Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ –...

33
Fun With JavaScript DeObfusca6on Adnan Mohd Shukor Mahmud Ab Rahman MyCERT, CyberSecurity Malaysia 1

Transcript of Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ –...

Page 1: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Fun  With  JavaScript  DeObfusca6on  

Adnan  Mohd  Shukor  Mahmud  Ab  Rahman  

MyCERT,  CyberSecurity  Malaysia  

1  

Page 2: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

JavaScript  Fun  Facts  #1  

2  

Page 3: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

JavaScript  Fun  Facts  #2  

•  Only  in  browsers?  

3  

Page 4: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

JavaScript  

•  JavaScript®  (some6mes  shortened  to  JS)  is  a  lightweight,  object-­‐oriented  language,  most  known  as  the  scrip6ng  language  for  web  pages,  but  used  in  many  non-­‐browser  environments  as  well.  

•  Executed  on  client  side  –  Code  will  be  downloaded  and  execute  on  the  client  applica6ons  

•  Obfusca6on  as  protec6on  

4  

Page 5: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

JavaScript  

•  Obfuscated  JavaScript  is  Everywhere  

5  

Page 6: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

JavaScript  

•  Obfuscated  JavaScript  is  Everywhere  – Browser  exploit  

6  

Page 7: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

JavaScript  

•  Obfuscated  JavaScript  is  Everywhere  – PDF  Reader  Exploit  

7  

Page 8: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

JavaScript  

•  Obfuscated  JavaScript  is  Everywhere  –  Injected  into  Database  +  Browser  Exploit  

8  

Page 9: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Common  Type  of  Obfusca6ons  

•  1  liner  •  Base64  •  Escape/Unescape  

9  

Page 10: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Common  Type  of  Obfusca6ons  

•  1  liner  

10  

Page 11: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Common  Type  of  Obfusca6ons  

•  1  liner  –  JS  Beau6fier  eg:  h\p://jsbeau6fier.org/    

11  

Page 12: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Common  Type  of  Obfusca6ons  

•  Base64  

12  

Page 13: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Common  Type  of  Obfusca6ons  

•  Base64  – Using  webbased  tool  to  decode  the  string  •  Eg:  h\p://home2.paulschou.net/tools/xlate/  

– Scrip6ng  kungfu  anyone?  ruby –e ‘require "Base64"; puts

Base64.decode64("YWxlcnQoIkh1aCEgQmFzZTY0KCkgPyIpOw==”)’!> alert("Huh! Base64() ?");!

13  

Page 14: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Common  Type  of  Obfusca6ons  

•  Escape/Unescape  

14  

Page 15: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Common  Type  of  Obfusca6ons  

•  Escape/Unescape  – Using  webbased  tool  to  decode  the  string  •  Eg:  h\p://www.tareeinternet.com/scripts/unescape.html  

– Yet  another  scrip6ng  kungfu?  

15  

Page 16: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  javascriptobfuscator.com  Obfusca6on  •  eval(func6on(p,a,c,k,e,r)  Obfusca6on  •  JSidle  Obfusca6on  •  (+[])  Obfusca6on  •  $=~[]  Obfusca6on  

16  

Page 17: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  With  a  lil  help  from:  – Firebug  JavaScript  Console  •  console.log()  •  console.debug()  •  console.info()  •  console.warn()  •  console.error()                                                              More  info:  h\p://davidwalsh.name/firebug-­‐console-­‐log  

– SpiderMonkey  – print()  – alert()  – <textarea>  

17  

Page 18: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  javascriptobfuscator.com  Obfusca6on  – Web  based  +  FREE  

– Converted  to  HEX  

18  

Page 19: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  javascriptobfuscator.com  Obfusca6on  – Convert  from  HEX  manually  :P  

– Using  <textarea>  – Hook  the  obvious  func6on(s)  

19  

Page 20: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  eval(func6on(p,a,c,k,e,r)  Obfusca6on  – AKA  Edwards  Packer  – Web  based  +  FREE  

20  

Page 21: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  eval(func6on(p,a,c,k,e,r)  Obfusca6on  – Using  <textarea>  – Hook  the  eval  func6on  •  alert()  •  console.log()  •  print  <=  for  SpiderMonkey  

21  

Page 22: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  JSidle  Obfusca6on  – By  Sven  T.  – Obfusca6on  +  6me  factor  – Appearance:  HITB  magazine,  Volume  1,  Issue  3  – Proposed  (by  the  author)  to  be  integrated  into  Metaspoit  

22  

Page 23: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  JSidle  Obfusca6on  

23  

Page 24: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  JSidle  Obfusca6on  – Hook  the  eval  func6on  •  alert()  •  console.log()  •  print  <=  for  SpiderMonkey  

24  

Page 25: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  (+[])  Obfusca6on  – AKA  JSF*ck  Obfusca6on  – By  Sifoo  Yosuke  HASEGAWA  – UTF-­‐8.jp  guy  – Encode  with  only  6  le\ers  -­‐  []()!+  – Master  of  weird  symbol  based  obfusca6on  

25  

Page 26: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  (+[])  Obfusca6on  

26  

Page 27: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  (+[])  Obfusca6on  – Hook  the  func6on  constructor  •  alert()  •  console.log  

27  

Page 28: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  $=~[]  Obfusca6on  – AKA  jjencode  – By  Sifoo  Yosuke  HASEGAWA  – UTF-­‐8.jp  guy  – Encode  with  symbol  

– For  some  reason,  also  called  as  “Dollar  sign  encode”  

28  

Page 29: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  $=~[]  Obfusca6on  

29  

Page 30: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

Modern  JavaScript  Obfusca6ons  

•  $=~[]  Obfusca6on  – Hook  the  func6on  constructor  •  alert()  •  console.log  

– Octal  decode  in  2nd  itera6on  

30  

Page 31: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

That  is  not  the  end!  

•  JavaScript  is  now  full  with  emo6on  that  can  be  express  via  emo6con  

31  

Page 32: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

That  is  not  the  end!  

•  JavaScript  aware  that  you  are  analyzing  them  – userAgent  – chrome://firebug/content/  – chrome://jsdeobfuscator/content/  

32  

Page 33: Fun$With$JavaScript DeObfuscaon$...Common$Type$of$Obfuscaons$ • Escape/Unescape$ – Using$webbased$tool$to$decode$the$string$ • Eg:$h\p:

-­‐End-­‐  

33  


Decode Week 4

Decode Week 4

Decode Week 2

Decode Week 2

Decode issue 0

Decode issue 0

Camaro RPO_VIN Decode

Camaro RPO_VIN Decode

Informatie m.b.t. de Rovict-toetsen In ESIS webbased · Rovict-toetsen. Dit betekent dat Rovict voor deze toetsen de normtabellen onderhoudt. Als gebruiker van ESIS webbased kunt

Informatie m.b.t. de Rovict-toetsen In ESIS webbased · Rovict-toetsen. Dit betekent dat Rovict voor deze toetsen de normtabellen onderhoudt. Als gebruiker van ESIS webbased kunt

Decode Jerusalem

Decode Jerusalem

GPU Architectures - courses.cs.washington.edu · Fetch Decode Execute Memory Writeback CPU1 Fetch Decode Execute Memory Writeback CPU2 Fetch Decode Execute Memory Writeback CPU3 Fetch

GPU Architectures - courses.cs.washington.edu · Fetch Decode Execute Memory Writeback CPU1 Fetch Decode Execute Memory Writeback CPU2 Fetch Decode Execute Memory Writeback CPU3 Fetch

IEEE - LT Decode

IEEE - LT Decode

Thesis Broadcast Webbased

Thesis Broadcast Webbased

Mte 3110 Decode

Mte 3110 Decode

Webbased narrowcasting stedenlink, chris kwant

Webbased narrowcasting stedenlink, chris kwant

Decode corporate stratgey

Decode corporate stratgey

Decode Genetics

Decode Genetics

20141212 Dissertation Decode

20141212 Dissertation Decode

Listen and Decode

Listen and Decode

Webbased Open Innovation

Webbased Open Innovation

#2 Distance and Webbased Learning

#2 Distance and Webbased Learning

MrSID Decode SDK 9.5 for LiDAR User Manualdoc.lizardtech.com/docs/SDK/MrSID Decode SDK for... · Chapter1:Introduction ThankyouforusingLizardTech®products.ThisisthedocumentationfortheMrSID®Decode

MrSID Decode SDK 9.5 for LiDAR User Manualdoc.lizardtech.com/docs/SDK/MrSID Decode SDK for... · Chapter1:Introduction ThankyouforusingLizardTech®products.ThisisthedocumentationfortheMrSID®Decode

Convolution Decode

Convolution Decode

Decode Credentials 2014

Decode Credentials 2014