Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #31157 > unrolled thread

Re: A little exercise

Back to article view | Back to comp.lang.javascript

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: A little exercise Andreas Bergmaier <andber93@web.de> - 2016-08-25 00:58 +0200
    Re: A little exercise Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-08-25 06:35 +0200

#31157 — Re: A little exercise

Stefan Ram wrote:
>   Go to httpuqrxcityscom (replacing the letters »u«, »q«, »r«,
>   and »s« by the usual symbols) with JavaScript turned /off/.
>
>   Look for JavaScript in the page source and decrypt its
>   encrypted parts it without actually running them (this
>   is for /experienced/ JavaScript users).

OK. "Decrypting" wasn't all too hard though:

function nextRandomNumber(){
     var hi = this.seed / this.Q;
     var lo = this.seed % this.Q;
     var test = this.A * lo - this.R * hi;
     if(test > 0){
         this.seed = test;
     } else {
         this.seed = test + this.M;
     }
     return (this.seed * this.oneOverM);
}

function RandomNumberGenerator(unix){
     var d = new Date(unix*1000);
     var s = d.getHours() > 12 ? 1 : 0;
     this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 
0xFFFF)+ (Math.round(s * 0xFFF));
     this.A = 48271;
     this.M = 2147483647;
     this.Q = this.M / this.A;
     this.R = this.M % this.A;
     this.oneOverM = 1.0 / this.M;
     this.next = nextRandomNumber;
     return this;
}

function createRandomNumber(r, Min, Max){
     return Math.round((Max-Min) * r.next() + Min);
}

function generatePseudoRandomString(unix, length, zone){
     var rand = new RandomNumberGenerator(unix);
     var letters = 
['a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z'];
     var str = '';
     for(var i = 0; i < length; i ++ ){
         str += letters[createRandomNumber(rand, 0, letters.length - 1)];
     }
     return str + '.' + zone;
}

var unix = Math.round(+new Date()/1000);
var domainName = generatePseudoRandomString(unix, 16, 'ru');
console.log("http://"+domainName+"/runforestrun?sid=botnet");

(I've left out the parts that create an iframe and load the referenced 
page, which obviously serves malware).

>   Read the result of your decryption and speculate on /why/
>   it does what it apparently does (retrieve a single probably
>   "nonexisting" random URI? Why?)

That I will leave to others.
Only I can tell that it's not as random as it appears to be.
Which would be the actually interesting part.

- Bergi

[toc] | [next] | [standalone]

#31160

Stefan Ram wrote:

>   But then, »unix = Math.round(+new Date()/1000)«,

The unary plus operator –

<http://ecma-international.org/ecma-262/7.0/#sec-unary-plus-operator>

– is unnecessary as the “/” operator is a Multiplicative Operator (like “*” 
and “%”) that already converts its operands to Number:

<http://ecma-international.org/ecma-262/7.0/#sec-multiplicative-operators-runtime-semantics-evaluation>

And since a UNIX timestamp has only seconds, it is debatable whether it 
should not be Math.floor(…) instead of Math.round(…).

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web