u591a\u5751\uff0c\u8981\u662f\u65e9\u77e5\u9053\u7528\u7684xdcms\uff0c\u76f4\u63a5\u6765\u4e4c\u4e91\u5c31\u53ef\u4ee5\u4e86\uff0c\u8fd8\u8d39\u4e86\u4e00\u4e9b\u65f6\u95f4\u5b66\u4e60burpsuite.\u5176\u5b9e\u597d\u591a\u7f51\u7ad9\u6f0f\u6d1e\u4e00\u5927\u5806\uff0c\u5728\u6211\u6765\u4e4b\u524d\u8bf4\u4e0d\u5b9a\u65e9\u6709\u4eba\u5df2\u7ecf\u8e29\u8fc7\u70b9\u4e86\u3002\u3002
\n\u5728\u767b\u9646\u6210\u529f\u7684\u4e00\u5239\u90a3\uff0c\u8fd8\u662f\u5f88\u6709\u6210\u5c31\u611f\u7684\u3002\u8fd9\u6761\u8def\u597d\u957f\uff0c\u4e14\u884c\u4e14\u73cd\u60dc\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u6211\u76f8\u4fe1\u6bcf\u4e2a\u7a0b\u5e8f\u5458\u5fc3\u91cc\u90fd\u6709\u4e00\u4e2a\u9ed1\u5ba2\u68a6\uff0c\u6211\u4e5f\u4e0d\u4f8b\u5916\u3002\u672c\u79d1\u56db\u5e74\uff0c\u820d\u53cbmalash\u5927\u795e\u5929\u5929\u9068\u6e38\u5728\u5b66\u6821\u7684\u5404\u79cd\u670d\u52a1\u5668\u4e4b\u95f4\uff0c […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-89","post","type-post","status-publish","format-standard","hentry","category-websecurity"],"_links":{"self":[{"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/posts\/89","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/comments?post=89"}],"version-history":[{"count":10,"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/posts\/89\/revisions"}],"predecessor-version":[{"id":109,"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/posts\/89\/revisions\/109"}],"wp:attachment":[{"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/media?parent=89"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/categories?post=89"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ayonel.malash.net\/index.php\/wp-json\/wp\/v2\/tags?post=89"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}