SQL混淆攻击技术深度解析

0x00 研究背景与概述

近年来数据泄露事件呈爆发式增长，仅2017年上半年就发生了2,227次数据泄露事件，涉及超过60亿条记录。数据库服务器成为攻击者的主要目标，无论是外部攻击者还是内部威胁。

本研究通过构建包含多种流行数据库(Microsoft SQL Server、MySQL、Oracle和MongoDB)的蜜罐网络，对数据库攻击行为进行了为期六个月的监控。研究发现SQL混淆是攻击者绕过安全防护机制的主要技术手段之一。

0x01 SQL混淆技术原理

SQL混淆是一种绕过安全检测的技术，通过对SQL语句进行变形处理，使其在保持攻击功能的同时，逃避基于模式的安全机制检测。主要特点包括：

• 目的：绕过Web应用程序防火墙(WAF)和数据库活动监视(DAM)解决方案
• 核心思想：将可读性强的SQL语句转换为难以识别的形式
• 常见方法：SQL HEX编码（将明文SQL转换为十六进制字符）

示例：

• 原始SQL：select * from passwords
• 混淆后：73656C656374202A2066726F6D2070617373776F726473

0x02 SQL HEX编码攻击模式分析

Microsoft SQL Server攻击模式

基本模式

DECLARE @a VARCHAR(8000); SET @a=0x[HEX编码的SQL命令]; EXEC(@a);

文件写入攻击模式

DECLARE @a VARCHAR(8000); SET @a=0x[HEX编码的恶意payload];
CREATE TABLE [dbo].[data]([data] image);
INSERT INTO [dbo].[data]([data]) VALUES (@a);
DECLARE @b VARCHAR(8000); SET @b=(SELECT [data] FROM [dbo].[data]);
DECLARE @c INT; SET @c=1;
DECLARE @d INT; SET @d=DATALENGTH(@b);
DECLARE @e VARBINARY(8000); SET @e=0x;
WHILE @c<=@d BEGIN
    SET @e=@e+SUBSTRING(@b,@c,1);
    SET @c=@c+1;
END
DECLARE @f INT; SET @f=1;
DECLARE @g INT; SET @g=DATALENGTH(@e);
DECLARE @h VARBINARY(8000); SET @h=0x;
WHILE @f<=@g BEGIN
    SET @h=@h+SUBSTRING(@e,@f,1);
    SET @f=@f+1;
END
DECLARE @i INT; SET @i=1;
DECLARE @j INT; SET @j=DATALENGTH(@h);
DECLARE @k VARBINARY(8000); SET @k=0x;
WHILE @i<=@j BEGIN
    SET @k=@k+SUBSTRING(@h,@i,1);
    SET @i=@i+1;
END
DECLARE @l INT; SET @l=1;
DECLARE @m INT; SET @m=DATALENGTH(@k);
DECLARE @n VARBINARY(8000); SET @n=0x;
WHILE @l<=@m BEGIN
    SET @n=@n+SUBSTRING(@k,@l,1);
    SET @l=@l+1;
END
DECLARE @o INT; SET @o=1;
DECLARE @p INT; SET @p=DATALENGTH(@n);
DECLARE @q VARBINARY(8000); SET @q=0x;
WHILE @o<=@p BEGIN
    SET @q=@q+SUBSTRING(@n,@o,1);
    SET @o=@o+1;
END
DECLARE @r INT; SET @r=1;
DECLARE @s INT; SET @s=DATALENGTH(@q);
DECLARE @t VARBINARY(8000); SET @t=0x;
WHILE @r<=@s BEGIN
    SET @t=@t+SUBSTRING(@q,@r,1);
    SET @r=@r+1;
END
DECLARE @u INT; SET @u=1;
DECLARE @v INT; SET @v=DATALENGTH(@t);
DECLARE @w VARBINARY(8000); SET @w=0x;
WHILE @u<=@v BEGIN
    SET @w=@w+SUBSTRING(@t,@u,1);
    SET @u=@u+1;
END
DECLARE @x INT; SET @x=1;
DECLARE @y INT; SET @y=DATALENGTH(@w);
DECLARE @z VARBINARY(8000); SET @z=0x;
WHILE @x<=@y BEGIN
    SET @z=@z+SUBSTRING(@w,@x,1);
    SET @x=@x+1;
END
DECLARE @aa INT; SET @aa=1;
DECLARE @ab INT; SET @ab=DATALENGTH(@z);
DECLARE @ac VARBINARY(8000); SET @ac=0x;
WHILE @aa<=@ab BEGIN
    SET @ac=@ac+SUBSTRING(@z,@aa,1);
    SET @aa=@aa+1;
END
DECLARE @ad INT; SET @ad=1;
DECLARE @ae INT; SET @ae=DATALENGTH(@ac);
DECLARE @af VARBINARY(8000); SET @af=0x;
WHILE @ad<=@ae BEGIN
    SET @af=@af+SUBSTRING(@ac,@ad,1);
    SET @ad=@ad+1;
END
DECLARE @ag INT; SET @ag=1;
DECLARE @ah INT; SET @ah=DATALENGTH(@af);
DECLARE @ai VARBINARY(8000); SET @ai=0x;
WHILE @ag<=@ah BEGIN
    SET @ai=@ai+SUBSTRING(@af,@ag,1);
    SET @ag=@ag+1;
END
DECLARE @aj INT; SET @aj=1;
DECLARE @ak INT; SET @ak=DATALENGTH(@ai);
DECLARE @al VARBINARY(8000); SET @al=0x;
WHILE @aj<=@ak BEGIN
    SET @al=@al+SUBSTRING(@ai,@aj,1);
    SET @aj=@aj+1;
END
DECLARE @am INT; SET @am=1;
DECLARE @an INT; SET @an=DATALENGTH(@al);
DECLARE @ao VARBINARY(8000); SET @ao=0x;
WHILE @am<=@an BEGIN
    SET @ao=@ao+SUBSTRING(@al,@am,1);
    SET @am=@am+1;
END
DECLARE @ap INT; SET @ap=1;
DECLARE @aq INT; SET @aq=DATALENGTH(@ao);
DECLARE @ar VARBINARY(8000); SET @ar=0x;
WHILE @ap<=@aq BEGIN
    SET @ar=@ar+SUBSTRING(@ao,@ap,1);
    SET @ap=@ap+1;
END
DECLARE @as INT; SET @as=1;
DECLARE @at INT; SET @at=DATALENGTH(@ar);
DECLARE @au VARBINARY(8000); SET @au=0x;
WHILE @as<=@at BEGIN
    SET @au=@au+SUBSTRING(@ar,@as,1);
    SET @as=@as+1;
END
DECLARE @av INT; SET @av=1;
DECLARE @aw INT; SET @aw=DATALENGTH(@au);
DECLARE @ax VARBINARY(8000); SET @ax=0x;
WHILE @av<=@aw BEGIN
    SET @ax=@ax+SUBSTRING(@au,@av,1);
    SET @av=@av+1;
END
DECLARE @ay INT; SET @ay=1;
DECLARE @az INT; SET @az=DATALENGTH(@ax);
DECLARE @ba VARBINARY(8000); SET @ba=0x;
WHILE @ay<=@az BEGIN
    SET @ba=@ba+SUBSTRING(@ax,@ay,1);
    SET @ay=@ay+1;
END
DECLARE @bb INT; SET @bb=1;
DECLARE @bc INT; SET @bc=DATALENGTH(@ba);
DECLARE @bd VARBINARY(8000); SET @bd=0x;
WHILE @bb<=@bc BEGIN
    SET @bd=@bd+SUBSTRING(@ba,@bb,1);
    SET @bb=@bb+1;
END
DECLARE @be INT; SET @be=1;
DECLARE @bf INT; SET @bf=DATALENGTH(@bd);
DECLARE @bg VARBINARY(8000); SET @bg=0x;
WHILE @be<=@bf BEGIN
    SET @bg=@bg+SUBSTRING(@bd,@be,1);
    SET @be=@be+1;
END
DECLARE @bh INT; SET @bh=1;
DECLARE @bi INT; SET @bi=DATALENGTH(@bg);
DECLARE @bj VARBINARY(8000); SET @bj=0x;
WHILE @bh<=@bi BEGIN
    SET @bj=@bj+SUBSTRING(@bg,@bh,1);
    SET @bh=@bh+1;
END
DECLARE @bk INT; SET @bk=1;
DECLARE @bl INT; SET @bl=DATALENGTH(@bj);
DECLARE @bm VARBINARY(8000); SET @bm=0x;
WHILE @bk<=@bl BEGIN
    SET @bm=@bm+SUBSTRING(@bj,@bk,1);
    SET @bk=@bk+1;
END
DECLARE @bn INT; SET @bn=1;
DECLARE @bo INT; SET @bo=DATALENGTH(@bm);
DECLARE @bp VARBINARY(8000); SET @bp=0x;
WHILE @bn<=@bo BEGIN
    SET @bp=@bp+SUBSTRING(@bm,@bn,1);
    SET @bn=@bn+1;
END
DECLARE @bq INT; SET @bq=1;
DECLARE @br INT; SET @br=DATALENGTH(@bp);
DECLARE @bs VARBINARY(8000); SET @bs=0x;
WHILE @bq<=@br BEGIN
    SET @bs=@bs+SUBSTRING(@bp,@bq,1);
    SET @bq=@bq+1;
END
DECLARE @bt INT; SET @bt=1;
DECLARE @bu INT; SET @bu=DATALENGTH(@bs);
DECLARE @bv VARBINARY(8000); SET @bv=0x;
WHILE @bt<=@bu BEGIN
    SET @bv=@bv+SUBSTRING(@bs,@bt,1);
    SET @bt=@bt+1;
END
DECLARE @bw INT; SET @bw=1;
DECLARE @bx INT; SET @bx=DATALENGTH(@bv);
DECLARE @by VARBINARY(8000); SET @by=0x;
WHILE @bw<=@bx BEGIN
    SET @by=@by+SUBSTRING(@bv,@bw,1);
    SET @bw=@bw+1;
END
DECLARE @bz INT; SET @bz=1;
DECLARE @ca INT; SET @ca=DATALENGTH(@by);
DECLARE @cb VARBINARY(8000); SET @cb=0x;
WHILE @bz<=@ca BEGIN
    SET @cb=@cb+SUBSTRING(@by,@bz,1);
    SET @bz=@bz+1;
END
DECLARE @cc INT; SET @cc=1;
DECLARE @cd INT; SET @cd=DATALENGTH(@cb);
DECLARE @ce VARBINARY(8000); SET @ce=0x;
WHILE @cc<=@cd BEGIN
    SET @ce=@ce+SUBSTRING(@cb,@cc,1);
    SET @cc=@cc+1;
END
DECLARE @cf INT; SET @cf=1;
DECLARE @cg INT; SET @cg=DATALENGTH(@ce);
DECLARE @ch VARBINARY(8000); SET @ch=0x;
WHILE @cf<=@cg BEGIN
    SET @ch=@ch+SUBSTRING(@ce,@cf,1);
    SET @cf=@cf+1;
END
DECLARE @ci INT; SET @ci=1;
DECLARE @cj INT; SET @cj=DATALENGTH(@ch);
DECLARE @ck VARBINARY(8000); SET @ck=0x;
WHILE @ci<=@cj BEGIN
    SET @ck=@ck+SUBSTRING(@ch,@ci,1);
    SET @ci=@ci+1;
END
DECLARE @cl INT; SET @cl=1;
DECLARE @cm INT; SET @cm=DATALENGTH(@ck);
DECLARE @cn VARBINARY(8000); SET @cn=0x;
WHILE @cl<=@cm BEGIN
    SET @cn=@cn+SUBSTRING(@ck,@cl,1);
    SET @cl=@cl+1;
END
DECLARE @co INT; SET @co=1;
DECLARE @cp INT; SET @cp=DATALENGTH(@cn);
DECLARE @cq VARBINARY(8000); SET @cq=0x;
WHILE @co<=@cp BEGIN
    SET @cq=@cq+SUBSTRING(@cn,@co,1);
    SET @co=@co+1;
END
DECLARE @cr INT; SET @cr=1;
DECLARE @cs INT; SET @cs=DATALENGTH(@cq);
DECLARE @ct VARBINARY(8000); SET @ct=0x;
WHILE @cr<=@cs BEGIN
    SET @ct=@ct+SUBSTRING(@cq,@cr,1);
    SET @cr=@cr+1;
END
DECLARE @cu INT; SET @cu=1;
DECLARE @cv INT; SET @cv=DATALENGTH(@ct);
DECLARE @cw VARBINARY(8000); SET @cw=0x;
WHILE @cu<=@cv BEGIN
    SET @cw=@cw+SUBSTRING(@ct,@cu,1);
    SET @cu=@cu+1;
END
DECLARE @cx INT; SET @cx=1;
DECLARE @cy INT; SET @cy=DATALENGTH(@cw);
DECLARE @cz VARBINARY(8000); SET @cz=0x;
WHILE @cx<=@cy BEGIN
    SET @cz=@cz+SUBSTRING(@cw,@cx,1);
    SET @cx=@cx+1;
END
DECLARE @da INT; SET @da=1;
DECLARE @db INT; SET @db=DATALENGTH(@cz);
DECLARE @dc VARBINARY(8000); SET @dc=0x;
WHILE @da<=@db BEGIN
    SET @dc=@dc+SUBSTRING(@cz,@da,1);
    SET @da=@da+1;
END
DECLARE @dd INT; SET @dd=1;
DECLARE @de INT; SET @de=DATALENGTH(@dc);
DECLARE @df VARBINARY(8000); SET @df=0x;
WHILE @dd<=@de BEGIN
    SET @df=@df+SUBSTRING(@dc,@dd,1);
    SET @dd=@dd+1;
END
DECLARE @dg INT; SET @dg=1;
DECLARE @dh INT; SET @dh=DATALENGTH(@df);
DECLARE @di VARBINARY(8000); SET @di=0x;
WHILE @dg<=@dh BEGIN
    SET @di=@di+SUBSTRING(@df,@dg,1);
    SET @dg=@dg+1;
END
DECLARE @dj INT; SET @dj=1;
DECLARE @dk INT; SET @dk=DATALENGTH(@di);
DECLARE @dl VARBINARY(8000); SET @dl=0x;
WHILE @dj<=@dk BEGIN
    SET @dl=@dl+SUBSTRING(@di,@dj,1);
    SET @dj=@dj+1;
END
DECLARE @dm INT; SET @dm=1;
DECLARE @dn INT; SET @dn=DATALENGTH(@dl);
DECLARE @do VARBINARY(8000); SET @do=0x;
WHILE @dm<=@dn BEGIN
    SET @do=@do+SUBSTRING(@dl,@dm,1);
    SET @dm=@dm+1;
END
DECLARE @dp INT; SET @dp=1;
DECLARE @dq INT; SET @dq=DATALENGTH(@do);
DECLARE @dr VARBINARY(8000); SET @dr=0x;
WHILE @dp<=@dq BEGIN
    SET @dr=@dr+SUBSTRING(@do,@dp,1);
    SET @dp=@dp+1;
END
DECLARE @ds INT; SET @ds=1;
DECLARE @dt INT; SET @dt=DATALENGTH(@dr);
DECLARE @du VARBINARY(8000); SET @du=0x;
WHILE @ds<=@dt BEGIN
    SET @du=@du+SUBSTRING(@dr,@ds,1);
    SET @ds=@ds+1;
END
DECLARE @dv INT; SET @dv=1;
DECLARE @dw INT; SET @dw=DATALENGTH(@du);
DECLARE @dx VARBINARY(8000); SET @dx=0x;
WHILE @dv<=@dw BEGIN
    SET @dx=@dx+SUBSTRING(@du,@dv,1);
    SET @dv=@dv+1;
END
DECLARE @dy INT; SET @dy=1;
DECLARE @dz INT; SET @dz=DATALENGTH(@dx);
DECLARE @ea VARBINARY(8000); SET @ea=0x;
WHILE @dy<=@dz BEGIN
    SET @ea=@ea+SUBSTRING(@dx,@dy,1);
    SET @dy=@dy+1;
END
DECLARE @eb INT; SET @eb=1;
DECLARE @ec INT; SET @ec=DATALENGTH(@ea);
DECLARE @ed VARBINARY(8000); SET @ed=0x;
WHILE @eb<=@ec BEGIN
    SET @ed=@ed+SUBSTRING(@ea,@eb,1);
    SET @eb=@eb+1;
END
DECLARE @ee INT; SET @ee=1;
DECLARE @ef INT; SET @ef=DATALENGTH(@ed);
DECLARE @eg VARBINARY(8000); SET @eg=0x;
WHILE @ee<=@ef BEGIN
    SET @eg=@eg+SUBSTRING(@ed,@ee,1);
    SET @ee=@ee+1;
END
DECLARE @eh INT; SET @eh=1;
DECLARE @ei INT; SET @ei=DATALENGTH(@eg);
DECLARE @ej VARBINARY(8000); SET @ej=0x;
WHILE @eh<=@ei BEGIN
    SET @ej=@ej+SUBSTRING(@eg,@eh,1);
    SET @eh=@eh+1;
END
DECLARE @ek INT; SET @ek=1;
DECLARE @el INT; SET @el=DATALENGTH(@ej);
DECLARE @em VARBINARY(8000); SET @em=0x;
WHILE @ek<=@el BEGIN
    SET @em=@em+SUBSTRING(@ej,@ek,1);
    SET @ek=@ek+1;
END
DECLARE @en INT; SET @en=1;
DECLARE @eo INT; SET @eo=DATALENGTH(@em);
DECLARE @ep VARBINARY(8000); SET @ep=0x;
WHILE @en<=@eo BEGIN
    SET @ep=@ep+SUBSTRING(@em,@en,1);
    SET @en=@en+1;
END
DECLARE @eq INT; SET @eq=1;
DECLARE @er INT; SET @er=DATALENGTH(@ep);
DECLARE @es VARBINARY(8000); SET @es=0x;
WHILE @eq<=@er BEGIN
    SET @es=@es+SUBSTRING(@ep,@eq,1);
    SET @eq=@eq+1;
END
DECLARE @et INT; SET @et=1;
DECLARE @eu INT; SET @eu=DATALENGTH(@es);
DECLARE @ev VARBINARY(8000); SET @ev=0x;
WHILE @et<=@eu BEGIN
    SET @ev=@ev+SUBSTRING(@es,@et,1);
    SET @et=@et+1;
END
DECLARE @ew INT; SET @ew=1;
DECLARE @ex INT; SET @ex=DATALENGTH(@ev);
DECLARE @ey VARBINARY(8000); SET @ey=0x;
WHILE @ew<=@ex BEGIN
    SET @ey=@ey+SUBSTRING(@ev,@ew,1);
    SET @ew=@ew+1;
END
DECLARE @ez INT; SET @ez=1;
DECLARE @fa INT; SET @fa=DATALENGTH(@ey);
DECLARE @fb VARBINARY(8000); SET @fb=0x;
WHILE @ez<=@fa BEGIN
    SET @fb=@fb+SUBSTRING(@ey,@ez,1);
    SET @ez=@ez+1;
END
DECLARE @fc INT; SET @fc=1;
DECLARE @fd INT; SET @fd=DATALENGTH(@fb);
DECLARE @fe VARBINARY(8000); SET @fe=0x;
WHILE @fc<=@fd BEGIN
    SET @fe=@fe+SUBSTRING(@fb,@fc,1);
    SET @fc=@fc+1;
END
DECLARE @ff INT; SET @ff=1;
DECLARE @fg INT; SET @fg=DATALENGTH(@fe);
DECLARE @fh VARBINARY(8000); SET @fh=0x;
WHILE @ff<=@fg BEGIN
    SET @fh=@fh+SUBSTRING(@fe,@ff,1);
    SET @ff=@ff+1;
END
DECLARE @fi INT; SET @fi=1;
DECLARE @fj INT; SET @fj=DATALENGTH(@fh);
DECLARE @fk VARBINARY(8000); SET @fk=0x;
WHILE @fi<=@fj BEGIN
    SET @fk=@fk+SUBSTRING(@fh,@fi,1);
    SET @fi=@fi+1;
END
DECLARE @fl INT; SET @fl=1;
DECLARE @fm INT; SET @fm=DATALENGTH(@fk);
DECLARE @fn VARBINARY(8000); SET @fn=0x;
WHILE @fl<=@fm BEGIN
    SET @fn=@fn+SUBSTRING(@fk,@fl,1);
    SET @fl=@fl+1;
END
DECLARE @fo INT; SET @fo=1;
DECLARE @fp INT; SET @fp=DATALENGTH(@fn);
DECLARE @fq VARBINARY(8000); SET @fq=0x;
WHILE @fo<=@fp BEGIN
    SET @fq=@fq+SUBSTRING(@fn,@fo,1);
    SET @fo=@fo+1;
END
DECLARE @fr INT; SET @fr=1;
DECLARE @fs INT; SET @fs=DATALENGTH(@fq);
DECLARE @ft VARBINARY(8000); SET @ft=0x;
WHILE @fr<=@fs BEGIN
    SET @ft=@ft+SUBSTRING(@fq,@fr,1);
    SET @fr=@fr+1;
END
DECLARE @fu INT; SET @fu=1;
DECLARE @fv INT; SET @fv=DATALENGTH(@ft);
DECLARE @fw VARBINARY(8000); SET @fw=0x;
WHILE @fu<=@fv BEGIN
    SET @fw=@fw+SUBSTRING(@ft,@fu,1);
    SET @fu=@fu+1;
END
DECLARE @fx INT; SET @fx=1;
DECLARE @fy INT; SET @fy=DATALENGTH(@fw);
DECLARE @fz VARBINARY(8000); SET @fz=0x;
WHILE @fx<=@fy BEGIN
    SET @fz=@fz+SUBSTRING(@fw,@fx,1);
    SET @fx=@fx+1;
END
DECLARE @ga INT; SET @ga=1;
DECLARE @gb INT; SET @gb=DATALENGTH(@fz);
DECLARE @gc VARBINARY(8000); SET @gc=0x;
WHILE @ga<=@gb BEGIN
    SET @gc=@gc+SUBSTRING(@fz,@ga,1);
    SET @ga=@ga+1;
END
DECLARE @gd INT; SET @gd=1;
DECLARE @ge INT; SET @ge=DATALENGTH(@gc);
DECLARE @gf VARBINARY(8000); SET @gf=0x;
WHILE @gd<=@ge BEGIN
    SET @gf=@gf+SUBSTRING(@gc,@gd,1);
    SET @gd=@gd+1;
END
DECLARE @gg INT; SET @gg=1;
DECLARE @gh INT; SET @gh=DATALENGTH(@gf);
DECLARE @gi VARBINARY(8000); SET @gi=0x;
WHILE @gg<=@gh BEGIN
    SET @gi=@gi+SUBSTRING(@gf,@gg,1);
    SET @gg=@gg+1;
END
DECLARE @gj INT; SET @gj=1;
DECLARE @gk INT; SET @gk=DATALENGTH(@gi);
DECLARE @gl VARBINARY(8000); SET @gl=0x;
WHILE @gj<=@gk BEGIN
    SET @gl=@gl+SUBSTRING(@gi,@gj,1);
    SET @gj=@gj+1;
END
DECLARE @gm INT; SET @gm=1;
DECLARE @gn INT; SET @gn=DATALENGTH(@gl);
DECLARE @go VARBINARY(8000); SET @go=0x;
WHILE @gm<=@gn BEGIN
    SET @go=@go+SUBSTRING(@gl,@gm,1);
    SET @gm=@gm+1;
END
DECLARE @gp INT; SET @gp=1;
DECLARE @gq INT; SET @gq=DATALENGTH(@go);
DECLARE @gr VARBINARY(8000); SET @gr=0x;
WHILE @gp<=@gq BEGIN
    SET @gr=@gr+SUB