One PHP manual injection and permission acquisition

Recently, I met a PHP site.

Http://www.xxx.com/
Http://www.xxx.com/index.php? Id = 112
This injection point

Judgment basis: and 1 = 1 and 1 = 2 you know it's basically similar to ASP
Start manually:
The order by statement is used to sort the result set.
The final result is 1.
Several Functions
User () return to the current User
Database () returns the current Database
Version () returns Mysql Version (this is important)
Mysql version> = 4.0 support for Union query Mysql> = 5.0 support for information_schema Query

The following table name and field name have been obtained for basic information:
Many tutorials are written with the table name
Admin administrator Manager User Users
However, the success count is very small. Why wait a while to read a Mysql database?

This is the table name of the Mysql database.
If you guess, you can't guess it if you're exhausted.
The principle is as follows:
Next we will mention this database.

This is a database automatically installed when mysql 5.0 is used.
Information_schema. Metadata is data about data, such as database name or table name, column data type, or access permission.
My understanding: when using the mysql database to create a database, it will automatically record the new database tables and fields in the information_schema Database
Table Name
Table Fields
Start to construct statements after the principles are clear
Analyze this sentence and check the name of the first table in the database.
Select group_concat (table_name) from information_schema.tables where table_schema = 0x7A73323236315F646220 (hex value zs2261_db)
Analyze this sentence and check the name of the table in the database as a group.

Query fields in the same way

Finally, find the table name and field name, and query
Md5 query cracking login background

There are no restrictions on uploading files in the background. You can directly upload files of the aspx class.
Permission for execution
Intranet IP Address
During the Elevation of Privilege, the Elevation of Privilege using barbecue and PR was unsuccessful.
It is estimated that the patch has been installed.
So I checked the Administrator and looked at it.
I found several administrators and found a user's password through IISSPY, so .....
Check that the user in IISSPY tries to connect
Forwarding port. Connection successful