HBH Javascript 3: HTML Entity Encoded

Hellbound Hackers’ Javascript challenge 3 looks a lot trickier than it actually is. First, you must find the relevant section of the source code. The following is enclosed in SCRIPT tags:

var U₇=window,W₈=document;var a1=”<script language="JavaScript1.1"> <!-- function right(e) { if (navigator.appName == 'Netscape' && (e.which == 3 || e.which == 2)) return false; else if (navigator.appName == 'Microsoft Internet Explorer' && (event.button == 2 || event.button == 3)) { alert("Rigth-mouse click isn't allowed!"); return false; } return true; } document.onmousedown=right; if (document.layers) window.captureEvents(Event.MOUSEDOWN); window.onmousedown=right; //--> </script></p> <p><script language="javascript"> <!-- function pasuser(form) { var text2='lolage' var text4='hahaomgz' if (form.text1.value==text2) { if (form.text3.value==text4) { location="index.php?text1=lol&text3=haha" } else { alert("Invalid Password") } } else { alert("Invalid UserID") } } //--> </script><br /> <center></p> <table cellpadding="4" border="0"> <tr> <td align="center" height="24" width="84">User ID:</td> <td align="center" height="24" width="170"> <form name="login"> <input name="text1" type="text"></td> </tr> <tr> <td align="center" height="24" width="84">Password:</td> <td align="center" height="24" width="170"> <input name="text3" type="password"></td> </tr> <tr> <td align="center" height="1" width="84"> <input type="button" value="Login" onClick="pasuser(this.form)"></td> <td></td> </tr> </table> <p></center>“;function V₀(){var V₀;V₀=unescape(a1);W₈.write(V₀);}V₀();

Fix the indentation and linebreaks of the above code, and it’s much easier to read. The content of a1 is substitute with “string” in order to keep the code readable.

var U7 = window, W8 = document;
var a1 = "string";
V0() {
  var V0;
  V0 = unescape(a1);
  W8.write(V0);
}
V0();

This code first defines W8 as the current document, and then a1 as a long, illegible string. The function V0() creates a variable with the same name and is assigned the unescaped value of a1, after which it is printed to the W8 (the window). V0() is then run.

In order to see what is printed, we must decode a1. This can be done in several ways, such as with the PHP function urldecode(). I used an online URL decoder.

The string decodes to an HTML form and two Javascripts, one that negates right-clicking and one that checks the username and password. You should be able to find and extract the password and username without any problems:

function pasuser(form) {
var text2='lolage'
var text4='hahaomgz'
  if (form.text1.value==text2) { 
    if (form.text3.value==text4) {              
      location="index.php?text1=lol&text3=haha" 
    }
    else {
      alert("Invalid Password")
    }
  }
  else {
    alert("Invalid UserID")
  }
}

My username/password combination was lolage/hahaomgz.adverse personal loan unsecured 10k12 new loan 17 paydaypayday 12 loan com 18 quick123 loans125 loan bad home13000 loanno credit 1500 loan check1st loan home horizon Map

Maybe Related?

• HackQuest: JavaScript: Sir, could you pop me?
• Javascript: POST Variables to Forms
• HackQuest: JavaScript: Now, what is that really?
• HackQuest: JavaScript: Jedi Mindtricks
• HackQuest: JavaScript: I am a JavaScript. Abuse me.