发新话题
打印

[讨论]入侵时遇到的注入问题

[讨论]入侵时遇到的注入问题

议题作者:MeltRain
信息来源:邪恶八进制信息安全团队(www.eviloctal.com

http://www.aaaaaa.edu.cn/web/jyzc/listInfo.php?areaId=386
http://www.bbbbbb.gov.cn/xxgk/in ... _code=4020520060005

这两个是注入点,可以猜到管理表,但找不到后台

PHPMYADMIN在www.bbbbbb.gov.cn/PHPMYADMIN有密码验证
我试时可以读出/ETC/PASSWD,但读PHP时没显示


我的朋友告诉我可以读出php文件在html代码里,但是他又不把测试代码发给我。
我没成功,还有在尝试导出文件时出错,他说是magic_quotes_gpc=on,但我测试时加'号显示出绝对路径


另外,因为在网吧我没扫过他的主机,MYSQL不知道允不允许远程连接,还有第二个注入点暴错时会出来SQL语句。

请各位指点迷津,谢谢!
http://www.txtb.cn 我的博客

TOP


爆出绝对路径了还不简单呀
你用load_file函数去读他的代码呀
在邪恶八进制里面搜索一下
有专门的文章哟

补充一下
楼主,你看看你的这两个注入点的网站的域名
请不要测试这类型的网站
而且就算测试也不要在邪恶八进制上面发出来域名
谢谢

TOP

我用了,读得出/ETC/PASSWD,但读不出PHP文件
不知道为什么 [s:73]
http://www.txtb.cn 我的博客

TOP

可能是被隐藏在代码里面了
你用查看源代码试试呢?

TOP

事实上我试了试,检查了没有

但另一个人说检查了有,他说是在HTML代码里,不知道他是不是真的检测了,总之我没成功

他现在不在。改天我再去问问他吧
http://www.txtb.cn 我的博客

TOP

在html代码里没有!!可能是没有读php代码的权限

TOP

有读/ETC/PASSWD的权限,没读PHP的权限,我没试时似乎可以读出USER目录的注册页面

TOP

晕~~还真的是读得出注册页面的文件

TOP

这是怎么回事啊,变态~找到了PHPMYADMIN。。。

TOP

有了PHPMYADMIN,你可以用load_file()读出数据库连接文件里面的MYSQL连接用户密码,然后用这个密码来登录PHPMYADMIN,再用select语句导出一句话木马到WEB目录来获得WEBSHELL.
每个人都有属于自已的世界,人生因此而精彩,HACK就是我的世界!

TOP

很多时候,phpmyadmin配置文件里的账号和密码就算得到也打不开phpmyadmin.

TOP

问一下PHPMYADMIN的数据库连接文件是哪个文件

TOP

?php /* $Id: config.inc.php,v 1.71 2002/02/13 20:34:12 lem9 Exp $ */ /** * phpMyAdmin Configuration File * * All directives are explained in Documentation.html */ /** * Bookmark Table Structure * * CREATE TABLE bookmark ( * id int(11) DEFAULT '0' NOT NULL auto_increment, * dbase varchar(255) NOT NULL, * user varchar(255) NOT NULL, * label varchar(255) NOT NULL, * query text NOT NULL, * PRIMARY KEY (id) * ); * */ /** * Your phpMyAdmin url * * Complete the variable below with the full url ie * http://www.your_web.net/path_to_your_phpMyAdmin_directory/ */ $cfgPmaAbsoluteUri = ''; /** * Server(s) configuration */ // The $cfgServers array starts with $cfgServers[1]. Do not use $cfgServers[0]. // You can disable a server config entry by setting host to ''. $cfgServers[1]['host'] = 'localhost'; // MySQL hostname $cfgServers[1]['port'] = ''; // MySQL port - leave blank for default port $cfgServers[1]['socket'] = ''; // Path to the socket - leave blank for default socket $cfgServers[1]['connect_type'] = 'tcp'; // How to connect to MySQL server ('tcp' or 'socket') $cfgServers[1]['stduser'] = ''; // MySQL standard user settings (this user must have read-only $cfgServers[1]['stdpass'] = ''; // access to the "mysql/user" and "mysql/db" tables) $cfgServers[1]['auth_type'] = 'config'; // Authentication method (config, http or cookie based)? $cfgServers[1]['user'] = 'root'; // MySQL user $cfgServers[1]['password'] = ''; // MySQL password (only needed with 'config' auth) $cfgServers[1]['only_db'] = ''; // If set to a db-name, only this db is displayed at left frame // It may also be an array of db-names $cfgServers[1]['verbose'] = ''; // Verbose name for this host - leave blank to show the hostname $cfgServers[1]['bookmarkdb'] = ''; // Bookmark db - leave blank for no bookmark support $cfgServers[1]['bookmarktable'] = ''; // Bookmark table - leave blank for no bookmark support $cfgServers[1]['relation'] = ''; // table to describe the relation between links (see doc) // - leave blank for no relation-links support $cfgServers[2]['host'] = ''; $cfgServers[2]['port'] = ''; $cfgServers[2]['socket'] = ''; $cfgServers[2]['connect_type'] = 'tcp'; $cfgServers[2]['stduser'] = ''; $cfgServers[2]['stdpass'] = ''; $cfgServers[2]['auth_type'] = 'config'; $cfgServers[2]['user'] = 'root'; $cfgServers[2]['password'] = ''; $cfgServers[2]['only_db'] = ''; $cfgServers[2]['verbose'] = ''; $cfgServers[2]['bookmarkdb'] = ''; $cfgServers[2]['bookmarktable'] = ''; $cfgServers[2]['relation'] = ''; $cfgServers[3]['host'] = ''; $cfgServers[3]['port'] = ''; $cfgServers[3]['socket'] = ''; $cfgServers[3]['connect_type'] = 'tcp'; $cfgServers[3]['stduser'] = ''; $cfgServers[3]['stdpass'] = ''; $cfgServers[3]['auth_type'] = 'config'; $cfgServers[3]['user'] = 'root'; $cfgServers[3]['password'] = ''; $cfgServers[3]['only_db'] = ''; $cfgServers[3]['verbose'] = ''; $cfgServers[3]['bookmarkdb'] = ''; $cfgServers[3]['bookmarktable'] = ''; $cfgServers[3]['relation'] = ''; // If you have more than one server configured, you can set $cfgServerDefault // to any one of them to autoconnect to that server when phpMyAdmin is started, // or set it to 0 to be given a list of servers without logging in // If you have only one server configured, $cfgServerDefault *MUST* be // set to that server. $cfgServerDefault = 1; // Default server (0 = no default server) $cfgServer = ''; unset($cfgServers[0]); /** * Other core phpMyAdmin settings */ $cfgOBGzip = TRUE; // use GZIP output buffering if possible $cfgPersistentConnections = FALSE; // use persistent connections to MySQL database $cfgExecTimeLimit = 300; // maximum execution time in seconds (0 for no limit) $cfgSkipLockedTables = FALSE; // mark used tables, make possible to show // locked tables (since MySQL 3.23.30) $cfgShowSQL = TRUE; // show SQL queries as run $cfgAllowUserDropDatabase = FALSE; // show a 'Drop database' link to normal users $cfgConfirm = TRUE; // confirm 'DROP TABLE' & 'DROP DATABASE' $cfgLoginCookieRecall = TRUE; // recall previous login in cookie auth. mode or not $cfgShowStats = TRUE; // allow to display statistics and space usage in // the pages about database details and table // properties $cfgShowTooltip = TRUE; // display table comment as tooltip in left frame // Left frame setup $cfgLeftFrameLight = TRUE; // use a select-based menu and display only the // current tables in the left frame. (experimental) // In the main frame, at startup... $cfgShowMysqlInfo = FALSE; // whether to display the "MySQL runtime $cfgShowMysqlVars = FALSE; // information", "MySQL system variables" and "PHP $cfgShowPhpInfo = FALSE; // information" links for simple users or not // In browse mode... $cfgShowBlob = FALSE; // display blob field contents $cfgNavigationBarIconic = TRUE; // do not display text inside navigation bar buttons $cfgShowAll = FALSE; // allows to display all the rows $cfgMaxRows = 30; // maximum number of rows to display $cfgOrder = 'ASC'; // default for 'ORDER BY' clause (valid // values are 'ASC', 'DESC' or 'SMART' -ie // descending order for fields of type // TIME, DATE, DATETIME & TIMESTAMP, // ascending order else-) // In edit mode... $cfgProtectBinary = 'blob'; // disallow editing of binary fields // valid values are: // FALSE allow editing // 'blob' allow editing except for BLOB fields // 'all' disallow editing $cfgShowFunctionFields = TRUE; // Display the function fields in edit/insert mode $cfgZipDump = TRUE; // Allow the use of zip/gzip/bzip $cfgGZipDump = TRUE; // compression for $cfgBZipDump = TRUE; // dump files /** * Link to the official MySQL documentation * Be sure to include no trailing slash on the path */ $cfgManualBaseShort = 'http://www.mysql.com/doc'; /** * Language settings */ // Default language to use, if not browser-defined or user-defined $cfgDefaultLang = 'en'; // Force: always use this language - must be defined in // libraries/select_lang.lib.php // $cfgLang = 'en'; // Loads language file require('./libraries/select_lang.lib.php'); /** * Customization & design */ $cfgLeftWidth = 150; // left frame width $cfgLeftBgColor = '#D0DCE0'; // background color for the left frame $cfgLeftPointerColor = '#CCFFCC'; // color of the pointer in left frame // (blank for no pointer) $cfgRightBgColor = '#F5F5F5'; // background color for the right frame $cfgBorder = 0; // border width on tables $cfgThBgcolor = '#D3DCE3'; // table header row colour $cfgBgcolorOne = '#CCCCCC'; // table data row colour $cfgBgcolorTwo = '#DDDDDD'; // table data row colour, alternate $cfgBrowsePointerColor = '#CCFFCC'; // color of the pointer in browse mode // (blank for no pointer) $cfgBrowseMarkRow = 0; // if set to 1, // and $cfgBrowsePointerColor has a // value, you can click on rows to // visually mark them with this color $cfgTextareaCols = 40; // textarea size (columns) in edit mode $cfgTextareaRows = 7; // textarea size (rows) in edit mode $cfgLimitChars = 50; // max field data length in browse mode $cfgModifyDeleteAtLeft = TRUE; // show edit/delete links on left side of browse // (or at the top with vertical browse) $cfgModifyDeleteAtRight = FALSE; // show edit/delete links on right side of browse // (or at the bottom with vertical browse) $cfgDefaultDisplay = 'horizontal'; // default display direction (horizontal|vertical) $cfgRepeatCells = 100; // repeat header names every X cells? (0 = deactivate) /** * MySQL settings */ // Column types $cfgColumnTypes = array( 'TINYINT', 'SMALLINT', 'MEDIUMINT', 'INT', 'BIGINT', 'FLOAT', 'DOUBLE', 'DECIMAL', 'DATE', 'DATETIME', 'TIMESTAMP', 'TIME', 'YEAR', 'CHAR', 'VARCHAR', 'TINYBLOB', 'TINYTEXT', 'TEXT', 'BLOB', 'MEDIUMBLOB', 'MEDIUMTEXT', 'LONGBLOB', 'LONGTEXT', 'ENUM', 'SET' ); // Atributes $cfgAttributeTypes = array( '', 'BINARY', 'UNSIGNED', 'UNSIGNED ZEROFILL' ); // Available functions if ($cfgShowFunctionFields) { $cfgFunctions = array( 'ASCII', 'CHAR', 'SOUNDEX', 'LCASE', 'UCASE', 'NOW', 'PASSWORD', 'MD5', 'ENCRYPT', 'RAND', 'LAST_INSERT_ID', 'COUNT', 'AVG', 'SUM', 'CURDATE', 'CURTIME', 'FROM_DAYS', 'FROM_UNIXTIME', 'PERIOD_ADD', 'PERIOD_DIFF', 'TO_DAYS', 'UNIX_TIMESTAMP', 'USER', 'WEEKDAY' ); } // end if /** * Unset magic_quotes_runtime - do not change! */ set_magic_quotes_runtime(0); ?>

config.inc.php,读出来这个,应该是ROOT用户,密码为空吧?MYSQL只允许本地连接?能不能详细介绍下利用PHPMYADMIN的方法

TOP

刚又去翻了翻,$cfgServers[1]['auth_type'] = 'config'采用这种验证方式,是不是一定要本地才能登机?还有没有办法

TOP

用root登陆phpmyadmin看下,有一次我就是这样成功的,进去后成功导出shell~~

TOP

config.inc.php好象是这个文件我记得。

TOP

不行喔。。。照这里显示ROOT应该是空的吧?登陆不上PHPMYADMIN
你成功过没

TOP

能读passwd就先去跑一下吧,说不定有意外的收获,一般网站的用户都超级的多,呵呵,若口令不在少数

TOP

检测LINUX弱口令有没有比较快的软件?

TOP

john,jack。还有乱刀,流光都可以

TOP

phmyadmin在CONFIG设置可以只能有本机登陆,如果这样的话 你就没办法登陆上去了。

TOP

已经拿到WEBSHELL了,问下有没有LINUX下清日志的教程?

TOP

发新话题