WooYun.org

$mid = intval($mid);


    if(empty($mid))


    {


        ShowMsg('你的效验串不合法！', '-1');


        exit();


    }


    $row = $dsql->GetOne("SELECT * FROM `#@__member` WHERE mid='{$mid}' ");


    $needUserhash = md5($cfg_cookie_encode.'--'.$mid.'--'.$row['email']);


    if($needUserhash != $userhash)


    {


        ShowMsg('你的效验串不合法！', '-1');


        exit();


    }

function GetCookie($key)


    {


        global $cfg_cookie_encode;


        if( !isset($_COOKIE[$key]) || !isset($_COOKIE[$key.'__ckMd5']) )


        {


            return '';


        }


        else


        {


            if($_COOKIE[$key.'__ckMd5']!=substr(md5($cfg_cookie_encode.$_COOKIE[$key]),0,16))


            {


                return '';


            }


            else


            {


                return $_COOKIE[$key];


            }


        }


    }

#! /usr/bin/env python


#-*- coding: utf-8 -*-


from hashlib import md5


import sys


import string





def getmd5(str):


    m = md5()


    m.update(str)  


    return m.hexdigest()





if __name__ == "__main__":


   if len(sys.argv) == 3:


      value=str(sys.argv[1])


      ckMd5=str(sys.argv[2])


      lowercase =  string.lowercase


      uppercase = string.uppercase


      for a1 in uppercase:


          for a2 in lowercase:


              for a3 in uppercase:


                  for a4 in uppercase:


                      for a5 in lowercase:


                          for a6 in range(1000,10000):


                              for a7 in uppercase:


                                  print (a1 + a2 + a3 + a4 + a5 + str(a6) + a7)


                                  result = getmd5(a1 + a2 + a3 + a4 + a5 + str(a6) + a7 + value)[:16];


                                  if result == ckMd5:


                                      print '----------------------------'


                                      print 'ck:' + (a1 + a2 + a3 + a4 + a5 + str(a6) + a7)


                                      sys.exit(0)


      sys.exit(0)


   else:


       print ("usage: %s value ckMd5" % sys.argv[0])


       sys.exit(-1)