CVE-2017-8917 Joomla SQLi 概念验证

该仓库包含一个简单、适合 CTF 的 Joomla com_fields SQL 注入漏洞（CVE-2017-8917）概念验证（PoC）。其目标是保持工作流轻量，同时展示完整的利用流程：检测、枚举和数据提取。

CVE-2017-8917 概述

漏洞类型：Joomla com_fields 组件中的 SQL 注入。

根本原因：list[fullordering] 参数未正确过滤，导致 SQL 可被注入到生成的查询中。当使用基于报错的 payload（例如 UpdateXML）构造时，SQL 结果会显示在响应中，从而实现数据提取。

利用方式（高层概述）：

向 index.php?option=com_fields&view=fields&layout=modal 发送精心构造的请求，并将 list[fullordering] 参数设置为恶意 payload。
使用基于报错的函数（如 UpdateXML）强制数据库回显结果。
解析响应（在本 PoC 中为 <title> 标签）并提取注入的输出。
迭代查询以枚举版本、数据库名、表、列和行。

关键代码路径

以下是关键组件。

`parse_args()`

将 CLI 参数解析为包含 host 和 debug 的简单 args 对象。脚本假定 HTTP 运行在 80 端口，并根据 --host 构建基础 URL。

`run_exploit()`

run_exploit() 是主要的编排函数：

会话处理：使用 requests.Session()，使 cookies 和 headers 保持持久化。
request_title()：发送请求并提取 <title> 值。该 PoC 使用基于报错的 SQLi 将数据泄漏到该标签中，因此这是数据提取的核心。
build_params()：创建带有注入 SQL 的易受攻击请求参数。
完整流程：探测 → 枚举 → 转储。
枚举/转储方法：sql_list() 和 dump_table() 可自动化枚举和分块提取。

`_fetch_token()`

CSRF 令牌从 Joomla 登录页面提取。虽然某些场景可能不需要它，但许多 Joomla 路由仍会强制进行 CSRF 检查。包含该令牌可以：

在对更严格配置的利用中提高可靠性。
让 PoC “最贴近实际”。
即使在强制登录流程或令牌检查的情况下，也能复用该脚本。

`wrap_payload()` 和 `encode_sql_string()`

这些辅助函数用于生成实际的注入 payload：

wrap_payload() 将原始查询包装在 UpdateXML(...) 中，以强制产生基于报错的输出。
encode_sql_string() 将字符串转换为 CHAR(...) 表达式，以避免引号问题。

分块提取（`_dump_table()`）

各行使用分隔符拼接，并通过子字符串分块获取，以避免截断。这样即使行值很长，也能保持输出一致。

使用方法

python main.py --host <TARGET_IP>

可选的调试输出：

python main.py --host <TARGET_IP> --debug

预期输出（请自行填写）

└─$ python exploit.py --host <TARGET>

                         ]LLLLLLLLmmmmmLLLLLL[
                         ]LLLLLLLLLLLLLLLLL[
                         ]LLLLLLLLLLLLLLLLL[
                         ]LLLLLLLLLLLLLLLLL[
                         ]LLLLLLLLLLLLLLLLL[
         ms.             ]LLLLLLLLLLLLLLLLL[              ,m
        ]LLLLs.          ]LLLLLLLL~+LLLLLLL[           _gLLLL
        LLLLLLLL_.        LLLLLLLL  ~~\LLLL[        ,gLLLLLLLi
       dLLLLLLLLLLm_     -LLLLLLLo      LLL[      _mLLLLLLLLLL.
      iLLLLLLLLLLLLLLs.  ]LLf` ,  'c    LLL[   ,gLLLLLLLLLLLLLL
     iLLLLLLLLLLLLLLLLLLsgL`   'c-  \.    LLLLLLLLLLLLLLLLLLLLLL
    ,LLLLLLLLLLLLLLLLLLLLL!      =__/Li  iLLLLLLLLLLLLLLLLLLLLLLL
   gLLLLLLLLLLLLLLLLLLLLLL    imm_.Y~'`  LLLLLLLLLLLLLLLLLLLLLLLLL.
  dLLLLLLLLLLLLLLLLLLLLLLL     'LL_     dLLLLLLLLLLLLLLLLLLLLLLLLLLi
,LLLLLLLLLLLLLLLLLLLLLLLLLi        ~--__LLLLLLLLLLLLLLLLLLLLLLLLLLLLs
'LLLLLLLLLLLLLLLLLLLLLLLLLLs.          LLLLLLLLLLLLLLLLLLLLLLLLLLLLL~
   'LLLLLLLLLLLLLLLLLLLLLLLLLL_.         LLLLLLLLLLLLLLLLLLLLLLLLf
      'LLLLLLLLLLLLLLLLLLLLLLLLLLm_       'LLLLLLLLLLLLLLLLLLLLLLLf`
         'LLLLLLLLLLLLLLLLLLLLLLLL'Lm_      LLLLLLLLLLLLLLLL`
            LLLLLLLLLLLLLLLLLLLLLL  'LL     LLLLLLLLLLLLLf
             'LLLLLLLLLLLLLLLLLLL    L     LLLLLLLLLLL~
               _LLLLLLLLLLLLLLL  !i   ]   ,LLLLLLLLLLLs.
           gLLLLLLLLLLLLLLLLL!   's  [ _mLLLLLLLLLLLLLLLs
         gmLLLLLLLLLLLLLLLLLLL      ~eLLLLLLLLLLLLLLLLLLLLLms
      _gLLLLLLLLLLLLLLLLLLLLLL.       'LLLLLLLLLLLLLLLLLLLLLLLs_
   _gLLLLLLLLLLLLLLLLLLLLLLLLLL_        !LLLLLLLLLLLLLLLLLLLLLLLLs.
,gLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLm_       YLLLLLLLLLLLLLLLLLLLLLLLLLms
 LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLs    ]LLLLLLLLLLLLLLLLLLLLLLLLLL`
  'LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL 'YL   ]LLLLLLLLLLLLLLLLLLLLLLLLf
   'LLLLLLLLLLLLLLLLLLLLLLLLLLLf`!   f  ,LLLLLLLLLLLLLLLLLLLLLLLL!
    'LLLLLLLLLLLLLLLLLLLLLLLLL[      LmmLLLLLLLLLLLLLLLLLLLLLLLL`
      LLLLLLLLLLLLLLLLLf  LLLLi   t  LLLLLLL  LLLLLLLLLLLLLLLLL!
      'LLLLLLLLLLLLLf     LLLL[    '*LLLLLLL    'LLLLLLLLLLLLL[
       !LLLLLLLLLf`       LLLLLs     'YLLLLL       ~LLLLLLLLLL
        LLLLLLf~          LLLLLLLs     LLLLL          ~LLLLLL`
        'LLL~             LLLLLLLLLm  iLLLLL             ~LLL~
         ~`               LLLLLLLL[LLmLLLLLL               '`
                          LLLLLL`d[ LLLLLLLL
                          LLLLLLdL[ LLLLLLLL
                          LLLLLLLLLLLLLLLLLL    Juergen Jakubowski
                          LLLLLLLLLLLLLLLLLL
                          LLLLLLLLLLLLLLLLLL   [email protected]

                          EXPLOIT BY ztrxwzy. 
              INSPIRED BY THE POC FROM Baptiste Contreras.
    
[888] Target : http://10.66.187.202:80/index.php
[888] CSRF token : 3ec54b1b32b5dc2dd8186537821b8dc1
[888] http://10.66.187.202:80/index.php is vulnerable to SQLi
[888] Database version detected : 5.5.64-MariaDB
[888] Current database : joomla
[888] Tables in database joomla

致谢与作者

作者：ztrxwzy
灵感来源：本 PoC 的部分内容受 Baptiste Contreras 的工作启发：
https://github.com/BaptisteContreras/CVE-2017-8917-Joomla

许可证

特此免费授予任何获得本软件及相关文档文件（“软件”）副本的人，不受限制地处理本软件，包括但不限于使用、复制、修改、合并、发布、分发、再许可和/或销售软件副本的权利，并允许向其提供本软件的人这样做，但须满足以下条件：

本软件按“原样”提供，不提供任何明示或暗示的担保，包括但不限于适销性、特定用途适用性和非侵权性的担保。在任何情况下，作者或版权持有人均不对因本软件或本软件的使用或其他交易而产生、与之相关或与之相关的任何索赔、损害或其他责任承担责任，无论是合同诉讼、侵权诉讼还是其他诉讼。

joomla.3.7.0exploit

最受欢迎