MS Access SQL Injection
Last updated
Last updated
Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Mchanganyiko wa nyuzi unaweza kufanyika kwa kutumia wahusika & (%26) na + (%2b).
Hakuna maoni katika MS access, lakini inaonekana inawezekana kuondoa ya mwisho ya swali kwa kutumia herufi ya NULL:
Ikiwa hii haifanyi kazi, unaweza kila wakati kurekebisha sintaksia ya ombi:
Hazirishi.
Mwandiko wa LIMIT haujawekwa. Hata hivyo, inawezekana kupunguza matokeo ya swali la SELECT kwa safu za kwanza N za jedwali kwa kutumia mwandiko wa TOP. TOP inakubali kama hoja nambari, ikiwakilisha idadi ya safu zitakazorejeshwa.
Just like TOP you can use LAST which will get the rows from the end.
In a SQLi you usually will want to somehow execute a new query to extract information from other tables. MS Access always requires that in subqueries or extra queries a FROM is indicated.
So, if you want to execute a UNION SELECT or UNION ALL SELECT or a SELECT between parenthesis in a condition, you always need to indicate a FROM with a valid table name.
Therefore, you need to know a valid table name.
Hii itakuruhusu kutoa thamani za jedwali la sasa bila kuhitaji kujua jina la jedwali.
MS Access inaruhusu sintaksia za ajabu kama '1'=2='3'='asd'=false. Kama kawaida, SQL injection itakuwa ndani ya WHERE clause tunaweza kuitumia hiyo.
Fikiria una SQLi katika hifadhidata ya MS Access na unajua (au umekisia) kwamba jina moja la safu ni username, na hiyo ndiyo sehemu unayotaka kutoa. Unaweza kuangalia majibu tofauti ya programu ya wavuti wakati mbinu ya chaining equals inatumika na kwa uwezekano kutoa maudhui kwa kutumia boolean injection kwa kutumia Mid function kupata substrings.
Ikiwa unajua jina la jedwali na safu ya kutupa unaweza kutumia mchanganyiko kati ya Mid, LAST na TOP ili kuvuja taarifa zote kupitia boolean SQLi:
Feel free to check this in the online playground.
Using the chaining equals technique you can also bruteforce table names with something like:
Unaweza pia kutumia njia ya jadi zaidi:
Feel free to check this in the online playground.
Sqlmap majina ya meza ya kawaida: https://github.com/sqlmapproject/sqlmap/blob/master/data/txt/common-tables.txt
Kuna orodha nyingine katika http://nibblesec.org/files/MSAccessSQLi/MSAccessSQLi.html
Unaweza kujaribu majina ya safu za sasa kwa kutumia hila ya kuunganisha sawa na:
Au kwa group by:
Au unaweza kulazimisha majina ya safu za meza tofauti kwa:
Tumesha jadili mbinu ya kuunganisha sawa kutoa data kutoka kwa jedwali la sasa na mengine. Lakini kuna njia nyingine:
Kwa kifupi, ombi linatumia taarifa ya "ikiwa-kisha" ili kuanzisha "200 OK" katika kesi ya mafanikio au "500 Internal Error" vinginevyo. Kwa kutumia opereta ya TOP 10, inawezekana kuchagua matokeo kumi ya kwanza. Matumizi yanayofuata ya LAST yanaruhusu kuzingatia tuple ya 10 tu. Kwenye thamani hiyo, kwa kutumia opereta ya MID, inawezekana kufanya kulinganisha kwa wahusika rahisi. Kwa kubadilisha ipasavyo index ya MID na TOP, tunaweza kutoa maudhui ya uwanja wa "username" kwa safu zote.
Mid('admin',1,1) pata sehemu ya wahusika kutoka nafasi 1 urefu 1 (nafasi ya awali ni 1)
LEN('1234') pata urefu wa mfuatano
ASC('A') pata thamani ya ascii ya wahusika
CHR(65) pata mfuatano kutoka thamani ya ascii
IIF(1=1,'a','b') ikiwa kisha
COUNT(*) Hesabu idadi ya vitu
Kutoka hapa unaweza kuona ombi la kupata majina ya meza:
However, note that is very typical to find SQL Injections where you don't have access to read the table MSysObjects.
The knowledge of the web root absolute path may facilitate further attacks. If application errors are not completely concealed, the directory path can be uncovered trying to select data from an inexistent database.
http://localhost/script.asp?id=1'+'+UNION+SELECT+1+FROM+FakeDB.FakeTable%00
MS Access responds with an error message containing the web directory full pathname.
The following attack vector can be used to inferrer the existence of a file on the remote filesystem. If the specified file exists, MS Access triggers an error message informing that the database format is invalid:
http://localhost/script.asp?id=1'+UNION+SELECT+name+FROM+msysobjects+IN+'\boot.ini'%00
Another way to enumerate files consists into specifying a database.table item. If the specified file exists, MS Access displays a database format error message.
http://localhost/script.asp?id=1'+UNION+SELECT+1+FROM+C:\boot.ini.TableName%00
Database file name (.mdb) can be inferred with the following query:
http://localhost/script.asp?id=1'+UNION+SELECT+1+FROM+name[i].realTable%00
Where name[i] is a .mdb filename and realTable is an existent table within the database. Although MS Access will always trigger an error message, it is possible to distinguish between an invalid filename and a valid .mdb filename.
Access PassView ni zana ya bure ambayo inaweza kutumika kurejesha nenosiri kuu la database la Microsoft Access 95/97/2000/XP au Jet Database Engine 3.0/4.0.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
