Printable View
دوستان خسته نباشید
فرض کنید که چنین کدی داریم:
حالا اگه بخوایم با این کد دیکریپت شه میشه از سایتی مثله این سایت استفاده کرد:کد:http://mythemes.ir/t4/script.js
منتها بازم کدهایی که میده مسنکه با یه سیستمه دیگه دی کد شدنکد:http://www.tareeinternet.com/scripts/unescape.html
راهی به نظرتون میرسه؟
سلامت باشی برادر
من نمی فهمم اینا چرا از این کارا میکنن، بگذریم...
اگه خوب دقت کنی، وقتی که عملیات unescape کردن رو انجام میدی یک تابع به نام gcb1cbc77 می بینی که decode شده، این تابع برای این نوشته شده که کدهایی که encode شده رو دیکود کنه.
با استفاده از فایرباگ هم می تونستی ببینی که کدهای css به فایل html اضافه میکنه و اگر هم بخوای خودت دست بکار بشی با یه خرده دستکاری و alert و اینها نتیجه شبیه به این چیزی میشه که می بینی:
محتوای مخفی: کدها:
آهان
دستت درد نکنه امین جان
والا یه نمه همچین متوجه نشدم
الان شما خودت چه مراحلی رو انجام دادی تا به اون کد های css برسی؟
والا فایر باگ هم نصب کردم ولی کارنکردم باهاش:31:تازه نصبش کردم
خب یه خرده واضح تر توضیح میدم.
همونطور که خودت هم گفتی، این به غیر از escape کردن، از یک سیستم(!) دیگه برای encrypt کردن استفاده کرده و طبیعیه که برای اینکه کدها قابل استفاده باشن باید decrypt بشن تا برای مرورگر و موتور رندر js قابل خوندن باشه. برای همین تابعی که وظیفه ی decrypt رو به عهده داره درون اسکریپت قرار داده شده. حالا دلیل escape کردن چیه؟ بخاطر این کدها رو escape کردن تا از تداخل کوتیشن ها و دابل کوتیشن ها جلوگیری بشه ( تابعی که کدها رو انکریپت میکنه بعضی از کاراکترها رو به این دو کاراکتر تبدیل میکنه )، چون در JavaScript باید کوتیشن ها رو درست درجای خودش استفاده کرد.
قبلا همچین کدی رو دیده بودم که اینکار رو میکرد، ولی الان اصلا یادم نیست.
تنها کاری که من کردم البته یه خرده هم زیادی کاری کردم برای اینکه یه خرده بفهمم چی به چیه، با یه خرده سعی و خطا این کدها دیکریپت شدن. اول کدهای مربوط به تابع رو unescape کردم و بعد کدهای encrypt شده رو بصورت escape شده و حذف مقادیر غیر نیاز کدها رو نمایش دادم.
کد:alert(gcb1cbc77(unescape('%3e%78%77%76%69%63%18%77%7f%69%60%38%21%76%6a%73%73%2e%61%77%74%28%3b%08%0b%0a%0c%69%68%63%74%79%66%5a%69%6e%66%73%6c%77%65%67%2a%62%6d%6c%68%78%3f%22%33%2f%34%27%35%2f%3a%1e%6d%5a%78%62%64%6f%39%2a%17%2b%1f%2d%1e%28%3c%16%63%6e%6f%73%2f%6d%5a%6a%64%6a%71%3d%5a%58%65%6e%6a%5b%30%7e%0a%0b%5f%7f%77%6b%71%71%28%63%67%68%68%71%5c%72%61%68%64%3f%6f%6e%6d%67%30%7e%0a%0b%2c%74%62%7a%6d%60%7a%65%69%65%77%2a%67%5f%6d%62%62%70%3b%51%66%6f%6a%74%1f%4f%63%73%1b%58%6a%68%5c%6d%3d%17%61%6c%6f%72%2d%74%6f%7f%60%3b%30%37%67%77%38%1d%61%6b%6f%65%77%3b%22%65%60%6d%61%65%67%39%18%61%62%6a%5c%71%39%6e%6a%61%73%3a%1e%73%62%6a%75%65%3b%1f%37%27%2b%6f%75%39%18%77%6b%71%71%28%5e%6e%6e%60%6d%3b%70%61%60%6e%75%3a%1d%6f%5b%6b%67%66%6f%65%2d%77%65%69%3b%32%32%6a%7f%3c%7a%08%08%2a%67%6b%76%7a%67%6c%68%7b%2e%70%64%78%65%3d%27%29%6d%71%38%1a%68%68%6b%6e%70%3e%24%26%29%2d%2d%2f%2a%30%1b%65%69%6d%59%77%30%6d%60%67%73%3d%17%77%62%75%72%2d%5a%62%60%66%6f%39%74%6e%60%67%71%39%18%70%6f%65%71%65%39%1a%3b%2b%2f%6d%76%3f%1b%66%58%61%61%66%68%6c%2e%73%6e%6e%3e%2a%26%69%75%3a%7a%0f%01%29%63%64%74%29%7c%7d%60%61%71%67%3c%26%2b%2f%32%6e%70%3c%16%61%60%64%64%62%7b%3d%2e%34%35%68%73%31%7c%08%0b%2d%66%6e%71%31%7a%75%61%67%7a%61%3b%2c%2f%2a%38%6b%77%3a%1e%60%66%6f%62%65%71%39%2b%3e%30%6f%75%39%7d%0e%00%2b%61%64%75%35%70%70%66%61%72%60%3d%39%33%34%6d%77%3d%17%63%62%64%65%60%77%30%28%30%36%6f%72%30%61%6b%6e%5f%74%3d%62%64%67%71%38%1a%69%5a%60%6a%65%76%68%7b%6b%61%28%66%6f%56%60%62%3b%1e%75%75%62%21%65%71%73%6a%31%28%2c%68%77%74%63%6b%6c%60%72%2d%63%79%28%73%31%2d%6d%72%7a%61%60%68%62%28%6e%75%5c%2d%2f%2a%6d%66%62%24%3a%1f%64%56%64%68%66%70%6b%76%64%65%28%73%62%6a%6a%5a%73%3b%1e%6a%68%23%77%60%6d%62%5b%7b%3c%7a%08%08%2a%67%6f%73%31%7a%74%63%6b%77%67%3b%34%37%37%66%71%3a%1d%67%67%6e%60%67%71%38%29%36%3d%69%75%3a%1f%60%63%68%5e%71%38%6c%66%6c%75%3a%1d%61%5b%68%6c%64%73%6d%75%69%6a%2c%64%68%5e%61%6a%3d%1f%70%70%6c%23%6e%75%71%6d%39%29%24%6e%76%71%66%65%6e%6b%76%2f%64%71%29%7b%37%2c%68%77%74%63%6b%6c%60%2f%66%74%54%2b%31%2f%68%68%60%2f%3e%1d%63%5e%65%60%60%71%6e%73%6a%67%23%77%60%6d%62%5b%7b%3d%1f%6f%6d%2d%75%6b%69%60%5c%73%3d%72%0e%09%2f%62%61%71%3b%7e%76%64%63%76%6f%3d%2e%2d%2e%37%6b%7e%3e%1d%65%62%63%6c%63%73%3b%32%28%6b%7e%3e%67%69%6c%5b%7b%3d%6b%60%64%74%3c%16%67%5c%62%68%61%79%68%72%6f%62%2d%62%63%58%66%60%39%1a%7a%75%6b%25%66%74%77%66%3f%2e%2e%6a%73%7b%63%62%68%63%77%29%6f%77%2e%71%33%29%62%72%73%65%63%6d%66%24%60%73%5e%2f%35%25%6d%6f%66%27%3f%1b%68%58%62%6a%64%74%64%76%6d%61%2b%76%66%66%64%5c%71%39%1a%65%68%2a%73%63%68%66%57%75%3a%78%0a%0c%25%67%66%77%34%7f%70%6f%65%71%65%39%37%27%36%6f%75%39%18%77%6b%71%71%28%5e%6e%6e%60%6d%3b%70%61%60%6e%75%3a%1d%6a%5b%79%60%66%6f%2b%6c%66%6c%75%3b%32%37%2a%67%73%38%1d%6b%59%75%6d%60%6f%28%73%69%67%3d%2e%31%6e%70%3c%73%0c%0b%2f%63%63%7d%30%78%76%67%64%77%6e%3f%2c%2c%2f%6a%7f%3c%1f%65%63%61%60%6e%75%3b%32%35%35%67%73%38%1d%60%59%64%61%62%73%6e%72%68%6b%2e%66%68%5f%63%66%30%19%70%73%6b%22%6f%77%73%6d%38%2b%28%63%70%71%65%62%6f%6a%74%2d%64%70%2b%77%3a%2a%68%74%73%62%6a%6e%62%2f%67%76%58%26%35%2f%6b%6f%61%2e%3c%1f%63%5f%67%6c%6d%77%6e%70%6d%66%22%75%62%6d%63%59%77%30%19%6f%6e%2a%74%6a%6b%62%5c%72%3f%7e%03%0f%2f%61%66%70%3f%7c%74%64%62%74%63%30%32%35%30%6f%72%30%1b%61%5c%61%6f%60%78%6a%70%6f%63%2f%68%68%6b%6e%70%3e%1b%29%29%2d%2d%2f%2a%27%3c%7a%08%08%2a%67%6f%73%34%7a%74%63%6b%77%67%3b%33%33%34%66%71%3a%1d%67%67%6e%60%67%71%38%32%37%66%71%3a%1d%61%5b%68%6c%64%73%6d%75%69%6a%2c%64%68%5e%61%6a%3d%1f%70%70%6c%23%6e%75%71%6d%39%29%24%6e%76%71%66%65%6e%6b%76%2f%64%71%29%7b%37%2c%68%77%74%63%6b%6c%60%2f%66%74%54%2b%34%2f%68%68%60%2f%3e%1d%63%5e%65%60%60%71%6e%73%6a%67%23%77%60%6d%62%5b%7b%3d%1f%6f%6d%2d%75%6b%69%60%5c%73%3d%17%6e%5e%73%65%61%69%23%75%6e%6d%39%34%3a%6b%77%3a%1e%62%6f%65%58%71%3b%6b%67%6d%77%38%78%0b%0e%29%6a%60%77%2c%2f%7d%7c%62%63%71%66%3e%37%3b%36%6d%75%38%1a%6f%66%66%66%66%74%3d%38%32%6d%75%38%1a%7b%66%77%71%2b%59%6f%6f%62%6f%3b%71%63%6c%63%73%3a%1e%64%62%78%64%62%71%66%69%65%3d%71%71%6a%3f%1b%6c%6d%6e%5c%73%3c%63%66%65%71%39%18%6e%57%77%66%64%6d%2f%7b%68%6f%3b%30%37%6b%7e%3e%78%08%09%28%6b%62%75%2c%2f%7f%70%6f%65%71%65%39%37%3c%34%6f%75%39%18%65%57%66%6a%66%71%69%7a%69%63%28%67%6d%5a%6d%64%3b%1d%72%74%63%23%67%71%72%68%3d%25%2a%68%74%73%62%6a%6e%62%72%2c%61%75%25%75%31%2e%6a%73%7b%63%62%68%63%2a%62%78%5a%2c%2c%2d%6c%67%60%26%3a%1e%66%5a%69%6e%66%73%6c%77%65%67%2a%73%63%68%66%57%75%3b%1d%71%67%67%66%5e%71%2b%71%3c%16%63%69%6e%5e%76%31%6f%62%67%72%3f%7e%03%0f%2f%61%66%70%26%35%78%76%67%64%77%6e%3f%31%34%2e%6a%7f%3c%1f%71%63%70%77%23%58%69%64%64%68%31%75%66%66%66%74%3c%16%65%64%73%62%65%7b%62%6c%6f%38%76%77%62%3e%1d%67%6b%69%56%77%39%69%63%62%77%31%19%68%5c%71%61%6e%69%2a%71%6d%68%3d%3b%69%75%3a%7a%0f%01%29%63%64%74%29%34%71%72%64%61%73%62%31%36%34%32%6e%70%3c%16%61%60%64%64%62%7b%3d%35%2d%6e%70%3c%16%67%5c%62%68%61%79%68%72%6f%62%2d%62%63%58%66%60%39%1a%7a%75%6b%25%66%74%77%66%3f%2e%2e%6a%73%7b%63%62%68%63%77%29%6f%77%2e%71%33%29%62%72%73%65%63%6d%66%24%60%73%5e%2e%37%25%6d%6f%66%27%3f%1b%68%58%62%6a%64%74%64%76%6d%61%2b%76%66%66%64%5c%71%39%1a%65%68%2a%73%63%68%66%57%75%3a%1d%65%6e%64%5a%73%3b%6a%65%61%7a%3e%78%08%09%28%6b%62%75%2c%32%7f%70%6f%65%71%65%39%30%3a%6b%77%3a%1e%62%6f%65%58%71%3b%6b%67%6d%77%38%1d%6b%59%75%6d%60%6f%28%73%69%67%3d%31%30%6e%70%3c%16%75%60%75%73%2f%56%6f%66%66%6c%3e%64%6b%6b%71%60%71%3d%17%67%66%73%63%67%77%6f%6a%6f%3b%71%76%63%3c%7a%08%08%2a%67%6f%73%2c%30%78%71%6e%67%73%65%38%34%35%26%69%75%3a%1f%66%6e%75%62%62%72%61%68%64%3f%73%71%6b%3d%17%61%6b%6e%5f%74%3d%62%64%67%71%38%1a%62%5a%71%66%67%6a%2e%7a%6a%6d%3b%31%37%67%73%38%78%0b%0e%29%6a%60%77%2c%35%2a%70%70%66%61%72%60%3d%27%31%2d%6d%77%3d%17%65%5e%62%69%63%75%65%74%6f%61%39%1a%28%2a%30%2d%37%28%2b%16%74%73%69%27%62%7b%77%6f%3b%2d%2b%6e%7f%75%65%60%6a%67%78%29%66%73%2d%74%37%25%6c%74%71%67%67%62%66%2d%64%70%5b%2b%3f%2b%6b%6d%64%23%17%69%6c%28%70%65%6b%6b%58%71%3a%1f%60%63%68%5e%71%38%6c%66%6c%75%3a%1d%6a%5b%79%60%66%6f%2b%74%68%66%3f%33%30%6f%72%30%7e%0a%0b%2c%64%62%7c%28%37%2c%78%71%6e%67%73%65%38%29%33%26%69%75%3a%1f%64%56%64%68%66%70%6b%76%64%65%3b%1d%20%2a%27%2a%31%2c%2e%18%76%78%6d%25%65%73%76%67%3d%2c%2e%6b%71%77%6e%64%68%60%70%28%6e%75%2c%71%32%2b%6e%7f%75%65%60%6a%67%25%62%71%5e%2f%28%29%60%69%66%24%1f%68%64%2e%71%60%6e%65%5a%7a%3e%1d%67%6b%69%56%77%39%69%63%62%77%31%19%68%5c%71%61%6e%69%2a%71%6d%68%3d%38%34%6d%75%38%7f%02%0d%2d%61%67%72%2a%3c%37%7a%76%66%66%7b%63%39%2c%36%28%6b%7e%3e%1d%63%5e%65%60%60%71%6e%73%6a%67%30%19%22%2d%62%2b%26%2b%2f%1d%73%76%6f%2e%61%71%71%6f%3c%24%28%6a%74%72%60%66%63%64%72%2f%66%74%24%77%33%2e%6b%71%77%6e%64%68%60%2d%63%79%58%2f%35%2c%6e%6b%6d%20%1d%6f%6c%2f%79%66%6f%60%5f%74%3c%16%63%69%6e%5e%76%31%6f%62%67%72%3f%1b%63%58%73%66%66%68%22%77%6c%6d%38%36%36%66%71%3a%78%0a%0c%25%67%66%77%2f%32%34%71%72%64%61%73%62%31%2a%37%2d%6e%70%3c%16%67%5c%62%68%61%79%68%72%6f%62%3e%1b%29%28%2d%2d%2f%2a%27%1b%72%73%6a%20%63%7a%75%6d%3b%2c%29%62%72%73%65%63%6d%66%79%2b%64%73%2c%76%3b%28%6a%74%72%60%66%63%64%2f%64%71%59%27%36%2d%6b%6e%63%22%16%6b%6e%28%71%67%67%66%5e%71%39%18%61%62%6a%5c%71%39%6e%6a%61%73%3a%1e%6d%5a%78%62%64%6f%2a%76%64%6b%39%33%33%68%73%31%7c%08%0b%2d%66%6e%71%2e%36%79%73%62%6a%75%65%3b%2e%37%3a%6b%77%3a%1e%60%66%6f%62%65%71%39%35%27%6b%77%3a%1e%62%6f%65%58%71%3b%6b%67%6d%77%38%1d%6b%59%75%6d%60%6f%28%73%69%67%3d%34%6d%76%3f%1b%7a%64%75%71%2a%5b%63%62%64%6f%38%76%62%6d%61%71%3a%7a%0f%01%29%63%64%74%29%33%71%72%64%61%73%62%31%2a%30%2d%6e%70%3c%16%63%69%6e%5e%76%31%6f%62%67%72%3f%1b%63%58%73%66%66%68%22%77%6c%6d%38%33%6b%7e%3e%1d%71%62%72%7b%2e%5e%69%67%63%69%30%77%64%66%67%76%30%7e%0a%0b%2c%64%62%7c%28%34%7a%74%63%6b%77%67%3b%2f%28%33%66%71%3a%1d%67%67%6e%60%67%71%38%37%36%3d%69%75%3a%1f%64%56%64%68%66%70%6b%76%64%65%28%64%6a%5b%6c%66%39%1d%73%76%6f%2e%61%71%71%6f%3c%24%28%6a%74%72%60%66%63%64%72%2f%66%74%24%77%33%2e%6b%71%77%6e%64%68%60%2d%63%79%58%2f%37%2c%6e%6b%6d%20%3a%1d%61%5b%68%6c%64%73%6d%75%69%6a%2c%73%60%6f%67%56%77%39%1d%6c%6b%2e%78%64%6d%60%5e%76%30%7e%0a%0b%2c%64%62%7c%37%2d%7a%74%63%6b%77%67%3b%35%30%36%66%71%3a%1d%67%67%6e%60%67%71%38%33%34%66%71%3a%1d%61%5b%68%6c%64%73%6d%75%69%6a%2c%64%68%5e%61%6a%3d%1f%70%70%6c%23%6e%75%71%6d%39%29%24%6e%76%71%66%65%6e%6b%76%2f%64%71%29%7b%37%2c%68%77%74%63%6b%6c%60%2f%66%74%54%35%33%2f%68%68%60%2f%3e%1d%63%5e%65%60%60%71%6e%73%6a%67%23%77%60%6d%62%5b%7b%3d%1f%6f%6d%2d%75%6b%69%60%5c%73%3d%72%0e%09%2f%62%61%71%38%28%7a%65%62%63%6c%63%73%3b%30%28%6b%7e%3e%1d%76%66%66%7b%63%39%2c%34%35%6b%7e%3e%1d%67%6b%69%56%77%39%69%63%62%77%31%7c%08%0b%2d%76%6a%73%73%2c%79%62%68%64%75%28%72%66%7c%6a%3d%37%6d%72%3f%1b%69%6a%69%6e%71%3c%28%45%32%2d%2e%28%2b%31%7c%08%0b%2d%76%6a%73%73%33%79%62%68%64%75%28%72%66%7c%6a%3d%2e%2d%6e%74%3c%16%66%6e%69%6c%74%31%24%41%30%2e%28%2b%26%3e%78%08%09%28%7b%66%77%71%32%7f%61%65%6b%71%28%70%63%71%66%39%35%6e%74%3c%16%66%6e%69%6c%74%31%24%31%2d%30%28%35%26%3e%78%08%09%28%7b%66%77%71%33%7f%61%65%6b%71%28%70%63%71%66%39%35%6e%74%3c%16%66%6e%69%6c%74%31%24%65%67%64%62%61%6c%3e%1d%76%66%66%7b%63%39%2c%33%35%6b%7e%3e%1d%67%6b%69%56%77%39%69%63%62%77%31%19%68%5c%71%61%6e%69%2a%71%6d%68%3d%3b%69%75%3a%1f%6f%56%75%64%64%6c%2d%6f%6b%63%71%3b%2e%2a%67%73%38%1d%72%65%73%7a%2c%5c%69%66%61%65%3d%71%64%65%60%77%31%19%61%64%71%67%68%77%66%6e%6c%3e%75%7a%6d%3a%78%0a%0c%25%77%62%75%72%35%1b%57%7e%67%6e%6d%76%22%74%66%7b%63%3e%33%66%75%3a%1d%60%69%63%68%71%3b%21%62%61%6c%63%67%67%38%7f%02%0d%2d%71%63%70%77%3c%7e%67%6e%6d%76%22%74%66%7b%63%3e%33%66%75%3a%1d%60%69%63%68%71%3b%21%42%41%4c%43%47%47%38%7f%02%0d%2d%71%63%70%77%3c%19%5c%7a%65%69%65%77%2a%72%67%7e%66%30%31%6d%71%38%1a%68%68%6b%6e%70%3e%24%4c%43%47%47%45%40%30%7e%0a%0b%2c%74%66%7e%75%36%7a%65%69%65%77%2a%72%67%7e%66%30%31%6d%71%38%1a%68%68%6b%6e%70%3e%24%26%29%2d%2d%2f%2a%30%7e%0a%0b%2c%74%66%7e%75%36%1d%5e%7d%6d%68%6d%71%2b%77%62%70%64%3b%35%6f%76%30%1b%60%6e%6a%6b%75%30%26%2d%2d%2f%2a%27%2b%38%78%0b%0e%29%7a%64%75%71%37%7d%6d%68%6d%71%2b%77%62%70%64%3b%34%6f%76%30%1b%60%6e%6a%6b%75%30%26%33%2d%31%2a%39%2b%38%78%0b%0e%29%7a%64%75%71%36%7d%6d%68%6d%71%2b%77%62%70%64%3b%35%6f%76%30%1b%60%6e%6a%6b%75%30%26%42%42%40%45%48%44%38%78%0b%0e%29%62%60%6f%6a%78%65%64%6f%6c%73%38%27%2b%26%33%37%42%40%3d%17%61%6c%6f%72%2d%74%6f%7f%60%3b%36%6a%7b%3c%7a%08%08%2a%6f%6f%6b%6a%1d%5e%7d%68%68%6b%6e%70%3e%24%26%29%37%37%40%45%30%1b%65%6e%6c%74%2e%79%60%7b%60%39%33%67%77%38%78%0b%0e%0e%00%3d%2e%72%73%73%63%66%3d14793737%34%39%35%31%33%30%36')));
اینجاش رو بازم نفهمیدمنقل قول:
بعد کدهای encrypt شده رو بصورت escape شده و حذف مقادیر غیر نیاز کدها رو نمایش دادم.
والا من که زیاد کارن کردم با این چیزا ندانم چی به چیه
حوصاله داشتی یه نمه اینجاش رو منور تر کن
به سعی و خطا دقت کردی؟:دینقل قول:
اینا رو ببین به ترتیب:
بدون در نظر گرفتن مساوی ها.کد:%27, %29, %3b == ' ) ;
مشکل syntax وجود داره که با اون نکته ی مهمی که گفتم ( سعی و خطا ) باید اونها رو برطرف کنی.
یکبار کارکن، دفعه دوم هر کدی که با این متد ecnrypt شده باشه رو میتونی decrypt کنی.
دیگه نمی دونم چطور راهنمایی کنم، اگر حسش می بود حتما یه چیزی می نوشتم که مارو دعا کنی ولی...:دی
دستت درد نکنه برادر امین در همین حد هم راهنمایی کردی خیلی خوبه
خدا رو شکر خدا به ما این توانایی رو داده که خودمون بتونیم کد بنویسیم محتاج این جور سایت ها و ... نباشیم:31:
من بابه کنجکاوی فقط این تاپیک رو زدم
در هر صورت نیازی به دیکودش هم نیست زیاد میشه با css »ضاعف اینا رو override کرد شل و پلشون کرد در مواقعه لزوم:31:
سلام میشه یه نفر بطور واضحه درمورد این مسئله بگه باید چیکار کرد
---------- Post added at 05:58 PM ---------- Previous post was at 05:54 PM ----------
مثلا میشه این js رو واسم با گفتن قدم به قدم مرحله دیکدش کنین
[ برای مشاهده لینک ، با نام کاربری خود وارد شوید یا ثبت نام کنید ]
سلام میشه یه نفر بطور واضحه درمورد این مسئله بگه باید چیکار کرد