用友某系统从弱口令到sql注射到getshell

2015-10-22T00:00:00
ID SSV:93364
Type seebug
Reporter Root
Modified 2015-10-22T00:00:00

Description

简要描述:

弱口令、sql注射、getshell

详细说明:

系统地址: http://vip.ufida.com.cn/Frame/Index.aspx

<img src="https://images.seebug.org/upload/201510/211621187861fbd42f94e62a918639c6421ddce5.jpg" alt="QQ截图20151021162136.jpg" width="600" onerror="javascript:errimg(this);">

弱口令帐号:adminnc 密码:adminnc

<img src="https://images.seebug.org/upload/201510/21162318d4fb4043dcf5f3c510b9cd10affaa228.jpg" alt="QQ截图20151021162437.jpg" width="600" onerror="javascript:errimg(this);">

在自助查询处,发现注入(需要登录,注意cookie有时效)

<img src="https://images.seebug.org/upload/201510/211624159e5956a880d0a2fd338d8469b81bb8da.jpg" alt="QQ截图20151021162521.jpg" width="600" onerror="javascript:errimg(this);">

GET http://vip.ufida.com.cn/RepositorySearchInfo/DoctInfo.aspx?ReposID=38d4a08e-8b79-4de7-8566-30aecfb1d56f HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Referer: http://vip.ufida.com.cn/RepositorySearchInfo/DoctList.aspx?Type=MainPageClick Accept-Language: zh-CN User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: vip.ufida.com.cn Connection: Keep-Alive Cookie: ASP.NET_SessionId=szvzcr45nfresnqlzjhbtsqe

<img src="https://images.seebug.org/upload/201510/21163040a9dc633bdb22d377d6fcb5ee476f63d3.jpg" alt="QQ截图20151021163123.jpg" width="600" onerror="javascript:errimg(this);">

支持union sa权限

<img src="https://images.seebug.org/upload/201510/211631126e092dde0a40298cfb73321672cc5f60.jpg" alt="QQ截图20151021163229.jpg" width="600" onerror="javascript:errimg(this);">

漏洞证明:

<img src="https://images.seebug.org/upload/201510/2116314633f6808a598ed29377292914f5986e33.jpg" alt="QQ截图20151021163307.jpg" width="600" onerror="javascript:errimg(this);">

可内网

<img src="https://images.seebug.org/upload/201510/21163420d35370b813ab3b64f84fb590a378a40c.jpg" alt="QQ截图20151021163526.jpg" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201510/2116385293629987903b8e225330ae534e8a1c62.jpg" alt="QQ截图20151021164007.jpg" width="600" onerror="javascript:errimg(this);">

找到web根路径后写shell

http://vip.ufida.com.cn/wooyun.aspx

密码wpp

<img src="https://images.seebug.org/upload/201510/211642425968ea9a3abd7c42f933dd1fa7988c26.jpg" alt="QQ截图20151021164403.jpg" width="600" onerror="javascript:errimg(this);">

支持union就是快

D:\E_data\战略客户自助系统网站\wwwroot\&gt; arp -a Interface: 192.168.8.90 --- 0x10003 Internet Address Physical Address Type 192.168.8.2 00-50-56-83-0c-49 dynamic 192.168.8.3 00-50-56-83-0c-50 dynamic 192.168.8.4 00-50-56-83-30-ab dynamic 192.168.8.7 00-50-56-83-56-6e dynamic 192.168.8.9 00-0f-e2-30-7f-c9 dynamic 192.168.8.32 00-50-56-83-4b-1a dynamic 192.168.8.38 00-21-28-14-c9-ba dynamic 192.168.8.57 70-e2-84-07-31-18 dynamic 192.168.8.67 c4-ca-d9-c6-d0-58 dynamic 192.168.8.72 70-e2-84-07-31-e4 dynamic 192.168.8.77 00-15-17-ce-9f-31 dynamic 192.168.8.80 90-e2-ba-5d-ac-1f dynamic 192.168.8.83 90-e2-ba-57-f9-97 dynamic 192.168.8.105 e8-39-35-22-42-42 dynamic 192.168.8.112 3c-e5-a6-af-21-b5 dynamic 192.168.8.113 00-1a-4b-de-ae-ae dynamic 192.168.8.114 70-e2-84-07-31-18 dynamic 192.168.8.118 00-1e-68-78-f8-a9 dynamic 192.168.8.119 70-e2-84-07-31-e4 dynamic 192.168.8.134 00-50-56-83-36-20 dynamic 192.168.8.135 00-15-17-b7-1b-15 dynamic 192.168.8.136 00-50-56-83-00-02 dynamic 192.168.8.137 00-50-56-83-00-36 dynamic 192.168.8.138 00-50-56-83-53-95 dynamic 192.168.8.151 00-25-b3-25-a6-a2 dynamic 192.168.8.153 00-50-56-83-0b-84 dynamic 192.168.8.156 00-21-28-14-ca-92 dynamic 192.168.8.164 00-50-56-83-4a-e9 dynamic 192.168.8.168 00-50-56-83-12-69 dynamic 192.168.8.174 70-e2-84-07-31-e4 dynamic 192.168.8.180 00-50-56-83-6c-e3 dynamic 192.168.8.184 00-50-56-83-0c-8e dynamic 192.168.8.192 00-50-56-83-2f-8f dynamic 192.168.8.196 00-50-56-83-3b-08 dynamic 192.168.8.197 c8-9c-dc-33-ad-37 dynamic 192.168.8.199 00-1a-4b-de-18-82 dynamic 192.168.8.200 00-0c-29-29-0b-1c dynamic 192.168.8.201 00-15-17-5f-0d-59 dynamic 192.168.8.203 00-e0-81-d2-d8-49 dynamic 192.168.8.210 d4-85-64-4b-c0-b8 dynamic 192.168.8.211 00-50-56-83-5c-e1 dynamic 192.168.8.212 f8-bc-12-4e-9c-06 dynamic 192.168.8.213 00-50-56-83-00-1d dynamic 192.168.8.214 00-e0-81-de-99-5b dynamic 192.168.8.215 00-00-5e-00-01-0f dynamic 192.168.8.216 00-23-7d-57-8a-88 dynamic 192.168.8.217 00-23-7d-56-60-dc dynamic 192.168.8.218 00-23-7d-56-60-dc dynamic 192.168.8.219 18-a9-05-60-b9-e0 dynamic 192.168.8.220 18-a9-05-46-3a-08 dynamic 192.168.8.221 00-14-5e-1c-81-3f dynamic 192.168.8.222 00-00-5e-00-01-05 dynamic 192.168.8.223 00-50-56-83-63-72 dynamic 192.168.8.224 18-a9-05-53-0f-64 dynamic 192.168.8.225 44-1e-a1-4d-31-06 dynamic 192.168.8.226 00-50-56-83-46-9f dynamic 192.168.8.227 00-00-5e-00-01-09 dynamic 192.168.8.228 00-50-56-83-00-8d dynamic 192.168.8.229 00-a0-b8-56-26-92 dynamic 192.168.8.230 00-21-97-02-8f-c1 dynamic 192.168.8.231 00-50-56-83-05-f8 dynamic 192.168.8.233 00-21-28-f1-7e-ce dynamic 192.168.8.234 00-1a-4b-de-bf-7a dynamic 192.168.8.236 00-e0-81-dc-26-4b dynamic 192.168.8.237 00-e0-81-d8-54-e7 dynamic 192.168.8.238 00-50-56-83-2b-41 dynamic 192.168.8.239 00-a0-b8-56-26-50 dynamic 192.168.8.240 00-15-17-da-a6-50 dynamic 192.168.8.241 18-a9-05-40-af-d2 dynamic 192.168.8.242 00-e0-81-de-9b-96 dynamic 192.168.8.243 00-21-97-42-80-d8 dynamic 192.168.8.244 3c-d9-2b-f6-ef-70 dynamic 192.168.8.245 00-e0-81-d7-72-37 dynamic 192.168.8.246 00-50-56-83-47-d8 dynamic 192.168.8.247 00-90-fb-44-fe-8a dynamic 192.168.8.248 c4-ca-d9-de-c2-8a dynamic 192.168.8.249 c4-ca-d9-de-32-01 dynamic 192.168.8.251 00-50-56-83-29-2c dynamic 192.168.8.253 00-15-60-a2-94-81 dynamic 192.168.8.254 00-e0-86-17-b1-0d dynamic

<img src="https://images.seebug.org/upload/201510/2116434740416d223331d5c2dc8e640128cf0d0d.jpg" alt="QQ截图20151021164507.jpg" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201510/2116442210f8474195d5d9afddc31b5795c40a87.jpg" alt="QQ截图20151021164542.jpg" width="600" onerror="javascript:errimg(this);">

``` D:\E_data\战略客户自助系统网站\wwwroot\> net view 服务器名称 注释


\BG-DC-01
\BG-DC-02
\BGVC
\BI
\CAIWUAPPS CaiWuApps
\CASERVER
\CWHR
\DDFWS-C117DB6F3
\EVENTLOG
\FTPSERVER
\GSALEDB
\IMC-01 imc-01
\IMC-02 imc-02
\IMC-03
\IMC-04 imc-04
\IMCPT
\IT-36800
\IT_FAWEN_09_25
\ITCOMMDATASERVE
\ITDATABASE
\ITTFS
\ITTFS2010
\JTSJJCB-2012-01
\KMS08
\MSNCASRV_09_26
\PORTAL8211 portal
\SALEAPP
\SALES_MANAGEMEN
\SUP2008
\TKR TKR
\U8SERVICE
\UF-BG-TEMPLATES
\UF200703009
\UF200703055A
\UF200703073
\UF200802416
\UF200903057
\UF200903072
\UF200903079
\UF201003115
\UF201103087
\UF2013-PCAS
\UFAPP
\UFBGDC01
\UFCUSDB
\UFCWSERVER2
\UFEDGESRV
\UFGOV-KAOQIN
\UFGROUP ufgroup
\UFGROUP2013
\UFGROUPAPP2
\UFIDA-D79A6DC9F
\UFIDA-WINS
\UFIDASERVER1
\UFIDASRV2
\UFIDAWEBDATA
\UFNAS1
\UFPARK
\UFPARK_BAK_10_0
\UFPMP
\UFPORTALSRV ufpo
\UFREGISTER2
\UFSEA
\UFSEADB
\UFSEARCH
\UFSERVERDB
\UFTDC11
\VIP
\VPN_LOG
\WEBSUPPORT we
\WIN-7NNI89H987C
\WIN-9QKG6QS0TNM
\WSUS02
\XHZWEBCOUNT
\XMGLNET UFPMP
\YONYOU-129D63B7
命令成功完成。 ```