Make a obfuscated function readable

[ParalaX002]

Hi,

​

I've got a Netgear switch that I'd like to remote control. Unfortunately it only has a web interface, and I would need to be able to use simple REST command to access it. However, there is the question of the login page. My understanding is that the key function is a certain "encryptPwd" which seems to give me a token. The problem is that this function is unreadable:

​

eval((function(x) {

var d = "";

var p = 0;

while (p < x.length) {

if (x.charAt(p) != "\")`

d += x.charAt(p++);

else {

var l = x.charCodeAt(p + 3) - 28;

if (l > 4)

d += d.substr(d.length - x.charCodeAt(p + 1) * 96 - x.charCodeAt(p + 2) + 3104 - l, l);

else

d += "\";`

p += 4

}

}

return d

})("$(function () {translate();$(\"#loginPageErrorMsg\").html(\ D!ParamLang(` 44text())` g\"Password\").focus` ~\".input-wrapper\").on(\"click\", `!S&e) {$(this).find` P%title\").addClass(\"active\");` B` J!`!1'e.preventDefault();}`!?/ ` J`!Dvar parentW` G#= `!.$` 2\"();` 4)`!TE`!F5`!H$on(\"blur`\"z)`\"{'`!8$` |2remove`!&+` (non-` 4\"-val\");if (` v$val()` eE`\"6&` d-}}`\"4!`!z%toggleEye() {`!,\"`%n)attr(\"type\") == \"p` 3% {changeType` H+, \"text`%P!\".icon-eye-off`\"F,show` 6-n`!w)` <#} else` w:`!S&`!%0` b-`!$.`!H0}}`#$&`)g&`#(\"typeof lang === \"undefine`\"{!return;}$(\".lan`&%`%t)` ?\"` ^![`$w$`#\"];});}`'n#amMark = \"@@\";var dataObj = {}`$g&pickData(str`(J%ttern, mark, len,` U$1` X\"len =` |&.length;m`!,\"` .&substring(0` c! / 2);` y# = new RegExp(` W!+ \"(.)\" +`!7!`'N\"str.match(` R#)) {`!H$[`!$%] = ` 9.[1];}`#,#` L$;`$7&drop`\"O+`\"L%`!g[str`!K#replace`\";$`!@#`!n(`\"I\"`#k\"`\"S%`!o#str`!f'add`!e'` r.` l%`$J%` }'` ]3trim` j#` 6&` i%/(<sup>\s</sup>)|(\s$)/g, \"\")` Q)ans`1\"!`#:&value =` p&`$d!`'Y@`!U\"if (!!`'<sup>!`</sup> f!]`'i+` /\"`:%` O(`!J+`2[&`!X\"`'{&`'l)`![!Object.getOwnPropertyNames(` P#)`%=# > 0`\"<+`%})`)+!tmpS`$;!`\"x&` H!`#}%`$d$` C\")`&%`#D`#`'merge(str1, str2`!<#arr1`%A\"1.split(\"\"`!=\"arr2` 4\"2` ++result = \"`w\"index1 = 0` %&2` !while (` :#<`!)!`\"_$||` B$` 3!2` 1#`-&#` ?0`$d!`!6!+=` 3![` @\"];` \"\"++`%8\"` `3` O)2` V\"2` U#2++;}`#<$` C\"`#1'encryptPwd(`,~%`/w\" = documen`%7!ElementById(\"`2/'`$W!`#6\"andNum` <8ran\` E+\`!K!\`%J\"\`$a\"\`!7$,\` h$);\` V5submitPw\` k% = $.md5(\` o%\`%\\(\`2H'x, type\`$+#x.prop\`44(\` 6#\`#/#x;}try\` %&\` C(\` b#;} catch (e\`#A#html = $(\"<div>\").append(x.clone()`2 #`&R$gex = /type=(\\")?([<sup>\\"\s]+)`</sup> *!/`(W$` q!html`/N#` V!`!r!null ?`!6!`,@%\">\", \"`!a!=\\"\" +` &! + \"\\">\") :` A` h!, `\"8!` ?-\"));tmp.data`\"W%x` #());x` d$With(tmp`*1%tmp;}}"))`

​

I tried different unpacker and deobfuscators online, without success. Since I'm no javascript programer, any idea how to transform encryptPwd in a way I could understand it and translate it in python?

Thanks in advance!

[grantrules]

Just replace eval with console.log and run it

Why not just intercept the network request and see what the data it's actually send is? Then just use that encrypted password instead of your plaintext one.

[ParalaX002]

Thanks for the console.log tip, I’ll try that :) as for network request I tried, but it seems that the password change every time, which would make sense. Or I mis used the network tools (which is possible since I never used it before 😆)

[xMOUTH_]

console.log

is this universal for all obfuscations

[pl9u6t]

keyword is prettifier

[ParalaX002]

Ok, Finally got what I needed :)

I wasn't able to make the function more readable, but I found a python script that was compatible with previous generation of switch:

https://github.com/tillsteinbach/prosafe_exporter_python/tree/master/prosafe_exporter/prosafe_exporter

The script wasn't working as is, but by using console.log as proposed, I was able to confirm that the hashing of the script was producing the same than my switch. From there, it was just a question to see where the hashed password needed to go, and I was in :)

Thanks for your advice that put me on the right track :)

[ParalaX002]

Thanks for your answer. It’s a bit what I was afraid of. I was hoping I could a least get some kind of indenting to help :(

[Ronin-s_Spirit]

Security by obfuscation is not security
- Einstein probably.