WooYun.org

从子站MSSQL注射点进行突破，得到数据库中86个表，dump下该校上万师生校内信息及少量个人信息，弱口令可通达OA办公系统。
进入主站http://**.**.**.**/
而后从子站开始突破，找到注入点：
http://**.**.**.**/jk/dangban/file.asp?fileid=1011179
工具跑出85个表

再跑表名：
所有表：
aopeng_baoming
aopeng_file
back_column
bulletin
bumen
bumenfile
bumensort
bumensort1
course
dtproperties
duty
earnings
earningslx
earningstx
ip
ipjg
ipjhj
jwdsans
jwdsbm
jwdscj
jwdsque
jwdssort
jwdsuser
jwdsuserdept
leacol
league
lib_column
lib_file
lib_quote
lib_sort
libjj_column
libjj_file
libjj_quote
libjj_sort
model
name_id
news
news_bumensort
oacolpeo
oacolumn
oafile
oafmodel
oafpeople
oafsort
oafwh
oamanage
oapeople
oapsort
oatrack
p_course
paper
pc_column
people
pingbicent
pingbicourse
pingbicourse1
pingbisum
pingbiuser
plan_course
w@kc_coluln
wlkc_eile
wlkc_plan
xb_column
xb_file
xb_file1
xb_quote
xb_sort
xdanswer
xfqesult
xfsort
xwtj
ypprov
ypzl
zb
zbuser
zyfile
zylog
zyuser
可以看到不少敏感表名
earnings、earningslx、earningstx可得大量师生校内信息
而后通过aopeng_baoming表得到少量个人信息<img src="/upload/201601/0518541066b8797d538c96ec9d1
5ec128a36b8c6.png" alt="2.png" />
OA办公系统弱口令admin/oaadmin可直接进入后台修改信息
http://**.**.**.**/oa/index.asp