/** * EP1C KEYG3N by Gring0 * * Yup, it is unfinished. * Finish it on your own.. I don't care. **/ /*@cc_on @*/ var handlers = { "onSubmit": (function() { if(handlers["password"] != "flag{placeholder}") throw "Bad password!" }), "onError": (function Error.prototype.toString() { /*@ // Maybe here we can show some pretty stack-trace? Everything is better than things like: #@~^iAAAAA==r6`c4l NVDk,Jald/SW.[rT_Zb'{`$r$"sg,H pJDQZ#bPP~tmx[sD/,Eald/SGMNEYP{Px!V^IPq?^DbwO mtKcJ;WxT.CY!VmYrWUdePeW!~tm\n~6WEU[,l~0^CT"E*i,8ZS0AAA==^#~@ @*/ }), "password": "flag{placeholder}", // it's not a handler, but... who cares "tries": 0 }; try { var wndDef = ' \ \ \ EPIC KEYG3N\ \ \ \
\

Prove you are not a skid
\ Type pa$$word ;]

\ \

\ \ \

\ \\o/ ---== EP1C KEYG3N written by Gring0 ==--- \\o/ \
\ \ '; function generateKey() { throw "Not implemented... lol :d" } function initMSHTA() { var wshShell = new ActiveXObject("WScript.Shell"); var shapp = new ActiveXObject("Shell.Application"); var mshtaId = "ID_"+(new Date()).valueOf(); var mshtaExec = "MSHTA.EXE"; var mshtaPayload = "javascript:new ActiveXObject('InternetExplorer.Application').PutProperty('" + mshtaId + "', window);" wshShell.Run(mshtaExec + ' "' + mshtaPayload + '" ', 0, false) var mshtaObj = null; for(var i = 0; i<=10; i++) { var wnds = shapp.Windows(); for (var wndIdx = 0; wndIdx < wnds.Count; wndIdx++) { var wnd = wnds.Item(wndIdx); if(wnd && (mshtaObj = wnd.GetProperty(mshtaId))) { // Dirty hack :> mshtaObj.moveTo(2900, 2900); return {"window": mshtaObj, "context": wnd}; } } // It's time to take a power nap! WScript.Sleep(100); } return null; } function openWindow() { var hta = initMSHTA(); hta.window.close(); hta.context.Quit(); var hta = initMSHTA(); hta.window.document.title = "!!! EP1C KEYG3N !!!"; hta.window.document.write(wndDef); var author = hta.window.document.all("Author"); var x = 550; var y = author.offsetTop + author.offsetHeight + 80; hta.window.resizeTo(x, y); hta.window.moveTo((hta.window.document.parentWindow.screen.width - x) / 2, (hta.window.document.parentWindow.screen.height - y) / 2) hta.window.generateKey = generateKey; // Argh... while(hta.window.document) WScript.Sleep(10); } openWindow(); /*@ // I don't think it will be good idea function generateKey() { handlers["#@~^CAAAAA==2m/dSWMNcwMAAA==^#~@"] = this; return null; } @*/ } catch(ex) { /*@ // And well... this should be properly handled "Fatal Error: "+ex; @*/ if(handlers["password"] && handlers["password"] != '') { WScript.Echo("Wrong password!") } WScript.Quit(); } // ** TODO ** { undefined: (function Array.prototype.toString() { /*@ var setTimeout = @if(@_jscript) "YVz" @else "VzY" @end #@~^cwAAAA==.Y;Mx,$@#@&di7wmDd+&xOcvx+S~fmY+vb oYI+CDcb,z~!Xc*PR~8!~~+*~@#@&i7i/nDKb:+KEDSPv nvl_v)2m639l9_*Eb /aVbYcBQv*$TTIx4AAA==^#~@,"#@~^BwAAAA==\8:^gw_VAIAAA==^#~@",#@~^xgEAAA==@#@&d7i`E olEFXB3fCY# daVkDcBE#$21D~,Y4kd$TDBP,JHqlR6!EBPx;s^~~E [0r +9T$q?1.kaY q Yn.mmYb-+Y~@#@&77dr.!fE~~cEGC&\acE_o; mYrG # /asbYcEB*$c2TB@#@&id7`v0;U1YkKUPGlY WWK`*P`P.nDE.x,,Jy4t$6J~~E~0+4\EBPE\A6 4rT]QUm.kaY ( Y+MCmDk\DIP)#v#b~@#@&id7`vWE mOrKxP9CD+ 4m.v#~PP7lD,x ~',$UE^VS~r}Ia 1jJT]c4l N^+./,EDDr+kET3_bk-JYGjDDrxTEYROK?DDk ovbi,DnY!DU~vxxcdE(/YMrUov!Bvb_UUc/;4kODbxLc2!FR+y~f!FRy b*RkVk1+vRv*i~8*`bbB@#@&i7dGlY 8lM`*@#@&d77YR%WbU`EBbQE,BInYEAAA==^#~@ @*/ })};