Mysql系统表学习

0x00 学习任务概述

如何利用数据库的功能读写文件，需要什么样的条件才可以读写
学习数据库系统表功能，如何利用sql语句查询库名、表名、字段名、内容以及当前用户等基本信息，将学习过程中关键部分整理成报告
尝试查询处用户的hash，并使用hashcat来对获取的hash进行暴力破解

0x01 数据库读功能

读取文件函数
- load_file()
- load data infile()
- system cat
  load_file()和load data infile 读取文件的方法:新建一个表，读取文件为字符串形式插入表中，然后读出表中数据.
  需满足条件：
- 有file权限
- secure_file_priv值不为NULL

查看secure_file_priv是否为空

mysql> show global variables like "secure_file_priv";
+------------------+-------+
| Variable_name    | Value |
+------------------+-------+
| secure_file_priv |       |
+------------------+-------+
1 row in set (0.00 sec)

load_file

读取文件,首先在D盘下新建一个1.txt文件,内容：mysqlceshi
在数据库中新建一张表

create table text(cmd text);//新建一个text表，字段为cmd，文本类型

mysql> create table text(cmd text);
Query OK, 0 rows affected (0.04 sec)

mysql> insert into text(cmd) values(load_file('d:/1.txt'));//读取文件
Query OK, 1 row affected (0.00 sec)

mysql> select * from text;
+------------+
| cmd        |
+------------+
| mysqlceshi |
+------------+
1 row in set (0.00 sec)

读取成功!

load data infile

在注入中load_file经常被拦截，可以使用此方法绕过

mysql> load data infile 'd:/2.txt' into table text;//读取文件
Query OK, 1 row affected (0.00 sec)
Records: 1  Deleted: 0  Skipped: 0  Warnings: 0

mysql> select * from text;
+------------------+
| cmd              |
+------------------+
| mysqlceshi       |
| load data infile |
+------------------+
2 rows in set (0.00 sec)

system cat

mysql版本大于5.0时，也可以使用此命令读取文件,注意：此方法只能本地读取，远程无法使用，无法越权使用。

貌似windows下无法使用system cat函数???，测试没成功，使用以管理员运行的命令行也失败，难道只有在linux下才能成功?

0x02 数据库写(导出)

outfile
将数据库内容导出到某文件中,具有写(读写权限)

mysql> select * from text into outfile 'd:/3.txt';
Query OK, 2 rows affected (0.00 sec)

0x03 数据库系统表

安装mysql数据库后，数据库中默认会有三张表

information_schema
- 存在数据库所有信息，使用show databases;查看所有信息引用的就是此数据库中的内容

+---------------------------------------+
| Tables_in_information_schema          |
+---------------------------------------+
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_VARIABLES                      |
| KEY_COLUMN_USAGE                      |
| PARAMETERS                            |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLESPACES                           |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| VIEWS                                 |
| INNODB_BUFFER_PAGE                    |
| INNODB_TRX                            |
| INNODB_BUFFER_POOL_STATS              |
| INNODB_LOCK_WAITS                     |
| INNODB_CMPMEM                         |
| INNODB_CMP                            |
| INNODB_LOCKS                          |
| INNODB_CMPMEM_RESET                   |
| INNODB_CMP_RESET                      |
| INNODB_BUFFER_PAGE_LRU                |
+---------------------------------------+
40 rows in set (0.00 sec)

performance_schema
- 监控mysql server运行过程中的资源消耗情况

mysql> show tables;
+----------------------------------------------+
| Tables_in_performance_schema                 |
+----------------------------------------------+
| cond_instances                               |
| events_waits_current                         |
| events_waits_history                         |
| events_waits_history_long                    |
| events_waits_summary_by_instance             |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_global_by_event_name    |
| file_instances                               |
| file_summary_by_event_name                   |
| file_summary_by_instance                     |
| mutex_instances                              |
| performance_timers                           |
| rwlock_instances                             |
| setup_consumers                              |
| setup_instruments                            |
| setup_timers                                 |
| threads                                      |
+----------------------------------------------+
17 rows in set (0.00 sec)

mysql
- 数据库用户权限表，记录所有数据库、表能执行那些操作.

mysql> show tables;
+---------------------------+
| Tables_in_mysql           |
+---------------------------+
| columns_priv              |
| db                        |
| event                     |
| func                      |
| general_log               |
| help_category             |
| help_keyword              |
| help_relation             |
| help_topic                |
| host                      |
| ndb_binlog_index          |
| plugin                    |
| proc                      |
| procs_priv                |
| proxies_priv              |
| servers                   |
| slow_log                  |
| tables_priv               |
| time_zone                 |
| time_zone_leap_second     |
| time_zone_name            |
| time_zone_transition      |
| time_zone_transition_type |
| user                      |
+---------------------------+
24 rows in set (0.00 sec)

0x04 数据库查询操作

查询数据库中所有库名

mysql> select group_concat(schema_name) from information_schema.schemata;
+-----------------------------------------------------------------------------+
| group_concat(schema_name)                                                   |
+-----------------------------------------------------------------------------+
| information_schema,mag,mysql,performance_schema,study,test,ultrax,w3cschool |
+-----------------------------------------------------------------------------+
1 row in set (0.00 sec)

查询数据库中所有表名

---------------------------------------------------------------------------+
| group_concat(table_name)
---------------------------------------------------------------------------+
| CHARACTER_SETS,COLLATIONS,COLLATION_CHARACTER_SET_APPLICABILITY,COLUMNS,COLUMN_PRIVILEGES,ENGINES,EVENTS,FILES,GLOBAL_STATUS,GLOBAL_VARIABLES,KEY_COLUMN_USAGE,PARAMETERS,PARTITIONS,PLUGINS,PROCESSLIST,PROFILING,REFERENTIAL_CONSTRAINTS,ROUTINES,SCHEMATA,SCHEMA_PRIVILEGES,SESSION_STATUS,SESSION_VARIABLES,STATISTICS,TABLES,TABLESPACES,TABLE_CONSTRAINTS,TABLE_PRIVILEGES,TRIGGERS,USER_PRIVILEGES,VIEWS,INNODB_BUFFER_PAGE,INNODB_TRX,INNODB_BUFFER_POOL_STATS,INNODB_LOCK_WAITS,INNODB_CMPMEM,INNODB_CMP,INNODB_LOCKS,INNODB_CMPMEM_RESET,INNODB_CMP_RESET,INNODB_BUFFER_PAGE_LRU,mag,columns_priv,db,event,func,general_log,help_category,help_keyword,help_relation,help_topic,host,ndb_binlog_index,plugin,proc,procs_priv,proxies_priv,servers,slow_log,tables_priv,time_zone,time_zone_leap_second,time_zone_name,time_zone_transition,time_zone_transition_type,user,cond_instances,events_waits_current,events_waits_history,events_waits_history_long,events_waits_summary_by_instance,events_waits_summary_by_thread_by_event_name,events_wait |
----------------------------------------------------------
1 row in set, 1 warning (0.01 sec)

查询mag库下所有表（库名可用十六进制转换）

mysql> select group_concat(table_name) from information_schema.tables where table_schema=0x6D6167;
+--------------------------+
| group_concat(table_name) |
+--------------------------+
| mag                      |
+--------------------------+
1 row in set (0.00 sec)

mysql> select group_concat(table_name) from information_schema.tables where table_schema='mag';
+--------------------------+
| group_concat(table_name) |
+--------------------------+
| mag                      |
+--------------------------+
1 row in set (0.00 sec)

查询数据库下表中所有列

mysql> select group_concat(column_name) from information_schema.columns where table_name='mag';
+---------------------------+
| group_concat(column_name) |
+---------------------------+
| id,name,content           |
+---------------------------+
1 row in set (0.02 sec)

查询表中所有内容

mysql> select id,name,content from mag;
+----+----------+---------------------+
| id | name     | content             |
+----+----------+---------------------+
|  1 | admin    | dsadsa              |
|  2 | 信安之路 | 小白成长计划        |
|  3 | Time     | 好好学习，天天向上! |
+----+----------+---------------------+
3 rows in set (0.00 sec)

查询数据库当前用户

mysql> select user();
+----------------+
| user()         |
+----------------+
| root@localhost |
+----------------+
1 row in set (0.00 sec)

查询数据库当前数据库

mysql> select database();
+------------+
| database() |
+------------+
| mag        |
+------------+
1 row in set (0.00 sec)

查询数据库当前版本信息

mysql> select version();
+-----------+
| version() |
+-----------+
| 5.5.40    |
+-----------+
1 row in set (0.00 sec)

查询数据库当前存放绝对路径

mysql> select @@datadir;
+-------------------------+
| @@datadir               |
+-------------------------+
| D:\phpStudy\MySQL\data\ |
+-------------------------+
1 row in set (0.00 sec)

查询数据库中用户hash

mysql> select user,password from mysql.user;
+------+-------------------------------------------+
| user | password                                  |
+------+-------------------------------------------+
| root | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
| root | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
| time | *F050209D4168D5A2E90C044C5EAF99A0F91E9F2B |
| zara | *08F7D6C84224646B57BDF66A6480F337F403F10C |
+------+-------------------------------------------+
4 rows in set (0.00 sec)

0x05 hashcat爆破hash值

hashcat几种攻击模式
- Straight
  - 给定一个字典，hashcat会逐行读取字典中的内容，计算每行的hash值，于目标hash值相比较
    使用方法
    hashcat -a 0 -m 400 example400.hash(hash值) example.dict(字典)
- Combination
  - 组合两个密码字典的内容，hashcat进行组合匹配来比较
    使用方法
    hashcat -m 0 -a 1 hash.txt dict1.txt dict2.txt
    相关参数
    -j, --rule-left
    -k, --rule-right
- Mask Attack
  - mask是字符串，由若干个占位符组成,“?|”是一个占位符,其中的“?”是关键字，用于修饰其后的“l”，“?l”合起来表示一个字符集合，除“?l”外，还可以有“?u”、“?d”、“?h”、“?H”、“?s”、“?a”和“?b”，代表的字符集合如下表所
    ? Charset
    l abcdefghijklmnopqrstuvwxyz
    u ABCDEFGHIJKLMNOPQRSTUVWXYZ
    d 0123456789
    h 0123456789abcdef
    H 0123456789ABCDEF
    s ! “#$%&'()*+,-./:;<=>?@[\]^_`~{|}
    a ?l?u?d?s
    b 0x00 – 0xff

hash值

| root | *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B |
| time | *F050209D4168D5A2E90C044C5EAF99A0F91E9F2B

命令

.\hashcat64.exe -a 0 -m 300 --force F050209D4168D5A2E90C044C5EAF99A0F91E9F2B .\1.dict -o 2.txt

本来是爆破成功的，但是忘记截图了。。。现在重新跑提示不支持。。测试半天失败。

不过刚刚把爆破成功的问题打开了，所以这边直接截图爆破成功的文本文件,作为成功结果….