Vous n'êtes pas identifié.
Voici un decodeur Javascript puissant, tout nouveau, trouvé sur 0x000000, il permet de decoder les javascript de script malveillant ![]()
#!/usr/bin/perl -w
use strict;
## Javascript decoder script by Nicholas Albright of DISOG - http://www.disog.org
## Special thanks to Jose Nazario and Daniel Wesemann for their contributions to the community!
## Check for Spidermonkey and arguments:
if (! -e "/usr/bin/js") { die ("** This script requires Mozilla\'s SpiderMonkey. Install it and symlink it to /usr/bin/js\n"); }
if (! $ARGV[0]) { &Usage }
$SIG{INT} = \&TrapBreak;
our ($Result, $ResultHold, $Answer, $Pass) = (0, 0, 0, 1);
our $Infile = shift;
our $StepThru = shift || '0';
#Open our encoded javascript file and put it into a scalar (for easier handling)
open (EncodedFile, "<$Infile") || die ("Unable to open file $Infile. Check your spelling and try again.\n");
our $EncodedJS = do { local $/; <EncodedFile> };
close (EncodedFile);
#attempt to decode, and check to see if it needs another pass
&MakeHuman();
&CheckAgain();
##Print results, or failures.
if ($Result) {
print ("\n//\t\t\t** Begin Decoded Javascript **\n\n$Result\n\n//\t\t\t** End Decoded Javascript. It took $Pass passes. **\n");
exit 0;
}
elsif ($ResultHold) {
$Pass = $Pass-1;
print ("\n//\t\t\t** Begin Decoded Javascript **\n\n$ResultHold\n\n//\t\t\t** End Decoded Javascript. It took $Pass passes. **\n");
exit 0;
}
else {
print ("\n//\t\t\t** Decode failed. You might wish to try step mode and or clean up the code a bit.\n");
exit 255;
}
## Sub routines:
sub MakeHuman {
my $Document = ("function docfunc(){this.write=function(string) {print(string);}};\nvar document=new docfunc();");
if ($EncodedJS =~ /eval/i) { $Document = ("$Document\neval=print;"); }
my $Javascript = ("$Document\n$EncodedJS");
$Javascript =~ (s/<\/?((java)?script|body|html)([^>]*)?>/\n\/\/$&\t\/\/\t<-\tRemoved by JSDECODE\n/gi);
$Javascript =~ (s/\"/\\\"/gi);
$Result = (`js -e "$Javascript" 2>/dev/null`);
}
sub CheckAgain {
while ($Result =~ /(<?\/?(java)?script>|function)/i and $Result !~ /<(body|html)>/i) {
$ResultHold = $Result;
if ($StepThru =~ /step/i) {
print ("*** Pass $Pass: What I decoded appears to be another JavaScript. Shall I try to decode it too ([YES]/no)? ");
$Answer = <STDIN>;
}
if ($Answer !~ /n/i){
$EncodedJS = $Result;
&MakeHuman();
$Pass++
}
else { return (); };
}
}
sub TrapBreak {
print ("\n** CTL-BREAK Caught. Cleaning up and exiting. **\n");
close (EncodedFile);
exit 255;
}
sub Usage {
print ("Nicholas Albright\'s Javascript Decoder (jsdecode.pl)\n");
print ("\tOptions:\n\t\t-step = step through multiple encodings (useful if you want to see every decode phase)\n");
print ("\tUsage:\n\t\t$0 <encoded_file.js> [-step]\n\n");
exit 0;
}
#We should never get this far.
die ("Something failed. Check the script and try again\n");Hors ligne