# Date: 2020-04-27
# Exploit Author: SajjadBnd
# Vendor Homepage: https://hits.ir
# Software Link: http://dl.persianscript.ir/script/hitsir-script-persian%28PersianScript.ir%29.zip
# Software Link(mirror): http://dl.nuller.ir/hitsir-script-persian[www.nuller.ir].zip
# Version: 1.0
# Tested on: Win10 Professional x64
[ description of script ]
With this script you can set up a site to exchange statistics
and traffic as well as
increase rankings. In this script, it is possible to exchange
Google +1,
exchange Facebook points, exchange Twitter followers,
exchange YouTube visitors, exchange visit statistics.
[ poc ]
file : ipn.php
parameters : 'item_name' , 'item_number'
method : POST
source [
36: mysql_query $pack = mysql_fetch_object(mysql_query("SELECT *
FROM `c_pack` WHERE `name`='{$item_name}' AND
`coins`='{$item_number}'"));
19: $item_name = $_POST['item_name'];
20: $item_number = $_POST['item_number'];
requires:
4: if(!(mysql_connect("$host", "$user", "$pass") &&
mysql_select_db("$tablename")))
31: if(!$fp) else
35: if(strcmp($res, "VERIFIED") == 0)
]
parameter : 'custom'
method : POST
source [
43: mysql_query mysql_query("UPDATE `users` SET
`coins`=`coins`+'{$pack->coins}' WHERE `id`='{$custom}'");
27: $custom = $_POST['custom'];
requires:
4: if(!(mysql_connect("$host", "$user", "$pass") &&
mysql_select_db("$tablename")))
31: if(!$fp) else
35: if(strcmp($res, "VERIFIED") == 0)
41: if(($receiver_email == $site->paypal) &&
($payment_amount == $pack->price) && ($payment_status ==
'Completed'))
]
parameters : 'item_name','mc_gross'
method : POST
source [
44: mysql_query mysql_query("INSERT INTO `transactions` (user,
points, pack, money, date) VALUES('{$user->login}',
'{$pack->coins}', '{$item_name}', '{$payment_amount}',
NOW())");
19: $item_name = $_POST['item_name'];
22: $payment_amount = $_POST['mc_gross'];
requires:
4: if(!(mysql_connect("$host", "$user", "$pass") &&
mysql_select_db("$tablename")))
31: if(!$fp) else
35: if(strcmp($res, "VERIFIED") == 0)
41: if(($receiver_email == $site->paypal) &&
($payment_amount == $pack->price) && ($payment_status ==
'Completed'))
]
file : register.php
parameters : 'PlusREF','register'
method : COOKIE,POST
source [
22: mysql_query $user1 = mysql_query("SELECT * FROM `users`
WHERE `id`='{$ref}'");
21: $ref = $_COOKIE['PlusREF'];
requires:
3: if(isset($_POST['register']))
19: if(!checkpwd ($sec['password'], $sec['password2'])) else
20: if(isset($_COOKIE['PlusREF']))
]
&
source [
40: mysql_query mysql_query("INSERT INTO
`users`(email,login,IP,pass,passdecoded,ref,signup,activate)
values('{$sec['email']}','{$sec['user']}','$final','$passc','$passa','{$ref}',NOW(),'{$activare}')")
or
37: $final = visitorip ();
39: $passc = md5($passa);
38: $passa = $sec['password'];
38: $passa = $sec['password'];
21: $ref = $_COOKIE['PlusREF']; // if(isset($_COOKIE)),
26: $activare = rand(000000000, 999999909);
requires:
3: if(isset($_POST['register']))
19: if(!checkpwd ($sec['password'], $sec['password2'])) else
]
