中国网络渗透测试联盟
标题:
SDCMS后台绕过直接进入漏洞
[打印本页]
作者:
admin
时间:
2013-7-26 12:42
标题:
SDCMS后台绕过直接进入漏洞
要描述：
/ Y$ X; k( t4 D0 t v, o
s$ D) ~% N3 W* c& R
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
! a" o" w1 j1 E2 p9 ^: X8 i8 }1 r
详细说明：
- |# c( R2 ^7 g' I
Islogin //判断登录的方法
/ C' f7 q4 D) y0 t' F4 ^' X/ D4 S
# F5 V; J7 C" V3 v
sub islogin()
8 ?' h6 D0 t+ o6 {6 o3 r4 g
7 |0 B) w/ \3 ~: U7 q
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
7 N- `) M* I# d( a) ?$ A7 X
4 Q# w0 h2 [; @ X' w+ A# K3 o
dim t0,t1,t2
2 ^/ W/ J9 _ _4 f) |
& ~7 b e. t5 e2 u$ @6 h2 F% |' O9 f
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
. o* k# U) v6 b1 a, d. F o5 ^9 O
2 r" @! X, ]$ H6 Q
t1=sdcms.loadcookie("islogin")
6 z8 e$ a" D) P- F
& l! l9 U6 t9 ?# p6 N
t2=sdcms.loadcookie("loginkey")
# V- ?! W, f# {6 E
: }2 w3 @- V' Y
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
: U8 H$ }% G" T6 [( P1 u
3 p+ `& [7 `$ E7 ]+ O
//
) K. i& g- p% p/ {6 @9 u
( k2 [3 U! N0 a6 l9 R, x7 I
sdcms.go "login.asp?act=out"
6 k8 a4 N, L' {0 i' ^/ ^
$ ~7 s7 d4 L0 Q
exit sub
! e. H% h, {/ F& C6 j
2 I. v8 o# X# V( U+ U1 N+ _$ v5 Z
else
- \9 i7 J" P' k- c
+ |, \" F$ W0 N3 U( V! b
dim data
6 f; ~3 w0 ]' p5 u( |
- R3 j7 ~/ S, i" C8 k0 M
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
" K7 l, n) m1 i0 f; Q* a- {+ j
; v; r4 u$ ^4 X% W) S
if ubound(data)<0 then
9 G! g; F7 _. m
1 m; e2 o( G2 L% b n+ z; j
sdcms.go "login.asp?act=out"
* |; r! q, n: j7 R6 w
- I3 T/ K% }" ^1 H# W' y
exit sub
2 W/ |! S. R" H, D
- ^% N* H* z% a2 ^
else
6 C( S; Q, d% x6 d0 o
# x7 {. O. l* q& k* [% K& D
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
7 M6 W6 n; L/ b8 d8 r
6 J; u; j @1 [) p
sdcms.go "login.asp?act=out"
( [( l, H& ?- g0 O1 R
1 h/ I% @( |. H8 Z
exit sub
& H( T% o' x1 s) i
6 K7 g# N* {3 l4 {4 R
else
) |1 T0 z# |) O4 N0 w6 c
% P- M- X. |1 ~. ]) Z
adminid=data(0,0)
/ D7 i$ r6 Y5 q; k5 d" T5 s H
! A4 K S) Z2 D8 x! \) r' F
adminname=data(1,0)
e. U- G2 r$ P9 K4 Q6 J
* n/ O' p6 p& |# q4 z
admin_page_lever=data(5,0)
; K6 o% k; H: ^' E1 a; p" F; n
& [" v+ M7 |$ ]6 u
admin_cate_array=data(6,0)
N p0 \8 s' E- B
3 ` Y- v8 s! s) h" g9 J# y
admin_cate_lever=data(7,0)
9 ?4 J) [! t/ n i
: _# \+ D% J0 O. j
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
8 F- e3 E9 e; V
9 K( `4 P2 c r+ `
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
8 p+ l- V$ @7 r. X/ O/ Z4 F6 Q
/ _/ f) L/ _$ m5 J/ c
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
: R6 \8 }/ ]/ Z. B* R1 [& `# G
& ~8 m5 t% M; M2 l2 ~+ ~
if clng(admingroupid)<>0 then
' K& p6 q+ F% @2 s
1 h c2 Y% ?+ @! w2 j# @
admin_lever_where=" and menuid in("&admin_page_lever&")"
* m7 n" |( ]6 y
2 @( x. r7 o" u2 {1 [6 R ^
end if
) C9 j B2 S }$ Z0 u0 E4 W) c
1 s" [3 E$ G1 P `8 {# F
sdcms.setsession "adminid",adminid
2 ^. P# H( h1 h* ^
( y2 e4 ?5 U, L+ o! Q' D- A, |
sdcms.setsession "adminname",adminname
8 r9 u n! y) X3 M7 B
! O# Z" |2 _/ w, }8 B8 P/ L
sdcms.setsession "admingroupid",data(4,0)
( K) L$ ?1 M" ~. V: ~: b. @# L
1 L0 @/ G0 ]" E8 j5 O
end if
0 n4 ]. W7 ?2 Q- E$ R/ S
, S f, @( J v& L( S
end if
' B% n! _ S9 p) y! A+ F2 r) E
( m/ P+ |0 b4 m# a5 R
end if
$ V% ^. B$ W8 M) n w; g
0 o1 k+ `+ z- @- i; a
else
" H% K/ q( \0 e8 U
; Y6 I, I. W5 |/ N
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
( u, \/ y$ V, m1 h: {6 e9 a6 o
: l' O) |3 X& [- j- D
if ubound(data)<0 then
9 n2 m5 l2 K8 D8 U! `6 a o6 |7 `
. v) L& X, s3 m6 a1 K2 I- \
sdcms.go "login.asp?act=out"
8 |$ u7 O) N0 J# A) i- v
& m' W: @$ v4 g- w
exit sub
! E @3 D1 {9 l; B: Y
" b7 C, j5 p3 ?" c* s) e' G
else
$ \8 y1 q* h- u7 M W# |
- `+ [1 x' w/ S2 |9 i" O9 B) m
admin_page_lever=data(0,0)
, c0 ? k9 I9 ], ?" c' c& h
0 N% f8 j) D$ F* f5 o+ ?
admin_cate_array=data(1,0)
" |7 L* R+ r: P2 Y) t$ F
/ t2 S, X: f) n- c0 y+ B
admin_cate_lever=data(2,0)
7 u2 `% b% m! E! B1 J+ G
- f3 O c6 i% ~. p# w8 X
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
" m: B0 J% ?/ p! `$ I- ^# c
; v4 R( Z' r. e# l5 M, y' r+ ~7 `
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
$ K$ \% D% ^4 ]% k; @- S5 h1 U- Z; b
4 _: U% t2 I- g7 A3 O
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ M* w3 o9 @+ s# J
3 g) i! g ^0 \7 m! \+ N' T
if clng(admingroupid)<>0 then
2 E5 W3 E9 m9 [2 i5 V
/ ^, b7 ?" V3 ^
admin_lever_where=" and menuid in("&admin_page_lever&")"
4 `$ D$ @7 @3 o% u) a M
4 b. o" U* h/ Y! [- w/ |0 Z
end if
% @/ j& S0 n4 }. f
/ C! l5 L" k7 M6 ~
end if
- I* y# O+ ^) m/ ]2 B
7 w" a, g8 p! G" a( A
end if
3 v3 d& V# w' _- T
3 h9 d5 E( O5 O" f: w
end sub
5 R( j9 d- y3 Z9 B
漏洞证明：
* A& g4 T! B7 r5 l8 c& L
看看操作COOKIE的函数
8 N+ T+ ~4 e" q1 v4 l
$ X9 y# X' [4 ~9 r6 o
public function loadcookie(t0)
6 R* X2 k/ w; N- [" i- Q! h4 V, s
8 u0 b9 ~* |7 o2 C
loadcookie=request.cookies(prefix&t0)
% y# H" z p" s# F, N- s3 X; e. ]
3 u! t( ?2 f* z, N3 D/ y# @# j
end function
$ I* ]9 P: X0 K+ f
6 f+ C. S' Z& Z7 ?# X2 W
public sub setcookie(byval t0,byval t1)
: m' c8 B: Q4 R5 O5 b1 `
1 B0 U$ m3 O8 y+ ^4 |0 |
response.cookies(prefix&t0)=t1
3 Q0 g8 o8 w! ~2 \
# ^* t( v, q& V# ?) C/ m. _- |
end sub
- g& |* g4 A" n. [/ ?, [; F
5 m7 c! u. x$ o H2 k: i" a
prefix
) C- s$ B5 D" Q- v3 g; x7 H
6 Q$ G# \& X: [
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
6 h% F+ U1 |; }0 R1 Y
' m+ W5 z1 ~" ^" {
dim prefix
8 K! Y5 L: X# J! v0 B1 S
+ c C3 E0 ~4 ~5 c: R! Q2 @
prefix="1Jb8Ob"
' J3 i6 K3 C& |" Y; D0 s4 I
! j; s- A% V0 E4 a* n
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
6 R) h+ i, W6 _0 f: _. Q/ O2 C
1 z ]9 Z: P9 t2 ` b
sub out
) `9 \; W- c9 w! ^( k5 q
2 y' V( k4 h" P" N. }# @+ d p
sdcms.setsession "adminid",""
6 H/ h6 O; V1 r' e% h' r
7 e/ r0 |) g* H
sdcms.setsession "adminname",""
0 f3 i0 R& N( ?; J- l/ h
0 B; o1 g4 Y* c$ A5 M4 D/ d
sdcms.setsession "admingroupid",""
$ u2 |- j! ?1 z- J4 s% x' v
% e3 t' U! ]4 K+ r# B+ {. @
sdcms.setcookie "adminid",""
* O! G5 h* g" A* u( ~, S) K% x
& P9 R, P6 q% P8 E9 z0 B
sdcms.setcookie "loginkey",""
- A0 ^4 H |+ d0 x
! x7 n$ y G) k
sdcms.setcookie "islogin",""
" ~, R+ P: [* L; V% q; c
4 F% w5 j9 n W- r& A( D/ D( t6 E
sdcms.go "login.asp"
: b4 z9 j$ ]6 }- {$ _5 |; S5 c
8 c: n) \8 O+ R6 ]$ I- \
end sub
* b. }# n- F2 d% P4 \
2 }5 O: o6 S3 P2 |
/ P9 Y7 _* K( C, O) q! g
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
& d, ~4 Y6 a$ j1 w1 u
修复方案：
3 _2 T$ V, n- p% a
修改函数！
* Z7 p6 T9 b. E7 x. X6 o
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2