0

I have an obfuscated script. I was asked to de-obfuscate the code and extract the URL from the script. However, I used multiple de-obfuscation tools such as

It did not work. The obfuscated script is found below.

<script
 language=javascript>document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67
%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%
69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70
%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%
29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%7
3%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E
%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%6
5%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68
%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%
6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E'));dF('q
mfbtf%2631xbju//////%261B%264Dtdsjqu%264Fbmfsu%2639%2633%26v93F6%26v74E1%26v8%3A
4B%26v8639%26v7348%26v7681%26v7FF2%26vGG1D%26v629E%26v7C32%26v81C%3A%26v62GC
%26v6484%26v64FG%26v5F1C%26v9G8E%2633%263%3A%264D0tdsjqu%264F%261B%264Dtdsjqu
%264F%261Bmpdbujpo%264E%2638iuuq%264B00ttp/h%7Bmjc/hpw/do0joufsmjcTTP0nbjo0Sfbefs
Mphjo%264GdneBDU%264Emphjo%2637gvsm%264E%26363GjoufsmjcTTP%26363Ghpup%26363G8
7%2637mphjoje%264E5512942%3A%3A817418633%2637seqbttxe%264E41863n3%2638%264D0tds
jqu%264F1')</script>

I decode the script and it gave me the results below.

<script
language=javascript&gt;document.write(unescape(&#39;<script lang
uage="javascript">funct%
69on dF(s){var s1=unescap
e(s.substr(0,s.length-1%
29); var t='';for(i=0;i<%7
31.length;i++)t+=String.
fromCharCode(s1.charCod%6
5At(i)-s.substr(s.length
-1,1));document.write(u%
6Eescape(t));}</script>&#39;));dF(&#39;q
mfbtf&31xbju//////&1B&4Dtdsjqu&4Fbmfsu&39&33&v93F6&v74E1&v8:
4B&v8639&v7348&v7681&v7FF2&vGG1D&v629E&v7C32&v81C:&v62GC
&v6484&v64FG&v5F1C&v9G8E&33&3:&4D0tdsjqu&4F&1B&4Dtdsjqu
&4F&1Bmpdbujpo&4E&38iuuq&4B00ttp/h{mjc/hpw/do0joufsmjcTTP0nbjo0Sfbefs
Mphjo&4GdneBDU&4Emphjo&37gvsm&4E&363GjoufsmjcTTP&363Ghpup&363G8
7&37mphjoje&4E5512942::817418633&37seqbttxe&4E41863n3&38&4D0tds
jqu&4F1&#39;)&lt;/script&gt;

I am not able to find any of the url in this point. What should I do to find the URL?

When I implemented the decoded text on the javascript code editor online.

<script language="javascript">function dF(s){var s1=unescape(s.substr(0,s.length-1)); var t='';for(i=0;i<s1.length;i++)t+=String.fromCharCode(s1.charCodeAt(i)-s.substr(s.length-1,1));console.log(unescape(t));}
document.write(dF('qmfbtf&31xbju//////&1B&4Dtdsjqu&4Fbmfsu&39&33&v93F6&v74E1&v8:4B&v8639&v7348&v7681&v7FF2&vGG1D&v629E&v7C32&v81C:&v62GC&v6484&v64FG&v5F1C&v9G8E&33&3:&4D0tdsjqu&4F&1B&4Dtdsjqu&4F&1Bmpdbujpo&4E&38iuuq&4B00ttp/h{mjc/hpw/do0joufsmjcTTP0nbjo0SfbefsMphjo&4GdneBDU&4Emphjo&37gvsm&4E&363GjoufsmjcTTP&363Ghpup&363G87&37mphjoje&4E5512942::817418633&37seqbttxe&4E41863n3&38&4D0tdsjqu&4F1'));</script>

I tried to run the output however, it says undefined.

  • If you look at the first function, there is still some URL encoded text (which I mentioned in my answer below) – schroeder May 18 '18 at 8:53
  • once you take care of that, the rest reveals itself – schroeder May 18 '18 at 8:59
  • None of the links you provided above return "undefined" when I copy/paste your last line in. Remove the <script parts and try again ... – schroeder May 18 '18 at 10:16
  • see the updates to my answer about using a beautifier and removing PHP before using a deobfuscator – schroeder May 18 '18 at 10:21
  • When you see something like &lt;script , that's mean the page is using URL encoded text. This is simple obfuscation tactic to prevent simple analytical tools to locate <script> tag and check script for malicious activities. – mootmoot May 18 '18 at 12:24
1

I ran the code through your links, and they are all unable to translate the encoded text like &#39 and %3C.

Decode those parts first, then look for any left over encoded text (there is some) run the result through a deobfuscator, taking care of line breaks.

The first part is the code to decrypt the dF() text.

To help the deobfuscators, try running the decoded code through a "beautifier". It can resolve any remaining line break and other syntax issues. And if you haven't already, remove the <script code etc. so that the javascript deobfuscators are only dealing with the javascript and not the PHP code.

I have been successful in decoding it and recovering the URL using the steps above.

0

The point is that the code uses different encodings. The first one is an HTML encoding (like &#39; stands for '). Decoding this results in

<script
 language=javascript>document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67
%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%
69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70
%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%
29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%7
3%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E
%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%6
5%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68
%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%
6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E'));dF('q
mfbtf%2631xbju//////%261B%264Dtdsjqu%264Fbmfsu%2639%2633%26v93F6%26v74E1%26v8%3A
4B%26v8639%26v7348%26v7681%26v7FF2%26vGG1D%26v629E%26v7C32%26v81C%3A%26v62GC
%26v6484%26v64FG%26v5F1C%26v9G8E%2633%263%3A%264D0tdsjqu%264F%261B%264Dtdsjqu
%264F%261Bmpdbujpo%264E%2638iuuq%264B00ttp/h%7Bmjc/hpw/do0joufsmjcTTP0nbjo0Sfbefs
Mphjo%264GdneBDU%264Emphjo%2637gvsm%264E%26363GjoufsmjcTTP%26363Ghpup%26363G8
7%2637mphjoje%264E5512942%3A%3A817418633%2637seqbttxe%264E41863n3%2638%264D0tds
jqu%264F1')</script>;

The first part unescapes the first long string. This results in the code for the function dF():

<script language="javascript">function dF(s){var s1=unescape(s.substr(0,s.length-1)); var t='';for(i=0;i<s1.length;i++)t+=String.fromCharCode(s1.charCodeAt(i)-s.substr(s.length-1,1));console.log(unescape(t));}</script>

Now that you have this function, you can invoke it with the second encoded string:

<script language="javascript">dF('qmfbtf&31xbju//////&1B&4Dtdsjqu&4Fbmfsu&39&33&v93F6&v74E1&v8:4B&v8639&v7348&v7681&v7FF2&vGG1D&v629E&v7C32&v81C:&v62GC&v6484&v64FG&v5F1C&v9G8E&33&3:&4D0tdsjqu&4F&1B&4Dtdsjqu&4F&1Bmpdbujpo&4E&38iuuq&4B00ttp/h{mjc/hpw/do0joufsmjcTTP0nbjo0SfbefsMphjo&4GdneBDU&4Emphjo&37gvsm&4E&363GjoufsmjcTTP&363Ghpup&363G87&37mphjoje&4E5512942::817418633&37seqbttxe&4E41863n3&38&4D0tdsjqu&4F1')</script>
  • 3
    isn't this what I said? – schroeder May 18 '18 at 9:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.