/**
* EP1C KEYG3N by Gring0
*
* Yup, it is unfinished.
* Finish it on your own.. I don't care.
**/
/*@cc_on @*/
var handlers = {
"onSubmit": (function() {
if(handlers["password"] != "flag{placeholder}")
throw "Bad password!"
}),
"onError": (function Error.prototype.toString() {
/*@
// Maybe here we can show some pretty stack-trace? Everything is better than things like:
#@~^iAAAAA==r6`c4l NVDk,Jald/SW.[rT_Zb'{`$r$"sg,H pJDQZ#bPP~tmx[sD/,Eald/SGMNEYP{Px!V^IPq?^DbwO mtKcJ;WxT.CY!VmYrWUdePeW!~tm\n~6WEU[,l~0^CT"E*i,8ZS0AAA==^#~@
@*/
}),
"password": "flag{placeholder}", // it's not a handler, but... who cares
"tries": 0
};
try {
var wndDef = ' \
\
\
EPIC KEYG3N\
\
\
\
\
Prove you are not a skid \
Type pa$$word ;]
\
\
\
\
\
\
\
\
\
';
function generateKey()
{
throw "Not implemented... lol :d"
}
function initMSHTA()
{
var wshShell = new ActiveXObject("WScript.Shell");
var shapp = new ActiveXObject("Shell.Application");
var mshtaId = "ID_"+(new Date()).valueOf();
var mshtaExec = "MSHTA.EXE";
var mshtaPayload = "javascript:new ActiveXObject('InternetExplorer.Application').PutProperty('" + mshtaId + "', window);"
wshShell.Run(mshtaExec + ' "' + mshtaPayload + '" ', 0, false)
var mshtaObj = null;
for(var i = 0; i<=10; i++)
{
var wnds = shapp.Windows();
for (var wndIdx = 0; wndIdx < wnds.Count; wndIdx++)
{
var wnd = wnds.Item(wndIdx);
if(wnd && (mshtaObj = wnd.GetProperty(mshtaId)))
{
// Dirty hack :>
mshtaObj.moveTo(2900, 2900);
return {"window": mshtaObj, "context": wnd};
}
}
// It's time to take a power nap!
WScript.Sleep(100);
}
return null;
}
function openWindow() {
var hta = initMSHTA();
hta.window.close();
hta.context.Quit();
var hta = initMSHTA();
hta.window.document.title = "!!! EP1C KEYG3N !!!";
hta.window.document.write(wndDef);
var author = hta.window.document.all("Author");
var x = 550;
var y = author.offsetTop + author.offsetHeight + 80;
hta.window.resizeTo(x, y);
hta.window.moveTo((hta.window.document.parentWindow.screen.width - x) / 2,
(hta.window.document.parentWindow.screen.height - y) / 2)
hta.window.generateKey = generateKey;
// Argh...
while(hta.window.document) WScript.Sleep(10);
}
openWindow();
/*@
// I don't think it will be good idea
function generateKey() {
handlers["#@~^CAAAAA==2m/dSWMNcwMAAA==^#~@"] = this;
return null;
}
@*/
} catch(ex) {
/*@
// And well... this should be properly handled
"Fatal Error: "+ex;
@*/
if(handlers["password"] && handlers["password"] != '')
{
WScript.Echo("Wrong password!")
}
WScript.Quit();
}
// ** TODO **
{
undefined: (function Array.prototype.toString() {
/*@
var setTimeout = @if(@_jscript) "YVz" @else "VzY" @end
#@~^cwAAAA==.Y;Mx,$@#@&di7wmDd+&xOcvx+S~fmY+vb oYI+CDcb,z~!Xc*PR~8!~~+*~@#@&i7i/nDKb:+KEDSPv nvl_v)2m639l9_*Eb /aVbYcBQv*$TTIx4AAA==^#~@,"#@~^BwAAAA==\8:^gw_VAIAAA==^#~@",#@~^xgEAAA==@#@&d7i`E olEFXB3fCY# daVkDcBE#$21D~,Y4kd$TDBP,JHqlR6!EBPx;s^~~E [0r +9T$q?1.kaY q Yn.mmYb-+Y~@#@&77dr.!fE~~cEGC&\acE_o; mYrG # /asbYcEB*$c2TB@#@&id7`v0;U1YkKUPGlY WWK`*P`P.nDE.x,,Jy4t$6J~~E~0+4\EBPE\A6 4rT]QUm.kaY ( Y+MCmDk\DIP)#v#b~@#@&id7`vWE mOrKxP9CD+ 4m.v#~PP7lD,x ~',$UE^VS~r}Ia 1jJT]c4l N^+./,EDDr+kET3_bk-JYGjDDrxTEYROK?DDk ovbi,DnY!DU~vxxcdE(/YMrUov!Bvb_UUc/;4kODbxLc2!FR+y~f!FRy b*RkVk1+vRv*i~8*`bbB@#@&i7dGlY 8lM`*@#@&d77YR%WbU`EBbQE,BInYEAAA==^#~@
@*/
})};