Script giải mã file keygen của vBulletin

<?
  function head() {}

if ( array_key_exists("head", $_REQUEST) && $_REQUEST["head"]==1) { head(); die(); }
$name = "vBulletin";
$version = "3.6.7 PL1";
$md5_hash_location = "includes/md5_sums_vbulletin.php";
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title><? echo $name; ?> <? echo $version; ?> KEYGEN by TEAM GYSN</title>
<style type="text/css">
  table.head {
    background-color: #000000;
  }
  tr.head {
    background-color: #FFFFFF;
  }
  td {
    color: #000000;
    font-size: 11px;
    font-family: Arial, Tahoma, Verdana, Arial;
  }
</style>
</head>

<body>
<table align="center" border="0" cellpadding="0" cellspacing="0">
  <tr>
    <td style="vertical-align:top;">
      <table cellpadding="0" cellspacing="1" class="head">

          <tr class="head">
            <td style="text-align:center;"><? echo $name; ?> <? echo $version; ?> KEYGEN ...  BY<br />
            <img src="<? echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>?head=1" alt="" /><br />
            .GiVE....YOU..SOMETHiNG...NEW.
            </td>
          </tr>
      </table>

      <br />
    </td>
  </tr>
  <table style="width:30%;" align="center" cellspacing="1" class="head">
    <tr class="head">
      <td align="center">
<? if (isset($_POST['submit'])) {
  echo "<br />\r\n";
  echo "Keygen is checking and replacing the files ...\r\n";
  echo "<br />\r\n";
  echo "<br />\r\n";
// ==========================
// GEN AND REPLACE - START
// ==========================
 function find($callback, $dir=Array())
   {
       foreach($dir as $sPath) {
           if ($handlea = opendir($sPath)) {
               while (false !== ($filea = readdir($handlea))) {
                   if($filea !== "." && $filea !== "..") {
                       if(is_dir($sPath."/".$filea)) {
                           find($callback, Array($sPath."/".$filea));
                       } else {
                           eval("$callback(\"$sPath\", \"$filea\");");
                       }
                   }
               }
               closedir($handlea);
           }
       }

   }
   function walk($dir, $filea)
   {
   global $fileinc, $filearray, $wDate, $wKey, $wTime, $wDtime, $wcKey, $md5_hash_location;
   ++$fileinc;
   $do = ($dir."/".$filea);
     $me = strpos($do, "gysn-kg");
	  if (!$me) {
        $handle = file_get_contents($do);
        $new1 = str_replace("[#]GYSN_LICNR[#]", $wKey, $handle);
        $new2 = str_replace("[#]GYSN_DLDATE[#]", $wDtime, $new1);
        $new3 = str_replace("[#]GYSN_DATE[#]", $wDate, $new2);
        $new4 = str_replace("[#]GYSN_TIME[#]", $wTime, $new3);
        $new5 = str_replace("[#]GYSN_CNR[#]", $wcKey, $new4);
        $fp = fopen($do, "w");
        fwrite($fp, $new5);
        fclose($fp);
		$vbulletin_file = file_get_contents($md5_hash_location);
        $search_file = $filea;
		$dir_temp = substr($dir, 1);
		if (!isset($dir_temp)) { $dir_final = $dir_temp; }
		else { $dir_final = substr($dir_temp, 1); }
		$search_file_name = "%" . $dir_final . "/" . $search_file;
		$new_file = str_replace($search_file_name, md5_file($do), file_get_contents($md5_hash_location));
		$tt = fopen($md5_hash_location, "w+");
		fwrite($tt, $new_file);
		fclose($tt);

                }
	          }
 settype($template1, "string");

// you could repeat the alphabet to get more randomness
$template1 = "1234567890ABCDEF";

function GetRandomString1($length)
{

       global $template1;

       settype($length, "integer");
       settype($rndstring, "string");
       settype($a, "integer");
       settype($b, "integer");

       for ($a = 0; $a <= $length; $a++) {
               $b = rand(0, strlen($template1) - 1);
               $rndstring .= $template1[$b];
       }

       return $rndstring;

}
 settype($template2, "string");

// you could repeat the alphabet to get more randomness
$template2 = "1234567890ABCDE";

function GetRandomString2($length)
{

       global $template2;

       settype($length, "integer");
       settype($rndstring, "string");
       settype($a, "integer");
       settype($b, "integer");

       for ($a = 0; $a <= $length; $a++) {
               $b = rand(0, strlen($template2) - 1);
               $rndstring .= $template2[$b];
       }

       return $rndstring;

}
function GetRandDate()
{
    $rMonth = 5;
    $rDay = rand(17,31);
    $test = date("D M jS Y", mktime(0,0,0, $rMonth, $rDay, 2007));
    return $test;
}
$random1 = GetRandomString1(6);
$random2 = GetRandomString2(10);
$wKey = "VBF" . $random1;
$wcKey_plain = "J" . $random2;
$wcKey = md5($wcKey_plain);
$wDate = GetRandDate();
$wDtime = date("H:i") . ", " . $wDate;
$wTime = date("H:i:s");
find("walk", Array("."));
// =====================
// LiC DETAiLS - START
// =====================
echo "        Done. <strong>Make sure all GYSN placeholder have been replaced.</strong><br />\r\n";
echo "        <br />\r\n";
echo "        Customer Number: " . $wcKey_plain . "\r\n";
echo "        <br />\r\n";
echo "        Licence Number: " . $wKey . "\r\n";
echo "        <br />\r\n";
echo "        Download Date: " . $wDtime . "\r\n";
echo "        <br />\r\n";
echo "        <br />\r\n";
echo "        <strong>HINT:</strong>\r\n";
echo "        <br />\r\n";
echo "        Save the customer and licence number for later.\r\n";
echo "        <br />\r\n";
echo "        <br />\r\n";
echo "        If all went fine <strong>delete the gysn-kg.php now.</strong>\r\n";
echo "        <br />\r\n";
echo "        <br />\r\n";
// =====================
// LiC DETAiLS - END
// =====================
// ==========================
// GEN AND REPLACE - END
// ==========================
} else {
      echo "        <br />\r\n";
      echo "        <strong>Check the following points before you continue:</strong>\r\n";
      echo "        <br />\r\n";
      echo "        <br />\r\n";
      echo "        1.) Your brain is fully functional\r\n";
      echo "        <br />\r\n";
      echo "        2.) All files are writable (chmod 777)\r\n";
      echo "        <br />\r\n";
      echo "        <br />\r\n";
      echo "        <strong>WARNING:</strong>\r\n";
      echo "        <br />\r\n";
      echo "        Reverse the chmoding after the replacement!\r\n";
      echo "        <br />\r\n";
      echo "        <br />\r\n";
}
?>
      </td>

    </tr>
  </table>
  <table style="width:30%;" align="center" cellspacing="1">
    <tr>
      <td align="center">
        <br />
        <form action="<? echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">
            <input type="submit" name="submit" value="Generate & Replace" />
        </form>

      </td>
    </tr>
  </table>
</table>
</body>
</html>