Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>It's a javascript snippet trying to exploit a security vulnerability related to Facebook, more specifically to its image uploader client side ActiveX control.</p> <p>The <code>cobj</code> part tries to create an object of ClassID <code>{5C6698D9-7BE4-4122-8EC5-291D84DBD4A0}</code> which happens to be an ActiveX photo uploader control. The ExtractIptc and ExtractExif functions belong to that specific ActiveX control.</p> <p>The core of the code is really memory address manipulation, shifting, using masks to separate high and low bits. For example, <code>hex((addr&gt;&gt;16)&amp;0xFFFF,4))</code> takes an address, shifts it 16 bits to the right, clears up the lower part and converts it to a hex number. To actually understand most of this code, you should have the right debugging tools. </p> <p>Googling the <code>{5C6698D9-7BE4-4122-8EC5-291D84DBD4A0}</code> ClassID gave some interesting results you should look into:</p> <p><a href="http://www.kb.cert.org/vuls/id/776931" rel="nofollow noreferrer">http://www.kb.cert.org/vuls/id/776931</a></p> <p><a href="http://seclists.org/fulldisclosure/2008/Feb/0023.html" rel="nofollow noreferrer">http://seclists.org/fulldisclosure/2008/Feb/0023.html</a></p> <p><a href="http://securitytracker.com/alerts/2008/Feb/1019297.html" rel="nofollow noreferrer">http://securitytracker.com/alerts/2008/Feb/1019297.html</a></p> <p>Please note, this is not PHP. It's javascript.</p> <p><strong>More details...</strong></p> <p>cobj is probably translated into a CreateObject() call. Every registered ActiveX control has its own Class ID, and they have the form <code>{0000000000-0000-0000-0000-000000000000}</code>. When you want to refer to the registered library, and create an instance of it, you can use either its name or its Class ID. </p> <p>The ActiveX control itself should be an .OCX or .DLL file on your computer. If you can find this file and debug it, you'll get most specific details about the ExtractIptc and ExtractExif functions. Again, those two functions seem to have vulnerabilities when called in a specific way, and this is what that script is trying to exploit.</p> <p>The <code>var hsta=0x0c0c0c0c</code> part defines a variable hsta, equal to the hexadecimal number 0c0c0c0c. It's the same as writing <code>var hsta = 202116108</code>. In computer engineering, it's easier to deal with hexadecimal addresses than decimal numbers since addresses and data inside the computer's memory is binary and can be directly represented as a hex number. More details about hexadecimal there: <a href="http://en.wikipedia.org/wiki/Hexadecimal" rel="nofollow noreferrer">http://en.wikipedia.org/wiki/Hexadecimal</a>. </p> <p>The variable name hsta seems to be in hungarian notation (first letter represents the variable type - h for hex). I would therefore assume it means <em>hexadecimal start address</em> (hsta). Following the same train of thought, my guess would be that <code>pl</code> means payload and <code>plc</code> means payload code. </p> <p>The payload code is the code the computer will execute if the exploit was successful, and it's what you see at the beginning of the script <code>(\x43\x43\x43\x43\n....\xEF)</code>. It's encoded as <a href="https://stackoverflow.com/questions/1469559/help-me-understand-this-c-code-void-scode">shell code</a> for a particular CPU architecture and operating system. That means code that's already compiled, standalone, and can be piped to the CPU directly. If you decode this, you'll probably find something close to machine code. It's probably nothing positive.</p> <p>The <code>hex(num,width)</code> function converts a decimal number to its hexadecimal form. I've tested the function separately, and it returned 3E8 when feeding it 1000. The width variable is simply used to exit the script if the resulting hexadecimal number is bigger than specified.</p> <p>About this part:</p> <pre><code>var buf = addr(0x0c0c0c0c); buf = buf.substring(0,400); obj.ExtractIptc = buf; obj.ExtractExif = buf; </code></pre> <p>The buf variable is a buffer. A buffer is nothing more than data in memory. It can be interfaced as a string, as shown in this code. My guess is that a buffer of 400 bytes is created from whatever contents is in memory at 0x0c0c0c0c, and then fed into two functions.</p> <p>There are several function definitions missing in here. Namely, the hav() function.</p>
    singulars
    1. This table or related slice is empty.
    1. POI don't understand this Code
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USCommunity
    1. USWadih M.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POI don't understand this Code
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COI think a relevant question for our OP is 'where did you get this code?' =X
      singulars
      1. PO
      1. USErik Forbes
    2. COright... well you can see his username isn't innocent either.
      singulars
      1. PO
      1. USWadih M.
    3. COHeh... Good point...
      singulars
      1. PO
      1. USErik Forbes
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload