WooYun.org

/etc/password
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
www:x:500:500::/alidata/www:/sbin/nologin
mysql:x:501:501::/home/mysql:/sbin/nologin
数据库
available databases [8]:
[*] hello3a
[*] hello3a_sc
[*] hello3a_t1
[*] information_schema
[*] jeewx
[*] mysql
[*] performance_schema
[*] test
获取表
Database: hello3a
[123 tables]
+---------------------------------+
| base_channel |
| base_clouduser |
| base_com_loca |
| base_company |
| base_companyapplication |
| base_companyuser |
| base_complaint |
| base_complaint_handle |
| base_department |
| base_dimensionality |
| base_evaluation |
| base_evaluationtodimensionality |
| base_function |
| base_icon |
| base_instation_message |
| base_location |
| base_mail |
| base_news |
| base_operation |
| base_pledgee |
| base_resource |
| base_role |
| base_role_function |
| base_role_opeartion |
| base_section |
| base_sms_mail_log |
| base_staffuser |
| base_store |
| base_systemsettings |
| base_systemtemple |
| base_user |
| base_user_base_pledgee |
| base_user_channel |
| base_user_role |
| base_user_token |
| base_user_weixin |
| bbs_discussion_category |
| bbs_id_generator |
| bbsuser |
| bid_bidtype |
| bondsman |
| companybidtype |
| discussionboard |
| discussionmoderator |
| discussionreply |
| discussiontopic |
Table: base_user
[42 columns]
+-----------------------+--------------+
| Column | Type |
+-----------------------+--------------+
| version | int(11) |
| autoBidTime | datetime |
| birthday | date |
| createDate | datetime |
| email | varchar(50) |
| firstInvestment | date |
| firstLoan | date |
| gender | varchar(255) |
| hersbitBalance | int(11) |
| homePhone | varchar(45) |
| hometown_id | int(11) |
| id | int(11) |
| idCard | varchar(255) |
| investmentCompanyId | int(11) |
| lastLoginDate | datetime |
| lastLoginIP | varchar(255) |
| loanCompanyId | int(11) |
| loginCount | int(11) |
| loginPassword | varchar(50) |
| mobilePhone | varchar(45) |
| msn | varchar(100) |
| openAutoBidSetting | char(1) |
| payPwdAnswer | varchar(255) |
| payPwdQuestion | varchar(255) |
| portrait_id | int(11) |
| qq | varchar(100) |
| qqOpenId | varchar(255) |
| realName | varchar(50) |
| recoverToken | varchar(255) |
| registerGoal | varchar(255) |
| reminderQueryAnswer | varchar(255) |
| reminderQueryQuestion | varchar(255) |
| residence_id | int(11) |
| score | double |
| siteId | bigint(20) |
| talentScout | int(11) |
| userName | varchar(45) |
| userStatus | varchar(255) |
| virtual | char(1) |
| weibo | varchar(100) |
| weiboUId | varchar(255) |
| workPhone | varchar(45) |
+-----------------------+--------------+
Table: base_user
[42 columns]
+-----------------------+--------------+
| Column | Type |
+-----------------------+--------------+
| version | int(11) |
| autoBidTime | datetime |
| birthday | date |
| createDate | datetime |
| email | varchar(50) |
| firstInvestment | date |
| firstLoan | date |
| gender | varchar(255) |
| hersbitBalance | int(11) |
| homePhone | varchar(45) |
| hometown_id | int(11) |
| id | int(11) |
| idCard | varchar(255) |
| investmentCompanyId | int(11) |
| lastLoginDate | datetime |
| lastLoginIP | varchar(255) |
| loanCompanyId | int(11) |
| loginCount | int(11) |
| loginPassword | varchar(50) |
| mobilePhone | varchar(45) |
| msn | varchar(100) |
| openAutoBidSetting | char(1) |
| payPwdAnswer | varchar(255) |
| payPwdQuestion | varchar(255) |
| portrait_id | int(11) |
| qq | varchar(100) |
| qqOpenId | varchar(255) |
| realName | varchar(50) |
| recoverToken | varchar(255) |
| registerGoal | varchar(255) |
| reminderQueryAnswer | varchar(255) |
| reminderQueryQuestion | varchar(255) |
| residence_id | int(11) |
| score | double |
| siteId | bigint(20) |
| talentScout | int(11) |
| userName | varchar(45) |
| userStatus | varchar(255) |
| virtual | char(1) |
| weibo | varchar(100) |
| weiboUId | varchar(255) |
| workPhone | varchar(45) |
+-----------------------+--------------+
Table: base_user
[42 columns]
+-----------------------+--------------+
| Column | Type |
+-----------------------+--------------+
| version | int(11) |
| autoBidTime | datetime |
| birthday | date |
| createDate | datetime |
| email | varchar(50) |
| firstInvestment | date |
| firstLoan | date |
| gender | varchar(255) |
| hersbitBalance | int(11) |
| homePhone | varchar(45) |
| hometown_id | int(11) |
| id | int(11) |
| idCard | varchar(255) |
| investmentCompanyId | int(11) |
| lastLoginDate | datetime |
| lastLoginIP | varchar(255) |
| loanCompanyId | int(11) |
| loginCount | int(11) |
| loginPassword | varchar(50) |
| mobilePhone | varchar(45) |
| msn | varchar(100) |
| openAutoBidSetting | char(1) |
| payPwdAnswer | varchar(255) |
| payPwdQuestion | varchar(255) |
| portrait_id | int(11) |
| qq | varchar(100) |
| qqOpenId | varchar(255) |
| realName | varchar(50) |
| recoverToken | varchar(255) |
| registerGoal | varchar(255) |
| reminderQueryAnswer | varchar(255) |
| reminderQueryQuestion | varchar(255) |
| residence_id | int(11) |
| score | double |
| siteId | bigint(20) |
| talentScout | int(11) |
| userName | varchar(45) |
| userStatus | varchar(255) |
| virtual | char(1) |
| weibo | varchar(100) |
| weiboUId | varchar(255) |
| workPhone | varchar(45) |
+-----------------------+--------------+
前辈的脚印：# /etc/profile
# System wide environment and startup programs, for login setup
# Functions and aliases go in /etc/bashrc
pathmunge () {
if ! echo $PATH | /bin/egrep -q "(^|:)$1($|:)" ; then
if [ "$2" = "after" ] ; then
PATH=$PATH:$1
else
PATH=$1:$PATH
fi
fi
}
# ksh workaround
if [ -z "$EUID" -a -x /usr/bin/id ]; then
EUID=`id -u`
UID=`id -ru`
fi
# Path manipulation
if [ "$EUID" = "0" ]; then
pathmunge /sbin
pathmunge /usr/sbin
pathmunge /usr/local/sbin
fi
# No core files by default
ulimit -S -c 0 > /dev/null 2>&1
if [ -x /usr/bin/id ]; then
USER="`id -un`"
LOGNAME=$USER
MAIL="/var/spool/mail/$USER"
fi
HOSTNAME=`/bin/hostname`
HISTSIZE=1000
if [ -z "$INPUTRC" -a ! -f "$HOME/.inputrc" ]; then
INPUTRC=/etc/inputrc
fi
export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE INPUTRC
for i in /etc/profile.d/*.sh ; do
if [ -r "$i" ]; then
if [ "$PS1" ]; then
. $i
else
. $i >/dev/null 2>&1
fi
fi
done
unset i
unset pathmunge
export JAVA_HOME=/usr/java/jdk1.6.0_45
export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export PATH=$PATH:$JAVA_HOME/bin
export PATH=$PATH:/alidata/server/mysql/bin:/alidata/server/nginx/sbin:/alidata/server/php/sbin:/alidata/server/php/bin
echo "****************************************************************"
echo "*Your system contains a serious security bug, please contact *"
echo "[email protected] for further details. I can help you to secure*"
echo "your system."
echo "ϵͳϵ[email protected]
echo "ϵͳ
echo "ʽЧ
echo "***********************************************************
用户信息：