Re: [Full-Disclosure] Phishing scam - Obfuscated url help please

From: Nick FitzGerald (nick_at_virus-l.demon.co.uk)
Date: 01/24/04

  • Next message: Matt Burnett: "Re: [Full-Disclosure] DOS all platforms" 
    To: full-disclosure@lists.netsys.com
Date: Sat, 24 Jan 2004 12:29:52 +1300

    Gadi Evron <ge@linuxbox.org> replied to Matthias Benkmann <msbREMOVE-
    THIS@winterdrache.de>:

    > > An easy way to de-obfuscate this is to give your browser this URL. Works
    > > at least with Mozilla, but I think other browsers support the javascript:
    > > pseudo-protocol, too.
    > >
    > > javascript:alert(decodeURI('<obfuscated-URL-here>'))
    >
    > We have seen this done and exploited *mostly* on IRC spam (directed at
    > the mIRC client).
    >
    > Let's decode a URL that may end up making IE destroying the PC or
    > emailing our passwords.. or downloading a dropper or,,, :o)

    You beat me to it...

    Indeed, very good advice which applies equally to the other suggestion
    of pasting it into Google (hopefully Google does all the necessary
    escaping, but at the rate XSS bugs are still being found all round the
    place do you really want to take that gamble?). Always assume the
    worst which in a case like this may be that the URL was obfuscated not
    just to trick some clueless newbie or "typical user" but to outwit
    "power users" or even half-clued admins.

    The first rule with _all_ suspect software, be it an unknown
    executable, an HTML-embedded script or a possible one-liner (such as
    this) is _NEVER_ "run" it on anything but an isolated "goat" ("mule",
    "donkey", "test net", etc) machine, (at least not unless you have done
    a thorough static analysis of it and are sure it is "safe" to do
    otherwise).

    FWIW, what I did with the posted URL was paste it into a simple
    standalone .JS I use for such things (it decodes the new string into a
    string variable and writes that to a file). After doing a careful
    eyeballing of the pasted string and any necessary manual tidying (in
    this case, removing the "=" chars) I then ran the .JS then viewed the
    output file with a "safe" file viewer. 

    -- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Matt Burnett: "Re: [Full-Disclosure] DOS all platforms"

    Relevant Pages

    • Re: TLV Objekte aus Datei lesen
      ... Weil STRING als OCTET STRING und IA5STRING vorkommen, das aber piepegal ist, schere ich die alle über einen Kamm und komme mit meinem STRING aus. ... Es gibt hier keinen Len-Parameter beim Decode. ... In meinen Daten haben die meisten der Arrays eine ein- oder zweibyteige Angabe der Anzahl der Records am Anfang. ... technischen Daten der Karte sofern sie in der Datei stehn). ...
      (de.comp.lang.delphi.misc)
    • Re: Sending floats over a client-server in Smalltalk
      ... The trick is knowing what to decode them ... Then encode the number in the remaining bytes. ... ByteString>>floatAt: byteIndex ... I could then take a string ...
      (comp.lang.smalltalk)
    • Re: Selecting a record froma table where a column might be null
      ... In perl dbi, ... So you use the decode function in your ... string null in decode you can ... Win a $20,000 Career Makeover at Yahoo! ...
      (perl.dbi.users)
    • Re: Ascii Encoding Error with UTF-8 encoder
      ... trying to write out using a UTF-8 encoder? ... Your fundamental problem is that you are trying to decode an 8-bit string ... You decode whatever from an 8-bit string into Unicode. ...
      (comp.lang.python)