Discuz! Remote attachment FTP password decryption Tool

Modify and execute the following program to obtain the FTP password of the Discuz remote attachment.

<? Php
$ Authkey = xxxxxxxxxxxxxxxxxx; // The Setting table is saved. If you have the permission to back up data, you can go down and check it out.
$ Discuz_auth_key = md5 ($ authkey. $ _ SERVER [HTTP_USER_AGENT]);
$ String = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; // This is the encrypted string in the FTP Password stored in the Setting table.
$ Password = authcode ($ string, DECODE, md5 ($ authkey ));
Echo $ password;
Function authcode ($ string, $ operation = DECODE, $ key =, $ expiry = 0 ){
$ Ckey_length = 4;
$ Key = md5 ($ key? $ Key: $ discuz_auth_key );
$ Keya = md5 (substr ($ key, 0, 16 ));
$ Keyb = md5 (substr ($ key, 16, 16 ));
$ Keyc = $ ckey_length? ($ Operation = DECODE? Substr ($ string, 0, $ ckey_length): substr (md5 (microtime (),-$ ckey_length )):;
$ Cryptkey = $ keya. md5 ($ keya. $ keyc );
$ Key_length = strlen ($ cryptkey );

$ String = $ operation = DECODE? Base64_decode (substr ($ string, $ ckey_length): sprintf (% 010d, $ expiry? $ Expiry + time (): 0). substr (md5 ($ string. $ keyb), 0, 16). $ string;
$ String_length = strlen ($ string );

$ Result =;
$ Box = range (1, 0,255 );

$ Rndkey = array ();
For ($ I = 0; $ I <= 255; $ I ++ ){
$ Rndkey [$ I] = ord ($ cryptkey [$ I % $ key_length]);
}

For ($ j = $ I = 0; I I <256; $ I ++ ){
$ J = ($ j + $ box [$ I] + $ rndkey [$ I]) % 256;
$ Tmp = $ box [$ I];
$ Box [$ I] = $ box [$ j];
$ Box [$ j] = $ tmp;
}

For ($ a = $ j = $ I = 0; $ I <$ string_length; $ I ++ ){
$ A = ($ a + 1) % 256;
$ J = ($ j + $ box [$ a]) % 256;
$ Tmp = $ box [$ a];
$ Box [$ a] = $ box [$ j];
$ Box [$ j] = $ tmp;
$ Result. = chr (ord ($ string [$ I]) ^ ($ box [($ box [$ a] + $ box [$ j]) % 256]);
}

If ($ operation = DECODE ){
If (substr ($ result, 0, 10) = 0 | substr ($ result, 0, 10)-time ()> 0) & substr ($ result, 10, 16) = substr (md5 (substr ($ result, 26 ). $ keyb), 0, 16 )){
Return substr ($ result, 26 );
} Else {
Return;
}
} Else {
Return $ keyc. str_replace (=, base64_encode ($ result ));
}

}
?>