GomyeCMS V4.7 universal login Vulnerability

Author: Zake 2009/10/18

I haven't written any technical articles for a long time. I was so excited that JJ was so eager to write the following article!

Author's websiteHttp://www.gomye.net/

Preface:
I haven't learned the SQL language for a long time. If some statements are incorrect, I'm sorry.
This is because there is a swindlers company in Chengdu. You can go to Baidu or Google's keyword "Liao Kee-ji chicken" and then flip several more pages.
I can see a lot of news from this company and cheat my cousin's joining fees. So I want to create a website for their company.
The health check domain name isWww.liaoji.com, Open the website all shtml or asp, you can imagine that shtml may be used
The aspx program is generated. It is unclear about the specific program. I went around and found a message board. By the way
Leave a message and try using javascript to try cross-site. The result was unexpected. I found that the program was not filtered and said it was illegal.
The statement prompt is aspx. Oh, these are a bit confusing. net. Although it is a strong-type language, it also has many drawbacks,
A strange directory named GCMS was found, and the directory was directed to the background login interface,
What is the program named GomyeCMS V4.7 in/GCMS/logno. aspx? Never seen, Baidu
Google has almost no results, but what should I do? No injection, and no login injection in the background (I did not go deep into my own SB
Test), but I found that the whole server is all in this program for several sites. What should I do? It's hard
Next to the main site to find the master of this program, the results of manual testing problems, and finally found that its program has a defect (also
I asked a brother, he told me.) This drawback is when his dynamic link, such as TID = 12, is injected here.
So I will use TID = 12) so that we can inject the merge of the front and back, so we won't get any useful value.
I am in a hurry. I still use its message board to find his background. I was lucky to log on to the background and test the login injection.
Don't forget me! There is still an error when injection can be performed in the background. Check whether the version number is 2005 or @ version = 1--SQL.
Here I want to explain that the injection in the login box and the search box is of the character type, so we need to add a single quotation mark to merge the front edge.
Single quotes, because a friend posted an MSSQL injection post on his blog some time ago, confused the problem.
As a result, many of our friends often regard Digital Injection as numeric injection, which does not need to be combined.
So we don't need to put a single quotation mark on it. After reading the version number, I thought that since we logged on to the background
So his program must read the management table. We do not need to bother to find instructions on directory backup and go to the background first.
Look, there is no need to find a directory backup in case of shell in the background. Everyone is right! Okay, don't talk nonsense. Start working.
Execute Statement 1 having 1 = 1 -- get information "the selected column Content_Master.Master_ID is invalid,
This column is not included in the aggregate function or group by clause ." You can see "Content_Master.Master_ID"
Having doesn't mean that it's so detailed. You can get it from Baidu or Google. What we can see here
The front of the two items is the management table Content_Master, and the back is the ID, so let's continue! Run
Statement 1 group by Master_ID having 1 = 1 -- then the second field Master_UserName
In this case, we continue to blow up the expected fields and then blow up the data. Execute the Statement 1 group by Master_ID, Master_UserName having 1 = 1 --
In this way, something will pop up until we have what we want. The final result shows Master_UserName and Master_Password.
What are the two fields that I want? Let's just blow his ass! Haha, just do what you say,
1or (select top 1 Master_UserName + | + Master_Password from Content_Master)> 0 --
Execute this statement to help new users learn what it means by the way. The experts will pass by and the younger brother will look ugly.
Or and are a connector, and the injection statement after the connection select is the top 1 of the first query.
Master_UserName + | + Master_Password. I don't need to explain it. The field is in the middle. | this is
A separator is used to separate the account and password. It is easy for us to see clearly and will not be confused from Content_Master
In this table, we can see the result. What should I do if the password cannot be decrypted? Well, I don't have that much time to talk to him.
Directly update Content_Master SET Master_Password = here is a simple MD5 16-bit encryption password where Master_UserName = admin
This statement is used to modify the admin password, which is the desired password value. After the change, read the password again.
Now, I am very excited to log on. I found that the paralyzed password is correct and I did not log on. I thought this account was forbidden.
What should we do at this time? Are there other accounts? No, I have to test it now!
1or (select top 1 Master_UserName + | + Master_Password from Content_Master where Master_UserName not in (admin)> 0 --
After that, I followed a conditional statement, that is, the account is not the admin account. check whether there are other accounts. The result is blank.
This is depressing. I will smoke and prepare to wait for a heavy read directory. Since I can update the directory, I will not have the permission.
The effect DB is over. After smoking the smoke, I continue to play. The first step is to check the permissions. At least I have a bottom in my mind and many people intrude into the database.
It's not like me. At this point, I can see what permissions it is! The first step is to test whether the database permission is used.
Execute 1or (Select IS_MEMBER (db_owner) = 1 -- oh, my god!
This statement can be directly entered in the background! No Password is required! My god programmers now! I will be F
In fact, I smoked cigarettes and went to WC and got off the gray machine! Maybe it's because I have finished shooting all the bad luck, so good luck is coming. Go to the background.
No need to think about it! Find an upload file and run it on An aspx file. The server has great permissions! Can Jump freely
I found the target and changed the homepage to him. I lied to him for 0.2 million or hacked him for 20 times. Finally, I threw the shell to my brothers,
Let them go up and help me scold me! Here, I would like to especially appreciate the two talents, the first ghost boy, and the second half Yu Hongyi, good guy.
The foul language is very tasty. I have seen it in my heart! Don't talk about it. The silver God's rhythm is awesome! Scammers
Paralysis should be so embarrassing! This article says it was a loophole. In fact, I talked to myself a lot. Finally, I would like to mention a person in May February 30.
My brother is very good and has helped me a lot in the SQL language !!

Summary:
Test official site asp ">Http://www.gomye.net/a.asp

1or (Select IS_MEMBER (db_owner) = 1 -- this statement is the omnipotent login account of this program.
You do not need to enter the password anywhere.Http://www.gomye.net/I found it on his website.
In several of their successful cases, the test result is 100%! The speech is over. Thank you!