A sub-station of China Unicom, such as SQL injection and GETSHELL, affects the permissions of any user, such as "wo + pass/email ".

A sub-station of China Unicom, such as SQL injection and GETSHELL, affects the permissions of any user, such as "wo + pass/email ".

Start with injection:

View the original str2 vulnerability address: forbidden

URL: http://m.unisk.cn/Count2.asp? Id = 1320356 & speid = 300

Injection parameter: speid

Other connections seem to have been filtered, but this file is not filtered ..
 

The injection has obtained the account password:
 

Think about it now, it seems that you do not know the background, this...

The next day, I wanted to see the sub-stations have other places to use. I accidentally encountered the back-end.

Http: // 123.125.97.162/admin/manage/

Then decrypt the file. The md5 file cannot be decrypted. It must be salt .. no hope. I suddenly found that many passwords have the same password. I guess it must be a weak password and the attempt was successful. ha
 

The obtained password is in plaintext:

 
  *****a9b96549b0cdc95bd*****
 

Log in and find that the fck is iis6, and directly getshell
 

Shell in the dlf \ upload \ 37 \ image \ a. asp \ directory,
 

There are still a lot of numbers and text messages in the database. The database file is 68.52 GB.
 

It usually ends here. Today, I read the opened port and found a port number of 6060. Then I access it:

Http: // MAID: 6060/jcard/demo. php? P =
 

Wo + Pass, pass is generally very powerful... let's see what the source code is doing:
 

After careful research, it turned out to be the channel to the http:// I .wo.cn/wo + pass, which is interesting

Sso. php

 
  
*****? P *********** "p ************* _ decode *********** = $ pho ** ******************* ot ;, "***** & quo *********** $ co ********************** nect: '****************************** ot; jcard & q *********** ot ;. $ phone. "'ord **********; * ***** ql_quer *********** tch_array (************ 039; id & ****************** e {************** 39; & # ******************** se ($ c ************** * ***** = $ ui *********** ["u **********'&****** * *** pt 'Type = 'tex ***** 1. ://**. **. ** // I .Wo.cn & ******/script & *************************** 2. ://**. **. ** // 123.125.97.162: 6060/jcard/sso/referer. php & ****** = '10 *********** _ set ('************ ('ym *** * ****** D52949A6A1 ************ rmID. $ key. **********? _. $ Auth. * r = SHA1 (**********_. $ authenticator. * ***************** ----------- & l ************; // initial? * ********* E. '&'. $ **********??. $ Input. "**********-> encry **********?. $ Encrypt_card. & q *********** t; decrypt ($ rep-& ****************************** erID. '<********** userID, $ key ). * ********** encryp *************** 64 encryption _. $ userInfo *********** nfo ). '<*********** rypt ($ userInfo ). & # ********** ----------- & l ******************** 3. ://**. **. ** // I .wo.cn/sso/otherlogin.dosourceplatformid??==************* n. href = '**********/script & ************ t; ************ ******************************{ * **************************** T ;; // What is the key of java? **************************************** **********? Data? * **************************** Ncrypt ($ ******* **************************************** * *********** _ size (MCRYPT_3DES *********************** * ****** gt; pkcs5_pad (****************************** is-> key, 24, ***************************** ES ,'', * **************************** crypt_enc_get_iv_s ********* * ******************** c_init ($ td, * **************************** pt_generic (******** * ********************** en Eric_de **************************** odule_clo ******** ********************* se64_encod ***************** * *********** turn $ ************************* ***********************************? Data? * **************************** Rypt ($ enc ****** **************************************** * ************ ase64_decode ************************* * ***** is-> key, 24, ****************************** 3DES ,'', * ***************************** rypt_enc_get_iv_si ******** * ******************** _ enc_get_ke **************** * ************* c_init ($ td, * **************************** ypt_generic ($ t ****** * ********************** eneric_de *************** ************** odule_clo ************************ * ****** kcs5_unpad ($ ******************************** retur **************************************** **************************************** * ********* ad ($ text, **************************************** * ******************-(strlen ($ tex ************** * ************** tr_repeat (chr ********************* **************************************** * *************************** kcs5_unp ********** **************************************** * ********* text {strlen *************************** * **> str *********************************** * *********************** turn f ************* **************************************** * ****** ad ), strlen ($ text ************************************ *********************** return *************** **************************************** * ***** r ($ text, 0, **************************************** ********************}******************* * t; *****
 

The code above indicates that, first query the database to check whether the database exists, and then encrypt the data directly into wo + without a password, then sourcePlatformID and key are very important.



After analysis, I learned that the database is only a poor id, and the id is the same as the mobile phone number, so you can directly modify it, remove the database query part, and use the number directly, in this way, all China Unicom numbers can be directly logged into the wo + pass without a password.



Access using sso2.php:

 
  http://**.**.**/jcard/sso/sso2.phpp=186****8948
 

Direct access to I .wo.cn
 

Click the mailbox and log in directly without a password
 

 

Tested by a colleague's Unicom number.

The following is what you can find,

 
  http://**.**.**/jcard/sso/sso2.phpp=15609516201
 

Go directly to the mailbox:
 

Theoretically, you can log on to China Unicom users. over!

Solution:

Filter