Question

I came across the following exploit due to a warning from my AV software. It originated from an adserver delivering banner ads on one of my sites.

I have retrieved the content with Wget and copied to pastebin.

http://pastebin.com/m6fa38fac
[Warning: Link may contain malware – Do not visit from vulnerable PC.]

Please note that you have to scroll horizontally on pastebin as the code is all on one line.

Can anyone find out what the exploit actually does?

Thank you.

Answer 1

Not quite, as it includes (the equivalent of):

var mtime= new Date(document.lastModified).toUTCString().split(' ')[4].split(':');

it then uses the minutes and seconds of the last-modified time of the document containing it as a key to decode the array. If you can’t still retrieve that javascript:alert(document.lastModified) time we’d have to brute-force it.

ETA: ah, actually it only uses the first digit of the minutes, and from the way it uses it we can guess it’s supposed to be 1. That’s leaves only sixty possibilities, and a quick loop reveals that meaningful javascript only comes out for 16 seconds.

I’ve put the decoded script here; it will probably also ping your anti-virus. Summary: it runs exploits against the Java, Flash and Acrobat plugins, running a payload from googleservice.net which is (surprise surprise) a Russian attack site.