MiniBlog 3.0 vulnerability in bean planting mini blog

Forum: http://bbs.2cto.com/read.php? Tid = 86783 blog: http://hi.baidu.com/linkhack

The rain is a bit depressing these days. Open the hard disk and look for a few decent programs to see if you have this article:



I. Classic Upload Vulnerability

I have never been in touch with the upload vulnerability for a long time. This time, I found that the vulnerability exists with upfile. asp.

<! -- # Include file = "include/conn. asp" -->
<! -- # Include file = "include/const. asp" -->
<! -- # Include FILE = "include/cb_upload.asp" -->

<%
Dim filebleid, upload, formPath, formName, file, fileExt, filename, userface

Filebleid = Caluoob. UserID
Set upload = new upload_5xSoft

FormPath = upload. form ("filepath ")
Add (/) after the Directory (/)
If right (formPath, 1) <> "/" then formPath = formPath &"/"
For each formName in upload. file: Lists All uploaded files.
Set file = upload. file (formName) to generate a file object
If file. filesize <100 then
Response. write "<font size = 2> select the image you want to upload [<a href = # onclick = history. go (-1)> re-upload </a>] </font>"
Response. end
End if

If file. filesize> 51200 then
Response. write "<font size = 2> the image size exceeds the limit [<a href = # onclick = history. go (-1)> re-upload </a>] </font>"
Response. end
End if

FileExt = lcase (right (file. filename, 4 ))

If fileEXT <> ". gif" and fileEXT <> ". jpg" then
Response. the write "<font size = 2> file format is incorrect [<a href = # onclick = history. go (-1)> re-upload </a>] </font>"
Response. end
End if

Filename = "face/" & filebleid & fileExt
Userface = filebleid & fileExt
If file. FileSize> 0 then if FileSize> 0, file data exists.
File. SaveAs Server. mappath (filename) save the file

End if

Caluoob. Execute ("update [cb_user] set userface =" & userface & "where id =" & filebleid)

Set file = nothing
Next
Set upload = nothing
Response. redirect "settings. asp"
%>

The core vulnerability code is
If fileEXT <> ". gif" and fileEXT <> ". jpg" then
Response. the write "<font size = 2> file format is incorrect [<a href = # onclick = history. go (-1)> re-upload </a>] </font>"
Response. end

I have asked a few people here that I think I should submit 1.jpg. asa is feasible, but if fileEXT <> ". gif "and fileEXT <> ". jpg "this sentence will kill any non-gif and jpg suffixes and even upload them. jpg + space does not work either.

You can use nc to upload the files ~ Yes, it's just truncation ~ As long as the file size does not exceed kb, the conditions are met ~ The directory here can be customized, so you can submit a file without truncation and create a new folder (here we all think of the 2003 parsing vulnerability. the asp folder uploads a horse to 2003 and treats it as an asp-parsed file.



II. Classic Injection

How wonderful this system is. There are injection, and post get cookies...

1. Loose Filtering:

In terms of filtering, programmers still think about it, but it is not complete. As a result, we can construct statements to break through haha.

The following is the do. asp code.
<%
Dim id, myrs, model, myfreinds
Model = Replace (Request. QueryString ("m "),"","")
Id = Replace (ValidInteger (Request ("in ")),"","")

See how the model variable comes over .. Simply use a replace function to filter... We can also submit;

Also in admin_reing.asp:


Dim Action, model, rs, ingid
Action = Request ("action ")
Model = CheckStr (Request ("model "))
Ingid = CheckStr (Request ("ingid "))

It is dangerous to directly submit the action variable to the server ..

Here, the model variables are different, not the previous do. asp command submitted with get, but this time another function Checkstr is used to filter them .. Don't despair, let's go to function. asp to see how this function is written:


------------------------------------
Function CheckStr (ChkStr)
Dim Str: Str = ChkStr
If IsNull (Str) Then
CheckStr = ""
Exit Function
End If
Str = Replace (Str ,"&","&")
Str = Replace (Str ,"","")
Str = Replace (Str ,"""",""")
CheckStr = Str
End Function

------------------------------------

Paging filtering is not strictly bypassed ,.. Haha another injection

3. Typical cookie injection. Let's take a look: (IN CB_admin.asp)

AdminName = Request. cookies (CookieName & "CaluoobAdmin") ("AdminName ")
AdminWord = Request. cookies (CookieName & "CaluoobAdmin") ("AdminWord ")

Let's bypass the construction statement .. . This set of programs... Real xx