Start here,
http://www.google.com/search?hl=en&client=opera&rls=en&hs=A5f&q=vulnerabilities+in+smf&btnG=Search

It seems that you are new to all these things. The pointer I gave you were links to "exploits" for different versions of smf. What you need to do is that first determine the vesion of smf your friend has, then find exploits and vulnerabilities specific to that version and then use them to get admin privileges on your friend's forum.

Now since every there are many kind of vulnerabilities a forum can have, like XSS, SQL injection, remote file inclusion etc. or you can directly exploit the server that hosts the forum by exploiting any vulnerable demon running on it (In this case the vulnerabilities and the way to exploit them will be completely different).

If you have heard many of the terms first time in the above paragraphs then you need to research first on these concepts first because IMHO no one will spoon feed you to exploit anything especially when we don't know who is your "friend" whose forum you want to exploit.

You most likely don't need/want a shell for your case anyway.... you're looking to attack the application, not the server. Just because there's no upload script, doesn't mean there are no system calls going on somewhere in an application.


As already stated... the daemons, or system services, may be vulnerable. Again, this is probably not something you should be doing in this case as I would guess your friend doesn't own the server on which the smf is hosted (but I could be wrong)

As shakuni already advised, start searching google and the vulnerability databases for privilege escalation holes and the like. I don't have a direct answer for you because I don't know the vulnerabilities in SMF ... but if I wanted to find out, I would do the same thing you need to do and research just as we've recommended you do.

No one is going to tell you "click this link, or type this in, and you will have admin privileges."

Since you seem pretty new to web application security, I would highly suggest you take a look at the OWASP Project, and read through a lot of the material offered on that site.

BillV