Python SQLi Scripts on WSL2 Errno 111

user_13922171 0
Viewed 233

I am trying to complete a portswigger academy exercise with the following python script.

    proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}
    def sqli_password(url):
    password_extracted = ""
    for i in range(1,21):   #Numbers of characters in the password
        for j in range(32,126):    #Iterating through the ASCII tables from 32 to 126
            sqli_payload = "' and (select ascii(substring(password,%s,1)) from users where username='administrator')='%s'--';" %(i,j)
            sqli_payload_encoded = urllib.parse.quote(sqli_payload)
            cookie = {'TrackingId':'hbORcjYUFBvjTbbq' + sqli_payload_encoded, 'session':'m6xmtbeL2CHAG8PMJjijbSZ9EqaWDwuY'}
            r = requests.get(url, cookies=cookie, verify=False)

I am proxying the requests through Burp using the localhost. I get the following error:

(+) Retrieving administrator password...
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 159, in _new_conn
    conn = connection.create_connection(
  File "/usr/lib/python3/dist-packages/urllib3/util/connection.py", line 84, in create_connection
    raise err
  File "/usr/lib/python3/dist-packages/urllib3/util/connection.py", line 74, in create_connection
    sock.connect(sa)
ConnectionRefusedError: [Errno 111] Connection refused

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 662, in urlopen
    self._prepare_proxy(conn)
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 950, in _prepare_proxy
    conn.connect()
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 314, in connect
    conn = self._new_conn()
  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 171, in _new_conn
    raise NewConnectionError(
urllib3.exceptions.NewConnectionError: <urllib3.connection.VerifiedHTTPSConnection object at 0x7fa9337d9e20>: Failed to establish a new connection: [Errno 111] Connection refused

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/requests/adapters.py", line 439, in send
    resp = conn.urlopen(
  File "/usr/lib/python3/dist-packages/urllib3/connectionpool.py", line 719, in urlopen
    retries = retries.increment(
  File "/usr/lib/python3/dist-packages/urllib3/util/retry.py", line 436, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='ac181f151f07cec480be1f2b002c00f6.web-security-academy.net', port=443): Max retries exceeded with url: / (Caused by ProxyError('Cannot connect to proxy.', NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fa9337d9e20>: Failed to establish a new connection: [Errno 111] Connection refused')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  ...
requests.exceptions.ProxyError: HTTPSConnectionPool(host='ac181f151f07cec480be1f2b002c00f6.web-security-academy.net', port=443): Max retries exceeded with url: / (Caused by ProxyError('Cannot connect to proxy.', NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fa9337d9e20>: Failed to establish a new connection: [Errno 111] Connection refused')))

I tried to debug the code by using print, and I noticed that I couldn't print the state of the request. When removing proxies, the script is working perfectly. I assume the script is not able to proxy through burp. It might be because I am using WSL2. Burp is installed on my windows. I do not know how to fix this problem as interoperability should be enabled as I am able to access my Windows10 filesystem from WSL. I tried to launch this code from within the C drive using WSL2 but it's also not working. Is there a way to fix this interoperability problem?

windows-subsystem-for-linux localhost proxy python
1 Answers

Burp is installed on my Windows. I do not know how to fix this problem as interoperability should be enabled as I am able to access my Windows 10 filesystem from WSL.

Background

WSL2 is running on a virtual network card through a subset of Hyper-V. This network card is NAT'd behind the Windows host, whereas WSL1's network acted more like it was bridged with that of the Windows host.

So 127.0.0.1 is the IP of the WSL2 instance, not that of its Windows host.

However, if you ran that same code under WSL1, it would likely work (assuming it doesn't need any kernel/device functionality present in WSL2).

WSL's interop functionality does automagic forwarding of localhost from Windows to a WSL2 instance, but not the other way around.

Proposed Solution

What you need is one of the following:

  • The IP of the primary Windows network adapter
  • If the Windows host has a DNS name, you could use that
  • The IP of the virtual router provided by the Windows host to WSL2 (ip route show default)
  • The mDNS name of the Windows host from within WSL2, which should resolve to the IP of the virtual router.

Try replacing the first line with (untested, since I'm not using a proxy in my Windows host):

import socket
proxies = {'http': f'{socket.gethostname()}.local:8080', 'https': f'{socket.gethostname()}.me:8080'}

Assuming mDNS is working, that should resolve dynamically to the mDNS hostname of the Windows virtual router. If not, try one of the other IP addresses or names mentioned above.

user_118109330
Related