Getshell of Fuyi fashion Hotel (controls the Intranet with nearly 10 primary domain names + nearly 20 databases + nearly 2 million user information + more than 0.6 million membership cards)

Getshell of Fuyi fashion Hotel (controls the Intranet with nearly 10 primary domain names + nearly 20 databases + nearly 2 million user information + more than 0.6 million membership cards)

Injection and upload take full control
Here, we must say that the gifts from many manufacturers are too stingy. Fortunately, we are not black hats ......
This time, you must be able to afford the gift of a hole !!!!!!!!!!!!!!!!!!!!!!!!

The main site of www.fxw.s.com has SQL injection:
 

URL: http://www.fxw.s.com/index.aspxpostdata :act?s&citycode=nkg

Arbitrary File Upload exists in the management background:
 

URL:http://www.fxhotels.com/addhotels.aspx

First, let's take a look at the injection point and list the Databases listed:
 

Then, we checked the table items of an ibe database and the corresponding number of data rows:
 

Find a DUser table, and dump the table content with the full plaintext login name and password:
 

I'm so glad that I can see the username and password for background logon, But I suddenly found that there is still one thing: the login page, so I continued to look for it again, after scanning the port, we found port 8089 was open, so we accessed it. It was a background logon point and logged on with admin: fx1234:
 

There are too few management functions in the background, so I roughly browsed it and found an Arbitrary File Upload point:
 

Find the webshell landing point (http://pic.fxhotels.com: 8081/news/Aspnet. aspx), visit:
 

OK, you have obtained control of the system. The next step is to find some valuable things. After reading the directory structure, we found that the web contains many domain names:
 

Almost all the main sites in Fuyi !!! That is to say, Fuyi's website is directly under full control.

The following shows some database connections:
 

 

After a thorough exploration, we found that the data you are interested in is in CRM:
 

I checked the entry of the housing registration form, with nearly 2 million items:
 

List several pieces of detailed information, too many of which will not be listed here. After all, it is private:
 

Other information is not pasted here.

All Domain Names and database information listed above are not modified

Please delete webshell by yourself. The path has been given

Solution:

Parameter escape and upload restrictions.