session_start();
// SET THE USER AGENT
$user_agent = 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari';
// COOKIE FILE LOCATION
$cookiefile = "/tmp/cookies.txt";
// ------------ START THE ADMIN PANEL LOGIN
// SET LOGIN INFORMATION
$url = 'http://domain.com/admin.php?login/login';
$referrer = 'http://domain.com/admin.php';
$post_fields = array();
$post_fields['login'] = 'ADMIN'; // ADMINISTRATIVE USER NAME
$post_fields['password'] = 'PASS'; // ADMINISTRATIVE USER PASSWORD
$post_fields['cookie_check'] = '1'; // SET COOKIE CHECK TO TRUE
$post_fields['redirect'] = '/admin.php'; // SET REDIRECT URL
$post_fields['_xfToken'] = ''; // XF TOKEN IS CURRENTLY BLANK
// SPECIFY THE HOST(NAME) AND OTHER HEADERS
$host = 'domain.com';
$headers = array("Host: ".$host, "Content-Type: application/x-www-form-urlencoded");
// INITIALIZE CURL SESSION
$curl_handler = curl_init();
$options = array
(
CURLOPT_URL => $url,
CURLOPT_POST => TRUE,
CURLOPT_POSTFIELDS => $post_fields, // POST VARIABLES TO BE SENT
CURLOPT_HEADER => TRUE, // DISPLAY HEADERS
CURLOPT_VERBOSE => TRUE, // DISPLAY COMMUNICATION WITH SERVER
CURLOPT_HTTPHEADER => $headers,
CURLOPT_FOLLOWLOCATION => TRUE,
CURLOPT_RETURNTRANSFER => TRUE,
CURLOPT_REFERER => $referrer,
CURLOPT_ENCODING => "",
CURLOPT_USERAGENT => $user_agent,
CURLOPT_AUTOREFERER => TRUE,
CURLOPT_CONNECTTIMEOUT => 120,
CURLOPT_TIMEOUT => 120,
CURLOPT_MAXREDIRS => 10,
CURLOPT_COOKIEJAR => $cookiefile,
CURLOPT_COOKIEFILE => $cookiefile
);
curl_setopt_array ( $curl_handler, $options );
$data['content'] = curl_exec ( $curl_handler ); //RETRIEVES THE WEBPAGE'S SOURCE CODE
$data['error'] = curl_errno ( $curl_handler );
$data['errormessage'] = curl_error ( $curl_handler );
$data['headers'] = curl_getinfo ( $curl_handler );
// ------------ END THE ADMIN PANEL LOGIN
define(MYSQL_IP, 'IP ADDRESS');
define(MYSQL_USERNAME, 'USER NAME');
define(MYSQL_PASSWORD, 'PASSWORD');
define(MYSQL_DATABASE, 'DATABASE');
$conn = mysql_connect(MYSQL_IP, MYSQL_USERNAME, MYSQL_PASSWORD, MYSQL_DATABASE) or die(mysql_error());
mysql_select_db(MYSQL_DATABASE,$conn) or die(mysql_error());
//-------------- START RETRIEVAL OF ADMIN CSRF_TOKEN
$sql = "SELECT csrf_token FROM xf_user_profile WHERE user_id = '1' LIMIT 1";
// QUERY THE DATABASE
$result = mysql_query($sql) or die(mysql_error());
$csrf = mysql_fetch_assoc($result);
if(mysql_num_rows($result) < 1)
{
echo "1"; // THERE WAS AN ISSUE RECEIVING ADMINISTRATIVE PERMISSIONS
exit;
}
$csrf_token = stripslashes($csrf['csrf_token']);
//-------------- END RETRIEVAL OF ADMIN CSRF_TOKEN
//WE USE THE RETRIEVED CSRF TOKEN FOR FUTURE CURL POST REQUESTS BY DOING:
$time = time();
$post_fields['_xfToken'] = '1,'.$time.','.sha1($time.$csrf_token);
// AND INCLUDING THE _xfToken IN THE post_fields FOR OTHER CURL POSTS, HOWEVER WHEN WE MAKE THIS FUTURE CURL REQUESTS IT CONTINUES TO GIVE US THE LOGIN PAGE WHEN WE EXAMINE THE $data['content']
