WooYun.org

$mid = intval($mid);
    if(empty($mid))
    {
        ShowMsg('你的效验串不合法！', '-1');
        exit();
    }
    $row = $dsql->GetOne("SELECT * FROM `#@__member` WHERE mid='{$mid}' ");
    $needUserhash = md5($cfg_cookie_encode.'--'.$mid.'--'.$row['email']);
    if($needUserhash != $userhash)
    {
        ShowMsg('你的效验串不合法！', '-1');
        exit();
    }

function GetCookie($key)
    {
        global $cfg_cookie_encode;
        if( !isset($_COOKIE[$key]) || !isset($_COOKIE[$key.'__ckMd5']) )
        {
            return '';
        }
        else
        {
            if($_COOKIE[$key.'__ckMd5']!=substr(md5($cfg_cookie_encode.$_COOKIE[$key]),0,16))
            {
                return '';
            }
            else
            {
                return $_COOKIE[$key];
            }
        }
    }

#! /usr/bin/env python
#-*- coding: utf-8 -*-
from hashlib import md5
import sys
import string
def getmd5(str):
    m = md5()
    m.update(str)  
    return m.hexdigest()
if __name__ == "__main__":
   if len(sys.argv) == 3:
      value=str(sys.argv[1])
      ckMd5=str(sys.argv[2])
      lowercase =  string.lowercase
      uppercase = string.uppercase
      for a1 in uppercase:
          for a2 in lowercase:
              for a3 in uppercase:
                  for a4 in uppercase:
                      for a5 in lowercase:
                          for a6 in range(1000,10000):
                              for a7 in uppercase:
                                  print (a1 + a2 + a3 + a4 + a5 + str(a6) + a7)
                                  result = getmd5(a1 + a2 + a3 + a4 + a5 + str(a6) + a7 + value)[:16];
                                  if result == ckMd5:
                                      print '----------------------------'
                                      print 'ck:' + (a1 + a2 + a3 + a4 + a5 + str(a6) + a7)
                                      sys.exit(0)
      sys.exit(0)
   else:
       print ("usage: %s value ckMd5" % sys.argv[0])
       sys.exit(-1)