Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
executable file 108 lines (93 sloc) 4.42 KB
#!/usr/bin/python
'''
Jsunpackn - A generic JavaScript Unpacker Network Edition
Copyright (C) 2010 Blake Hartstein
http://jsunpack.jeek.org/
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
'''
from hashlib import sha1
import datetime
import socket
import jsunpackn
# Error Reporting to /tmp
socket.setdefaulttimeout(10)
class cmdline_filler:
options = {
'timeout':30,
'redoevaltime':1,
'maxruntime':0,
'urlfetch':'',
'configfile':'options.config',
'saveallfiles':True, # for pcaps?
'saveallexes':False,
'quiet':True,
'verbose':True,
'veryverbose':True,
'graphfile':'',
'debug':False,
'active':True,
'interface':'',
'nojs':False,
'log_ips':'./maliciousips.txt',
'pre':'./pre.js',
'post':'./post.js',
'htmlparse':'./htmlparse.config',
'fasteval':False,
'proxy': '',
'currentproxy': '',
}
def __init__(self, inhash):
self.tmpdir = '/tmp' # these temporary files are necessary for decoding, but you can use any path and they will be deleted afterwards
self.logdir = self.outdir = '' # an empty storage filepath means no directory of output files will be created
self.decoded = '' #NO decoding logfile, otherwise = self.outdir + '/decoded.log'
for item in self.options:
setattr(self, item, self.options[item])
#Feel free to hard code all your files "rules", "rules.ascii", and "htmlparse.config" in this file instead, only problem is updating them
fin = open('rules', 'r')
if fin:
self.rules = fin.read()
fin.close()
fin = open('rules.ascii', 'r')
if fin:
self.rulesAscii = fin.read()
fin.close()
if self.options['htmlparse']:
fin = open(self.options['htmlparse'], 'r')
self.htmlparseconfig = fin.read()
fin.close()
def main(userdata):
'''userdata contains the javascript, html, or pdf data to decode'''
'''if you'd like to do other things with the results, then modify this function'''
HASH = sha1(str(datetime.datetime.now()) + userdata).hexdigest()
options = cmdline_filler(HASH)
root_of_tree = '' # This can be empty but its sometimes useful to specify a filename here
url_or_name = '/' # This can also be empty but if you have the URL, you'd want to set that here
prevRooturl = {} # This can also be empty but if you want to decode something with more context its useful to keep state
js = jsunpackn.jsunpack(root_of_tree, [url_or_name, userdata, root_of_tree], options, prevRooturl)
for url in js.rooturl: # set all the state variables for printing
js.rooturl[url].seen = {}
results = ''
for url in [js.start]: #recursive
print 'The key %s has the following output in recursive mode' % (url)
results = js.rooturl[url].tostring('', True)[0] + '\n'
print results
print 'Note that none of the files are actually created since self.outdir is empty.'
print 'Instead, you could go through each url and look at the decodings that it creates'
for url in js.rooturl:
print 'Looking at key %s, has %d files and %d messages, that follow:' % (url, len(js.rooturl[url].files), len(js.rooturl[url].msg))
for type, hash, data in js.rooturl[url].files:
print 'file type=%s, hash=%s, data=%d bytes' % (type, hash, len(data))
for printable, impact, msg in js.rooturl[url].msg:
print 'output message printable=%d, impact=%d, msg=%s' % (printable, impact, msg)
if __name__ == "__main__":
main('eval("var a=123;");')