Guess who is back online: jsunpack3000

After a long hiatus jsunpack.jeek.org is back online. I tried hosting from my apartment for as long as possible but it wasn't working out because my uplink became saturated and I had to put rate restrictions on the server. I was also being regularly kicked offline because either I was performing dns lookups for known malware domains or internet watchdogs would report URIs cached in jsunpack as abuse to the ISP. This is the same code that has been running for a long time and I want to work on a new version that has great new features. I will begin reaching out to some people for help this time to build Jsunpack3000.

I would like to thank everyone who supports my efforts especially Steven Burn. Thank you!

jsunpack online

jsunpack is now online in a temporary capacity. the disk performance is worse than previous places jsunpack has been hosted so please let me know if its bearable. picture of the hosting environment below:

Jsunpack offline (for now)

jsunpack.jeek.org is offline today for expected downtime.
I hope to bring the server online soon, but I unfortunately don't know how soon.

More details if you email me at urule99 {on the} gmail 

Blake

Jsunpack server migration in progress

Hey everybody, I'm upgrading the jsunpack server again. I'm hoping there will be no downtime during this period. Thanks.

[Edit] All done! I love it when everything goes smoothly.

Update to Jsunpack PDF parsing

Hey guys, I just added a patch from David Dorsey of Visiblerisk, Inc. (Thanks David, you are a boss!).

Below is a sample PDF you can test with just to see how awesome it is:
http://jsunpack.jeek.org/?report=2afae1f7a9b2552f2e38713e47c3371cc8a2d23c

David described a lot of the improvements and the analysis he performed at the following blog posts entitled "Analyzing Malicious PDFs or: How I Learned to Stop Worrying and Love Adobe Reader"
Part 1: http://visiblerisk.com/blog/2013/4/8/analyzing-malicious-pdfs-or-how-i-learned-to-stop-worrying-a.html
Part 2: http://visiblerisk.com/blog/2013/4/15/analyzing-malicious-pdfs-or-how-i-learned-to-stop-worrying-a.html

In brief, this update improves pdf.py's XFA parsing, PDF encryption tags, and generally the update will help you to decode some malicious PDFs where jsunpackn.py had trouble decoding them before.

Thanks to David and please if you see any bugs related to this update please report them at https://code.google.com/p/jsunpack-n/issues/list and I'll fix them.

Blake

New jsunpack server!

I brought a new server online for jsunpack.jeek.org over the weekend and everything should be operating normally now. I expect this server to last about 6 months based on the volume of past submissions. I hope you enjoy it!

Blake

The jsunpack website is accepting submissions again

I removed the ability for people to submit URLs and files to http://jsunpack.jeek.org/, partially due to abusive submissions in late May. I brought the submissions interface back online today with some changes to help prevent further abuse. Please let me know if you encounter any sort of problems.

Temporary downtime for jsunpack website

The website for this project jsunpack.jeek.org has been down for the past 2 days because I was moving it to new hardware. The old hardware was running ESXi and caused all virtual machines to lock up repeatedly. While I was moving it the site was completely offline but I'm happy to say its back now!

Keep in mind, if you had been running jsunpack-n locally then you wouldn't have experienced any problems (thats software is freely available and that is what the server is running).

[off topic] I've seen a few people do a great job in downtime situations, none of which I did because this whole project is running from a single virtual machine with limited resources. For instance, when Netflix was recently down they acknowledged the problem and credited subscriber's accounts. When another site was down, they played a funny "Doh!" error message video from the Simpsons. In yet another case, DreamHost apologized and wrote a funny blog about it (note: I do not use or endorse DreamHost but I do read their blog). Some quotes from that post:

"I’d like compensation. You’ve earned it! You pay for 365 days of service – not 364.375"

"Why didn’t you call me? We would have loved to reach out to every customer individually, but with over one million domains hosted, that could – quite literally – have taken all year. We’d have loved to email you too, but well, we had this little network problem blocking emails."

Jsunpack Website Database Optimizations

I just published some new optimizations for the jsunpack.jeek.org database. This should dramatically improve the performance of the website.

Contact me if you need anything related to this update. I removed the search functionality (and associated RSS feeds) because that was one of the most performance intensive features on the database. While this type of function is still possible, I think I'll either have to limit terms that may be searched for or build a separate index structure so that it is better optimized.

[edit] In case you are curious, the jsunpack database has 186,459 submissions and 686,232 evalated scripts and URLs since 2010-01-29 14:17:36. This year was pretty active for web exploits. The majority of the submissions to jsunpack were publicly released in one of the RSS feeds with 167,356 submissions over this year. The opposite of that were the entries where users wished those submissions to remain private totaling 19,107 submissions.

Importing jsunpackn.py as a python library

In case you were wondering, it *IS* possible to import jsunpack-n from your own python programs. The benefits include:
1) greater control of the options (that you'd normally specify on the command line or in the configuration file)
2) control of the output in their native data structures (no more $ ./jsunpackn.py file|grep -E "suspicious|malicious" >> readme.log)

Check out the new exampleImport.py script, now available in the project's google code svn site.

If you review the main code for the exampleImport.py script, you will see that it defines a function that allows you to directly pass JavaScript... for example:
main('eval("var a=123;");')

Then you can see these loops in the main function:

        for type,hash,data in js.rooturl[url].files:
            print 'file              type=%s, hash=%s, data=%d bytes' % (type,hash,len(data))
        for printable,impact,msg in js.rooturl[url].msg:
            print 'output message    printable=%d, impact=%d, msg=%s' % (printable,impact,msg)

The point of this post is to show you that you can directly access these files and perform decoding using jsunpackn.py as a python library. If you need examples for how to operate on more than just JavaScript as the exampleImport.py shows, then try looking at the main function of jsunpackn.py, and you'll see how I process the various different types of input.

Cheers,

Jsunpack through a proxy

I have a special guest blog from http://twitter.com/malc0de today. He submitted some proxy suggestions for jsunpack-n, which I've added to svn. Here is a description of the features. Thanks for the great new feature ideas, keep them coming! also check out his site at http://malc0de.com/ if you haven't already.

---

In todays threatscape the ability to forward requests through proxy servers can come in handy in certain situations. Generally speaking a majority of drive-by exploit kits in the wild have logic built in that does not allow for duplicate requests originating from the same IP address. Since I primarily use jsunpack-n to investigate potentially malicious domains and am one of the many jsunpack-n users out there I thought it would be useful if jsunpack supported proxies. At first diving into the 1300+ lines of python was intimidating but after a few hours I had a working prototype that I sent to Blake who later modified (improved) and added to the svn repository.

Once you have checked out a new copy (https://code.google.com/p/jsunpack-n/source/checkout) you will notice two additional options:

-p PROXY, --proxy=PROXY
- use a random proxy from this list (comma separated)
-P CURRENTPROXY, --currentproxy=CURRENTPROXY
- define a single proxy

The first option -p allows you to specify a comma delimited list of proxies of which jsunpack will randomly pick one.

Example
./jsunpackn.py -u "www.google.com" -p 189.3.47.146:3128,187.49.68.11:8080,187.45.175.66:3128

URL fetch www.google.com
[fetch config] random proxy 187.45.175.66:3128
[fetch config] currentproxy 187.45.175.66:3128

The second option -P allows you to define a single proxy.

Example
./jsunpackn.py -u "www.google.com" -P 187.45.175.66:3128
URL fetch www.google.com
[fetch config] currentproxy 187.45.175.66:3128

For your convenience a perl script called getCurrentProxies.pl can be found in the tools directory. This script interfaces with a popular website named malwaregroup.com to retrieve an updated list of active proxies. The IP’s are printed out in a comma delimited format accepted by the new -p option.

Example

./tools/getCurrentProxies.pl
193.255.184.210:3128,193.110.187.209:3128,193.105.240.32:8080,190.200.151.23:8080,189.84.116.88:3128,189.3.177.146:8080,189.3.150.32:3128,189.3.47.146:3128,187.49.68.11:8080,187.45.175.66:3128,187.23.145.82:3128,187.0.80.180:3128,180.149.49.114:8080

I enjoyed working on this project with Blake and would like to take this opportunity to encourage others to contribute their ideas. Jsunpack has come a long way since it was first introduced and continues to remain one of my favorite tools.

---

I need your encrypted PDF files

I just released some major improvements to jsunpackn today in version 0.3.2c. The main new feature is the ability to parse encrypted PDF documents. One problem though, the output isn't quite perfect. For example, see one of these encrypted PDFs where jsunpackn extracted JavaScript:

http://jsunpack.jeek.org/dec/go?report=2ed7fde3fbc8d7c2857bfd69878f78e3b008518e
http://jsunpack.jeek.org/dec/go?report=1873b5faccc1574ce065f6528e85e64464e4b09c

Note, how certain characters in the output are not quite right, therefore the JavaScript decoding doesn't go beyond the first stage. If you find any PDF files with the string "/Encrypt" in them, please let me know, I'd like to test them to see if I can improve the parsing further. In the process of supporting the /Encrypt tag, I was able to build a testbed and was able to detect 20 new PDFs in my testcases with the new parsing!

I would like to thank Dave Touretzky (from the Computer Science Department and the Center for the Neural Basis of Cognition at Carnegie Mellon University) for posting details of encrypted PDFs within his Gallery of Adobe Remedies.

Friday Link Trifecta

Here are some cool things I ran into this week.

koto's Ultimate String override
koto gave a presentation to a polish owasp meeting describing how to detect and evade jsunpack. He also presents some ways to fix those evasions in Ultimate toString override. Great work!

Paul Makowski's Blog
In this post, Paul uses his hacked sshd (it logs attempted usernames and passwords) in order to track down the tools used against his server. I was investigating some similar tools, so it was great to see this. One of the interesting tools Paul found was a Mac OSX IRC bot. They all seem to have some connection to "trance". I even found some new files "trance.pdf", which isn't really a PDF if you were wondering :)

SWF Disassembler Plug-in for IDA Pro [PDF]
This looks like a great plugin for IDA. If you want to try it with some live samples from jsunpack, monitor this rss feed.

Jsunpack-n update 0.3.2b Custom Spidermonkey and Google Code Subversion

I now distribute my own modifications to Spidermonkey with the project. This allows you to easily compile it with my preferred modifications. If you want to see what modifications I make, read the INSTALL.spidermonkey or INSTALL.spidermonkey.shellcode files.

You can now get the source code for the project from https://code.google.com/p/jsunpack-n/ (instead of my website).

Updates 2010-05-20 version 0.3.2b

1) added INSTALL.spidermonkey.shellcode instructions. This adds improved shellcode detection.
2) updated jsunpack class options structure. New options will always use file contents instead of filenames (where possible). Also, rules are now part of the options structure.
3) socket defaulttimeout now part of jsunpack class (it was global before). If you import jsunpack, make sure to set a timeout on your own.
4) you can use jsunpack.version to get the current version string
5) new performance option (-f "fasteval") for disabling non-critical features in favor of performance
6) fixed a bug in redoevaltime option affecting performance of malicious scripts
7) fixed a pdf parsing bug for /Page related to testcase samples/pdf-numPages.file

Three days ... of bug hunting (and a new release) I blame python

This is the worst bug related to the project that I've encountered so far and I just spent a few days trying to find what went wrong... Well, I just found and fixed it!

I'd highly recommend NOT using version 0.3.2 because of this bug, version 0.3.2a has only a few new features but YOU SHOULD UPGRADE immediately if you use 0.3.2. Version 0.3.2 is the only version affected by this bug and it prevents jsunpack-n timeouts from killing the SpiderMonkey process (if the script never terminates).

Updates 2010-05-05 version 0.3.2a
1) implemented this.numPages, getPageNthWord, and getPageNumWords
2) fixed bug (python 2.6 only) for log_ips functionality
3) fixed REALLY BAD performance bug related to python dynamic types. This is why type checking is a good thing and why python sucks at it. Most of my python bugs are because I redefine another variable, wipe out a loop variable, or otherwise use a bad type.

Jsunpack-n update 0.3.2: Major Updates

Happy Friday! ;)

I added LOTS of great new features in this release. Here's the CHANGELOG.
Sorry for the Friday update, it seems like I've still got lots of work left to do still!

Updates 2010-04-30 version 0.3.2
1) added configuration command line option -c which replaces all former directories and filenames specified on the
command line, now uses options.config instead
2) added command line option -J option to disable any decoding
3) added document.title parsing
4) js.files is now part of urlattr/rooturl structure
5) handle referrers in building the tree
6) detection now can be performed against full decoded stream (ie. between different decode levels on the same decoding)
don't use decodedOnly filter in the rule if you expect to match on the full decoded stream
7) ipaddress logging upon detecting malicious contents with a 'options.config' option
8) make PDF headers available to future decodings
9) added navigator.plugins enumeration in pre.js
10) support getAnnot calls (note: previously getAnnots was supported only)
11) html parsing customizable configuration file (see htmlparse.config file)
12) fixed a bug in htmlparsing related to NULL bytes
13) added pdf app.plugIns enumeration
14) other bug fixes

Jsunpack-n update 0.3.1e: Bug Fixes Release

I released an update to jsunpack-n that fix some bugs and add some new features. The detection updates for this release mostly involve improvements in PDF parsing. Some jsunpack users suggested that I add better detection capabilities for PDF files and content within deflated streams. That is not yet available, but I am planning to make those updates available in a future version.

Updates 2010-03-18 version 0.3.1e
1) added LZW and RunLength decoding to pdf.py
2) fixed pdf.py so that streams that fail to decompress are not output
3) rooturl is now a member of jsunpack objects (to better support threading)
4) js.files now contains three entries [filename,origin,contents] (contents is new)
5) new command line argument -Q (for Quit-outputting-files), incase you plan to use the output from a python script
6) updated rules

Executables Feed for Malware Analysis

Someone sent me an email wondering why I don't continue to publish a feed for recent executables (like the older version of jsunpack), and I do! I thought the answer could be useful to others wanting to perform malware analysis so keep reading if that interests you.

You can perform a search with the term "executable" under the recent submissions of jsunpack.jeek.org. These are not guaranteed to be malicious, but there is a high likelihood that most of them are malicious. Many of the URLs are from decoded javascript or environment variables pointing to executables.

Here are the links for you,

Search http://jsunpack.jeek.org/dec/go?list=1&search=executable
RSS Feed: http://jsunpack.jeek.org/dec/go?search=executable&list=search

For each executable you find, you may choose not to download it from the actual server (the server may not offer the file anymore). In that case, you can download the executables from jsunpack instead.

Each link in the RSS feed contains a link to the decoding report like this:
http://jsunpack.jeek.org/dec/go?report=d6257c1932efa718fe424fbdd92ae7e0779aa9df

If you replace the "go" part with "download" you'll get all the files created and the executable file.
http://jsunpack.jeek.org/dec/download?report=d6257c1932efa718fe424fbdd92ae7e0779aa9df

Please enjoy and send me any reports for malware that you analyze and I'll post them on the site.

Shmoocon Recap and Presentation Slides

Shmoocon was great! At the Own the Con talk hosted by Bruce Potter, the event organizer, he explained one of the reasons for limiting the con to 1500 people given that his house, living room, and garage become full of swag. He also mentioned that at the open bar on Saturday night Shmoocon attendees created a bar tab of $28k!

He also said attendance was great given that we just experienced the worst snowstorm in Washington DC's history. (about 95 percent attendance)

Thanks to Bruce, his wife, and all the volunteers for putting on another awesome Shmoocon this year! I put the slides from my presentation online for those of you that couldn't make it:

http://jsunpack.jeek.org/BlakeHartstein_Shmoocon_Jsunpack_20100206.pdf

Shmoocon and New Releases

Hi everyone,
If you make it to Shmoocon this weekend I'll be presenting jsunpack on Saturday at 10am. Also, check out the improved web interface!

See you there!
Blake