Chapter 324: When the Invasion Is in Progress (2)
"How?" Hearing that Xiao Yuan was so confident, Professor Xia hurriedly asked.
Xiao Yuan did not immediately answer Professor Xia's question, but opened another tool, this tool has a command line window similar to DOS, Xiao Yuan crackled and knocked in it, and as the last crisp return sound fell, a growing percentage appeared in the command line window, showing the progress of the software running.
While waiting for the results of this software to come out, Xiao Yuan turned around and explained: "The server used by Dongji Telecom is also IBM's AIX, and the code I just wrote can be used, which will save a lot of time, so you should be able to achieve your purpose before five o'clock." ”
"I see, but I'm curious, IBM's AIX security is recognized all over the world, how can it be as if it is unguarded in your eyes?" Professor Xia asked curiously.
"There is a theory in software engineering, which says that there is no software without bugs in the world, according to this sentence, it can also be said that there is no absolutely safe system in the world, security is just a relative word, although the security of AIX is very high, but it is not absolute." Xiao Yuan said.
"So, you've got a hidden vulnerability to AIX?" Professor Xia asked.
"Yes." Xiao Yuan replied with certainty.
Professor Xia listened to Xiao Yuan's words, but fell silent, not knowing what he was thinking.
Xiao Yuan saw that Professor Xia didn't speak, so he didn't take the initiative to say anything more to him, but stared at the percentage in the black command line window on the screen and kept scrolling.
"Have you ever thought about selling these vulnerabilities to IBM, or maybe some other organization doesn't?" After a while, Professor Xia suddenly asked.
Xiao Yuan turned his head, looked at Professor Xia, and asked, "Why do you ask that?" ”
"I think if you sell this loophole, there will be people who are willing to pay a lot of money to buy it, this is a good opportunity to make a fortune, and now many 0-day organizations in the world are making money from this." Professor Xia said.
"I know that, but I'm not going to sell loopholes to make money?" Xiao Yuan said.
"Why?" Professor Xia asked a little puzzled, and then speculated, "Is it because of your current military status?" ”
"It's not for this reason, I have my principles." Xiao Yuan said.
"What principles, can you talk about them?" Professor Xia was a little surprised by Xiao Yuan's answer, so he asked.
Xiao Yuan smiled and didn't explain, at this time, the percentages in the command line scrolled to 100% and stopped, and then returned a lot of data, so he focused on these data and began to find the information he wanted from them.
Professor Xia saw that Xiao Yuan was busy, and he didn't continue to ask and bother him, but became more and more interested in him.
After Xiao Yuan analyzed the data, he opened the previous script writing program, rewrote a piece of code, and then intercepted some of the data just now, embedded it in this perl script, saved it as a file, and returned to the command line software just now, knocked a few lines of commands in it, and sent the script just written, and a large number of English messages appeared in the window, scrolling up quickly, and at the same time, the hard disk light began to flash wildly.
"What is this doing?" Professor Xia asked again.
"Just now is a SQL injection script, through this script, we can obtain the IP list on the Dongji Telecom server, send it back to our computer, save it as a data file, and after a while, we can know the IP list of Hemengzhai from the script, and then find out the AIX server in it." Xiao Yuan explained that he found that this Professor Xia was really curious, and he had to ask why every step he made.
"Can it be done so easily?" Professor Xia saw that Xiao Yuan was idle again, so he asked.
"Is it easy?" Xiao Yuan asked rhetorically.
"Hehe, I'm a layman, it looks pretty simple." Professor Xia said with a smile.
"The real technology is in those two scripts, if I say, if any of those two scripts are taken out and sold, even if the price is 100,000, someone may buy it, do you still think it's simple?" Xiao Yuan asked again.
"Hehe, I just said it casually, and I didn't mean anything else." Professor Xia said with a smile, he saw that Xiao Yuan had completed this task quite easily, and his originally nervous mood also became relaxed, so his tone was much more relaxed.
Xiao Yuan turned his gaze to the computer screen again, minimized the command line window just now, and then began to prepare for the next action, after he finished the preparations, after restoring the command line window just now, he saw that the information scrolling inside had ended.
"Now it's time to analyze the data, right?" Professor Xia asked.
"Hmm." Xiao Yuan nodded, and at the same time opened the data file that he had just generated with the software he had just configured the analysis rules, and then asked, "What is the English of Hemengzhai?" ”
Professor Xia was stunned for a moment, and said a few words casually, Xiao Yuan asked in detail about the specific letters, whether there were commonly used abbreviations, etc., and then split the information he got according to certain rules and wrote a regular expression.
Regular expression is a kind of logical expression used for string operation, which defines a lot of specific symbols, through the combination of these symbols, to form a kind of "rule string", through these rule strings can filter a large number of disorganized strings, in order to quickly find the purpose of meeting the conditions of the string, so that it is somewhat abstract, let's take a familiar example, the search function of Windows Explorer can identify some simple regular expressions, If we want to search all word files that start with a, we can use a*.doc to search, where the * sign is a symbol defined by a regular expression, representing any combination of zero or more characters.
According to Xiao Yuan's experience, when the database developer sets the place name variable, he usually does not use the full name of the place name, but will use some abbreviations and other deformed names, if he directly uses the English of Hemengzhai to search, it is likely to find nothing, so he needs to establish a mechanism that can filter out all the words that have nothing to do with Hemengzhai, regular expressions are more than enough to do this kind of thing, of course, here, the regular expressions written by Xiao Yuan are better than the a* cited above. The doc example is much more complex.
After doing all this, Xiao Yuan began to let the software analyze the data files, because this analysis did not involve the network, but only analyzed locally, so the speed was very fast, it took about five minutes, and the results came out.
The result is a list of IP addresses, which Xiao Yuan imported into the previous network scanning tool, which scanned these IP addresses and returned the type of operating system corresponding to the computer that was online in these IP addresses.
This process took a little longer, about twenty minutes, after doing it, the time had reached more than four o'clock, the sky outside began to brighten, Professor Xia began to worry faintly again in the process of waiting, during this period, he has been observing Xiao Yuan, he found that Xiao Yuan in such a long time of waiting, his expression can always remain calm, without the slightest impatience, can't help but secretly surprised, more and more feel that this young man who is never more than twenty years old is not simple, I also feel that I have lived to be more than forty years old, and my heart is not as calm as a teenager, and I can't help but feel ashamed secretly.
After the scanning process was over, the software returned a result, Xiao Yuan couldn't help but breathe a sigh of relief when he saw the returned result, because the return result showed that there was only one IP running AIX server in Hemengzhai, and if the returned result was a list, he still had to check this list one by one, and it would take a lot of time, but fortunately, this situation that worried him did not appear.
"Professor Xia, the address is out." Xiao Yuan pointed to the results returned on the computer and said.