Additionally, we hook MappedStatement. At the beginning of the entire MyBatis mapping process, we first assume that this SQL is ignorable.

Finally, when performing SQL injection detection, we determine whether CanIgnoreSql is true. If it is true, we do not need to perform SQL injection detection on this SQL, thereby accelerating our RASP's SQL injection detection.

The wall config contains general switch configurations and differentiated configurations (deny-function.txt, deny-schema.txt, deny-variant.txt, permit-funtion, permit-variant, etc.), and the data types of the differentiated configurations are quite complex. Therefore, at present, only these general configurations are cloud-based, and the differentiated configurations will be completed later.

Com.alibaba.druid.wall.WallProvider#checkInternal: The code under this method is the core function of WallFilter. First, it intercepts SQL statements with annotations and stacked queries according to the configuration. Then it creates WallVisitor, which has various check items, including prohibiting variable access or variable blacklists, prohibiting eternal statements, prohibiting blacklisted functions, and prohibiting access to blacklisted tables (database system tables). Some complex cases are set as configuration options, such as prohibiting file writing. If the detection fails, the SQL statement will be added to the blacklist. If the detection succeeds, both the SQL statement and the parameterized SQL statement will be added to the blacklist.

We can configure the blacklists of functions, tables, and variables in the syntax firewall:

parsed sql 这块的解析，针对替换后的dollar token，需要考虑其是否在引号包裹内，如果是，则需要考虑忽略被转义的引号，笔者认为的合法字符集为(Character.isDigit(c) Character.isLetter(c) c=='_' c=='$' c=='-'|| c>='\u0080')。
如果raw sql 与 parsed sql的 gap 数量或内容不一致，则认为SQL发生变化。
demo展示，运行结果显示第 1 组、第 4 组未发生SQL结构变化

The context.getSql() function at the end retrieves the parsed SQL statement after the dollar token ($++) is replaced. However, if we want to obtain the raw SQL statement, we need to track the SQL concatenation process of SqlNode ourselves. We can insert hooks before the StaticTextSqlNode#apply and TextSqlNode#apply methods to obtain the text (SQL fragments) and then concatenate them manually.

The hook points are as follows, where the same function logic is used to handle before and after the StaticTextSqlNode#apply and TextSqlNode#apply methods.

According to the method described in the article, the Trojan directly launched through commands will maintain the state of database query during its online operation without ending unless the Trojan is directly disconnected. Otherwise, the attacker can clearly see a long-running database query process and the Trojan's disk location by running select * from pg_stat_activity; in the database query process... Moreover, this process cannot be terminated by executing taskkill or select pg_terminate_backend(pid) in the PG database unless the session is actively closed by the task manager or the server.

Under Windows, the default permissions of the installed PostgreSQL database are set to network service, and it lacks the SeImpersonate or SeAssignPrimaryToken permissions. Therefore, all privilege escalation methods of the potato family cannot be exploited and will fail at the step of obtaining a token or using a token for authentication.  

By the way, if your static resource server is implemented based on the Go language's MIME standard library, there's a high chance that after containerizing it with the Alpine image, it will misidentify image files with extensions such as bmp/tif/tiff as text/html, which could lead to storage-based XSS vulnerabilities.

typedef unsigned char BYTE;
typedef unsigned short WORD;
typedef unsigned long DWORD;
typedef unsigned long long QWORD;
typedef unsigned long LONG;
typedef __int64 LONGLONG;
typedef unsigned __int64 ULONGLONG;

#define ___IMAGE_NT_OPTIONAL_HDR32_MAGIC       0x10b
#define ___IMAGE_NT_OPTIONAL_HDR64_MAGIC       0x20b
#define ___IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
#define ___IMAGE_DOS_SIGNATURE                 0x5A4D

#define ___IMAGE_DIRECTORY_ENTRY_EXPORT          0
#define ___IMAGE_DIRECTORY_ENTRY_IMPORT          1
#define ___IMAGE_DIRECTORY_ENTRY_RESOURCE        2
#define ___IMAGE_DIRECTORY_ENTRY_EXCEPTION       3
#define ___IMAGE_DIRECTORY_ENTRY_SECURITY        4
#define ___IMAGE_DIRECTORY_ENTRY_BASERELOC       5
#define ___IMAGE_DIRECTORY_ENTRY_DEBUG           6
#define ___IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7
#define ___IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8
#define ___IMAGE_DIRECTORY_ENTRY_TLS             9
#define ___IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10
#define ___IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11
#define ___IMAGE_DIRECTORY_ENTRY_IAT            12
#define ___IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13
#define ___IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14

#define ___IMAGE_SIZEOF_SHORT_NAME              8
#define ___IMAGE_SIZEOF_SECTION_HEADER          40