Thomas Stig Jacobsen's constant why

VirusTotal API PHP class

Thomas Stig Jacobsen — Fri, 23 Sep 2011 07:52:53 +0000

So I’m about to do a project with VirusTotal integration, therefore I went to the VirusTotal site to get API access. I create a user and after some HTTP 500’s from VirusTotal I get my API key. Great, I thought. I saw there was some guy who had already made an PHP class for the API so I was excited, less work for me.

I click the link to the download and… 404’ed! DAMMIT! I start powering up my Google-foo and finally on some chinese site I get the class (which wasn’t a class). Unfortunately the exsisting thingy wasn’t that, goood. No offence to the guy who made it. I think the code is a bit old and that is properly the reason for the lack of classes.

Therefore I decided to do a new class which you can get here: https://github.com/eXeDK/VirusTotal-API-PHP-class.

Please tweet me about any bugs etc. @eXeDK

Freshplum job application puzzel thingy

Thomas Stig Jacobsen — Wed, 03 Aug 2011 21:46:23 +0000

This was a puzzel made by the guys at Freshplum who is hiring at the moment. Hold your horse, you need to have a Ph.D. For all of us mortals with no Ph.D. (yet, hopefully) there are no more to do than solving the puzzel they made in order for people to send in their applications.

In the bottom of the hiring page https://freshplum.com/jobs/ there is the text:

Send to: x@freshplum.com where x = the number that appears most frequently below.

And below that there’s a lot of random numbers flashing by. The code generating them is here:

var x;
function go(){
    x = Math.floor(Math.random() * 11) + Math.floor(Math.random() * 11);
    $("#number").html(''+ x +'
');
    setTimeout('go()', 100);
}
$(document).ready(function(){
    go();
})

As you see in line 3, two random numbers between 0 and 10 are added together and put into #number. So the resulting number is between 0 and 20. Calculating the most common one can be done like this:

$xArray = $yArray = array(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
$resultArray = array();
foreach($xArray as $x) {
    foreach($yArray as $y) {
        $result = $x + $y;
        $resultArray[$result] = $resultArray[$result] + 1;
    }
}
foreach ($resultArray as $key => $val) {
    if ($val == max($resultArray))
        echo $key;
}

The result of the script you can see here: http://codepad.org/YA5fX8aC

The most common number is 10, quite obvious really but there you have it.

jjencode decoder (jjdecode)

Thomas Stig Jacobsen — Thu, 28 Jul 2011 12:12:44 +0000

So I’ve had a look at jjencode some time ago and today I decided to do a decoder for the bloody thing. Instead of creating an entire parser for JS I decided to trust the code a bit by evaling the code prior to the encoded part and thereby letting the browsers JS engine build up the scope for me to use afterwards.

If you have no clue what jjencode is then you can read this: http://pferrie2.tripod.com/papers/jjencode.pdf and this: http://utf-8.jp/public/20090710/jjencode.pps. And you can try it here: http://utf-8.jp/public/jjencode.html. Basicly it encoded your code into symbols only. alert(0) would be be encoded into this (with parameter g set to “_”):

_=~[];
_={___:++_,$$$$:(![]+"")[_],__$:++_,$_$_:(![]+"")[_],_$_:++_,$_$$:({}+"")[_],$$_$:(_[_]+"")[_],_$$:++_,$$$_:(!""+"")[_],$__:++_,$_$:++_,$$__:({}+"")[_],$$_:++_,$$$:++_,$___:++_,$__$:++_};
_.$_=(_.$_=_+"")[_.$_$]+(_._$=_.$_[_.__$])+(_.$$=(_.$+"")[_.__$])+((!_)+"")[_._$$]+(_.__=_.$_[_.$$_])+(_.$=(!""+"")[_.__$])+(_._=(!""+"")[_._$_])+_.$_[_.$_$]+_.__+_._$+_.$;
_.$$=_.$+(!""+"")[_._$$]+_.__+_._+_.$+_.$$;
_.$=(_.___)[_.$_][_.$_];
_.$(_.$(_.$$+"\""+_.$_$_+(![]+"")[_._$_]+_.$$$_+"\\"+_.__$+_.$$_+_._$_+_.__+"("+_.___+")"+"\"")())();

I’m aware that could lead to some code execution in the decoding part but if that code is incoded it needs the full scope inorder to eval it. All non-encoded code I would be able to filter of by myself. A code which could trigger a code execution at accident at this time would be:

_=~[];
alert(0);
_={___:++_,$$$$:(![]+"")[_],__$:++_,$_$_:(![]+"")[_],_$_:++_,$_$$:({}+"")[_],$$_$:(_[_]+"")[_],_$$:++_,$$$_:(!""+"")[_],$__:++_,$_$:++_,$$__:({}+"")[_],$$_:++_,$$$:++_,$___:++_,$__$:++_};
_.$_=(_.$_=_+"")[_.$_$]+(_._$=_.$_[_.__$])+(_.$$=(_.$+"")[_.__$])+((!_)+"")[_._$$]+(_.__=_.$_[_.$$_])+(_.$=(!""+"")[_.__$])+(_._=(!""+"")[_._$_])+_.$_[_.$_$]+_.__+_._$+_.$;
_.$$=_.$+(!""+"")[_._$$]+_.__+_._+_.$+_.$$;
_.$=(_.___)[_.$_][_.$_];
_.$(_.$(_.$$+"\""+_.$_$_+(![]+"")[_._$_]+_.$$$_+"\\"+_.__$+_.$$_+_._$_+_.__+"("+_.___+")"+"\"")())();

The alert(0) in the second line would be fired off, but then again. It’s quite easy to spot in this example. If I get some more time, I’ll go the long was in decoding this the proper way.

In the decoder I start by finding the variable name of the main object (in the encoder that’s the paramter g) hereafter I start splitting the encoded code up at all semi-colons (;) with a RegEx. Here’s the two RegExs, first the one for parameter g and then the one for splitting up the lines (text is my input of encoded code).

 1: var g = text.match(/([^=])=~\[\];/)[1];
 2: var lines = text.match(/([^;]*);/g);

With g and the lines in hand I do a loop on the lines checking for the execution part of jjencode. If it’s not found I’ll eval the line, otherwise I’ll set the variable lookAhead to true and thereby concatinating the rest of the encoded lines before pulling out the encoded code out of the execution part and running eval on the thing for it to return it’s content. More explaning comes later on. Here’s the if from the loop, I’ll just run it through.

if ( ! lines[i].match(/_.\$\(_.\$\(/) && ! lookAhead) {
    eval(lines[i]);
} else {
    lookAhead = true;
    finalLine = finalLine + lines[i];

    if (i == lines.length - 1) {
        // _.\$\((.*)(\)\(\))
        var re = new RegExp(g + '.\\$\\((.*)(\\)\\(\\))');
        var reString = finalLine.match(re);
        output = eval(reString[1]);
    }
}

Line 1 if of course the check whether the execution part of jjencode is to be found in the line. If not I’ll eval the code at line 2. Inside the else I’ll start the lookAhead since the execution part was found, I’ll concat the line to the finalLine variable. When there is no more lines to concat it will trigger the if sentence at line 7. The RegEx at line 9 vill take the return code inside the execution part and take it out to eval it and return lastly.

You can try the thing here: http://e-x-e.dk/labs/jjdecode/index.php, go have some fun and let me know if you do something smiliar. Remeber to have your console open when fooling around with this. The decoder function can be found here: http://e-x-e.dk/labs/jjdecode/assets/decoder.js and the encoder here: http://e-x-e.dk/labs/jjdecode/assets/encoder.js (the encoder is from http://utf-8.jp/public/jjencode.html).

Looking into Hypem… and some exploits

Thomas Stig Jacobsen — Tue, 26 Jul 2011 00:03:00 +0000

Please note that this is not in any way an attack on Hypem. All work done here is done with great love to Hypem. Hypem have been notified about the exploits before this release in order to patch these. This is more of an exercise for myself.

So the last couple of days I’ve been fooling around with Hypem, both looking into finding their mp3 files and some of the mechanics in that. Moreover I did a quick look for some simple exploits as well. I’ll present my findings starting with the mechanics of finding their mp3 files and hereafter I’ll get to some exploits and some cookie stealing/session hijacking when going over some of their javascript.

If you don’t know what Hypem are then you have been living under a rock. But, this is how they describe themself: “The Hype Machine keeps track of what music bloggers write about. We handpick a set of kickass music blogs and then present what they discuss for easy analysis, consumption and discovery. This way, your odds of stumbling into awesome music or awesome blogs are high.” - http://hypem.com/about. Their rank on Alexa can be found here: http://www.alexa.com/siteinfo/hypem.com

Finding Hypem mp3 files

So I first wanted to be able to download the awesome music from Hypem which is why I downloaded some plugin for FF in order to do so. But the plugin was bad, I had to go through every song and press download or use another plugin which messed up the naming of the files. Therefore I broke down the plugin in order to find out how they got the files in the first place.

Basicly the url of the mp3 files can be found in two ways (found the second one later on):

http://hypem.com/serve/play/[id]/[key]

http://hypem.com/serve/source/[id]/[key]

The /serve/play one will do a redirect to the mp3 file which then can be downloaded. The /serve/source one on the other hand will give you a bit of JSON data with the id of the track, the url to the mp3 and a bool final which allways seems to be true (what I’ve seen so far). The JSON for one of the tracks is shown below (You don’t need to try to download the file, the link is broken on purpose)

{
   itemid: "gmef"
   url: "http://t01a.hypem.com/sec/5e3cf3001fck75d3bb1de182b959a89b/51ed41f1/archive/614/10/1eaca15ec90abcde181efk144d146d8b.mp3"
   final: true
}

Getting this far is quite easy when being in a browser (which is maybe why there are no standalone programs that I could find) which takes care of cookies etc etc. But when I was doing my own program in C# as a program on the side I ran into a couple of problems.

I started by getting the Hypem pages after remembering to add a User-Agent in the headers of the HTTP request. Otherwise I wouldn’t get any real content. Getting the ids and keys for the URLs was next on the agenda, luckily Hypem got all of that in their source in a format like this:

trackList[document.location.href].push({
   type:'normal',
   id:'ad5sf',
   postid:'1539980',
   posturl:'http://www.themusicninja.com/folk-st-vincent-surgeon/',
   time:'265',
   ts: '1311368622',
   fav:'0',
   key: '63f38d627b20d16aad38c67cbe1ed2b6',
   imeem_id:'',
   artist:'St. Vincent',
   song:'Surgeon',
   amazon:'',
   itunes:'',
   emusic:'',
   exact_track_avail:'0'
});

So I created a function which took the input in form of a Hypem HTML source and returned a list of Track objects which all had been extracted from the source. The extraction was quite simple; select all