中国网络渗透测试联盟

标题: SDCMS后台绕过直接进入漏洞 [打印本页]
作者: admin    时间: 2013-7-26 12:42
标题: SDCMS后台绕过直接进入漏洞
要描述：9 y- H6 |8 ?" V6 H+ ~9 }4 z
! M7 i/ I; t( u& ]/ k9 B
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试! ]3 W( z) M$ ?9 t: S% Z4 ^# k
详细说明：* [3 S* M! Q" d9 T0 ~
Islogin //判断登录的方法) K/ v0 x/ t: X/ S3 r) J
- ~; i' v# w0 a  ]# l8 ~8 t( D* e
sub islogin()1 |. E$ r( Y( u! }
& C. W* |1 b; {
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then ( e& ^! y" I1 n0 c
$ u- Z% K! [  X5 e8 s4 D! L
dim t0,t1,t2 ' Q6 W/ \+ ]. y! K

. W) `# \% ?* U- Z$ kt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie # I  x, i+ U5 ~7 s  ^
% U, x; Z2 }- ~' L# S
t1=sdcms.loadcookie("islogin")
  p4 ~9 d" @* s + j5 C7 Y( b$ W+ u- k& n, w
t2=sdcms.loadcookie("loginkey")  e7 s: l0 k) Y3 B; X, V
' w' ~: E/ Z/ A6 ]
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
' w% E9 e; E0 E$ B1 L- {: S 9 a. `  r8 U' Q! H" T0 n6 S
//9 B7 y. m8 R2 ]/ Z
5 J/ J, s. c% l1 I9 q6 s
sdcms.go "login.asp?act=out"
" ~) d3 P) f  s+ v; V2 H 6 `/ b# ^5 J5 v
exit sub
0 p. f/ T5 p$ m3 h: ]  N, T' _
6 c2 D4 U, O  g7 W2 ]4 v- Aelse3 R4 O3 u" `1 r& }/ c' P9 C! A
' g" m% _4 l, i4 G  x9 ]" d& n& e
dim data# d) b) b* k4 j8 e2 X

$ s4 z* v( M2 e3 g6 Wdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控6 B+ n( B3 z9 f1 I  A# w

# W- `* P# e5 {5 Fif ubound(data)<0 then
6 J- a/ V9 ^+ N7 Q0 p& T* Q
3 ~4 }, E; {/ O% fsdcms.go "login.asp?act=out"% z/ A$ K4 _, C) D5 P& ]% U

$ f! c8 b$ j5 o1 o7 m) sexit sub
& o+ _% s/ a  }& [& I 3 c/ A1 ~% r* n: _- v
else$ M8 E) \9 O. G( L& k# q( z

( H$ p% t' I  K9 z7 X, J8 \: g: eif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then$ l3 |  w$ D1 M' c. D5 r) Z. v  j

* W6 C0 b" {. h2 m7 k8 Zsdcms.go "login.asp?act=out"$ R) T8 u- q) R' h5 k0 `
6 |  j5 V* y( e* K. z! X( ^2 n. X
exit sub
8 U# q2 `, E5 n! |1 a
; b: F: k6 f6 S, l% ~, m0 xelse7 f! v) [6 z$ K; }. a- O

% p: M) R- d: h0 P4 [% zadminid=data(0,0)& F& u2 _' s* w
' O4 V, N+ I7 E$ U1 A. _
adminname=data(1,0)
" _0 Z  [$ A& w7 X, i& ` 4 E! \7 Y$ n7 w! z# I( y6 ^
admin_page_lever=data(5,0)2 l( x+ x% P4 i- C# r9 p. j- }

6 j. j8 r+ @$ c5 v3 l) R% i6 w% Madmin_cate_array=data(6,0)
- F+ d% F$ ~1 S  \8 b1 [
! ]! J( J. |- H1 Sadmin_cate_lever=data(7,0)- X& Z# I  f/ v3 T+ n
; R+ C% q8 P' w+ J9 S
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=09 Q& h3 Z& B" b9 z% G; O/ g
& u' j+ Q6 A) l  q( ^
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=01 z5 U+ ], a! `1 {' O0 m: Q& N

& X- g7 z5 @( t0 a; n/ Eif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=07 a% {2 r3 K( a" N2 _4 E8 h
9 ~* a0 b  [( R9 A& |6 Q5 @6 H7 F
if clng(admingroupid)<>0 then  [) `  l  b+ {/ n8 ?4 C2 ~* p
) [- E! C9 _! P2 q2 g2 t
admin_lever_where=" and menuid in("&admin_page_lever&")") @$ Y' y& _" J% o

# G& z1 w! f" b) }* G* mend if
+ s" p9 S2 D" I; ~8 k* }: _% M% M
# f+ \& H1 J1 p, vsdcms.setsession "adminid",adminid) L) V; P3 U/ r( d7 J6 \$ o% f. H
& A( o; i4 n) V2 f- v9 l8 w2 l
sdcms.setsession "adminname",adminname2 S% ?5 [, S7 Z- d9 {
$ D- F* z/ c+ c; D( M
sdcms.setsession "admingroupid",data(4,0)
# E, T/ P  x6 h0 q$ Y
3 n$ ~6 ~0 ~4 e4 @5 Hend if
" ]: P" j. H  O+ V0 | . ^- k) e: w. T8 i% E9 \  Y$ ?
end if/ y  h- z: I. E3 D

! G% O% q$ v" G' p. T) l9 b* yend if4 [$ w0 s0 ]& c4 f$ `
3 N6 v! R" `3 J- q5 `
else
% w$ n5 O. d- D& J& s; A0 A( S - e) S# y7 q$ ]" L8 T& M
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")+ q/ Z6 P: t! h$ m8 B. \7 E2 o! n' H
, F  H8 w% d* m
if ubound(data)<0 then- H, ^7 E- o1 U6 A7 D

; q( S0 A3 Z2 [9 E; ]. P* isdcms.go "login.asp?act=out"6 k! ?$ \3 Z2 X7 u2 j) }. y* {) H& ?

  Z% k6 R  ^. U+ L4 ^7 Sexit sub
$ i3 w4 g" L) W3 c* a' g4 ~3 `
/ \3 N- `; P3 h4 W3 R8 g- Jelse
7 Z/ H! v$ r3 D+ M7 m5 w
" x8 Z8 Y/ v9 z7 Ladmin_page_lever=data(0,0)( d' {9 X0 J$ N3 @& O  D# y+ o. [9 r
" J3 o$ G+ m+ q, M* l8 V
admin_cate_array=data(1,0)
' e; K9 l; L; ~2 V
* P4 {' D- b3 {/ padmin_cate_lever=data(2,0)9 h6 `2 N. W6 x

& p! q  P' O( I" }4 K! eif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0$ ~: f6 @/ g% v+ n# N" Y6 @

1 }, e# D4 T7 z% cif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=05 W) Y1 c+ T. H0 x: _
4 }* ]. e6 J# D& A! Z; r
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
4 k4 @5 F! j/ X: K0 K8 J- P
1 }. U; @: Y) U( A& M- g# E& xif clng(admingroupid)<>0 then( d! [; u1 z- ], j7 O

" B4 j4 f/ _$ Badmin_lever_where=" and menuid in("&admin_page_lever&")"
2 ^8 |9 ~: w9 m1 H' d' _  A) o
6 O! ?6 f  j8 l, w; @* Yend if
) A& h* Q: ^0 i2 A+ t
5 P' Q& e& j8 a3 j3 k- vend if
: z8 f- I7 ?: \4 e
' c7 N' J- y0 Gend if
' W* n' E5 X1 I' |0 n" O
5 @) [* u5 U/ G& \  G5 J3 Vend sub" P) f) B& G3 X4 H* S$ h7 _
漏洞证明：7 V# v% r0 j& _" i
看看操作COOKIE的函数
" L* e! }% J  {5 r4 z' J$ f( N8 F + k: a5 M' o3 F2 @" `7 g  o1 U
public function loadcookie(t0)( l9 d3 f. z# b4 o

; U! `6 f; p  y" S- Q, v: ]loadcookie=request.cookies(prefix&t0)2 f  f( Z, H4 \" z3 r* F
; m' w9 q  h2 I) r8 |% B( J8 ]
end function1 l; ^' D+ s: k3 J  ~. z
0 k, E& f0 J9 t. e9 Z6 J$ Z  \6 Q/ f
public sub setcookie(byval t0,byval t1): o" s$ R2 I  }8 E$ W
) P# T) H- N. |! M6 Y0 v4 G, {
response.cookies(prefix&t0)=t1: g; g9 b' `# C6 [. r3 f; |" o

. m5 n# O0 b9 bend sub
8 ?* h, I9 J- S1 v
$ T* n, ]( f+ X' S; xprefix
* G( r6 n* i. B( H9 Q
: Y! k5 I0 g* F% C* k'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
- f! e/ T" W1 R2 F1 z4 y 0 J+ ?$ h& D$ y8 j( U; o
dim prefix2 u1 O) V, f1 @. I

+ Y4 {- u3 ]" C6 v% rprefix="1Jb8Ob"% Q3 r8 _" g  A/ J5 w! u; Y
0 l5 d" P5 M$ h' F" b0 C* a" V2 l
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 - z- W( @9 A, ?

4 N) ^( X1 B! ]& e3 r, ~sub out
- O+ O4 Z; z/ J5 y3 U
) W9 M( k' R) c5 fsdcms.setsession "adminid",""
# t: x% S1 V. d- G, Y
" i$ Q& @; ?7 h" e1 y( G! O0 {% hsdcms.setsession "adminname",""" N8 G8 Z+ T/ d. y3 c
, {( ]$ s! c, |# E8 }9 i
sdcms.setsession "admingroupid",""
# c# y1 W1 ]- m" O& w % a( `# ]% g$ I. g1 O
sdcms.setcookie "adminid",""7 k: U( F1 m. Y1 @5 C% V( J# J
) x* B" g# j, p
sdcms.setcookie "loginkey","": Y. @  j2 U% k' ?
- v+ D; ~5 A9 p* \) h7 z9 a. t
sdcms.setcookie "islogin",""
6 J8 ^( z8 P2 |: v! X $ q+ S& y9 p. G& h
sdcms.go "login.asp"* }4 S1 c5 d2 R9 _
8 Z4 x' I! `8 ?" P- K% \4 p+ D( K
end sub
( E! \$ u' e/ |" V3 q3 g% T, B0 ^
. s! J; T: _' Z/ R
+ }! b% W8 J8 T. d利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
* D% p! c8 s" Y  A9 P修复方案：
2 w  n7 c7 j$ w# n) C修改函数！
3 U! y7 V+ ~9 y$ L% a



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2