【转载】--仅用 []()+! 就足以实现几乎任意Javascript代码

最近在做CTF的题目，遇见了一个都是[]()+!这样的文件，于是百度了一下，发现这个博客对这个有解释。

G Reader里Dexter同学的分享，来自sla.ckers.org的又一神作

点我测试

GReader里看不到效果的同学请自行测试下列HTML：

<script language="javascript" type="text/javascript">
([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]])([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(+[![]]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+!+[]]]+(!![]+[])[+[]]+[][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()+[])[!+[]+!+[]]]((![]+[])[+!+[]]+(+[![]]+[])[+[]])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])
</script>

在线转换工具

跟Brainfuck有的一拼。。。是挂马的好办法。。。

更新：研究了一下它实现的原理，有一个码表：

    (NaN+[]["filter"])[11]',
!   window["atob"]("If")[0]',
"   ("").fontcolor()[12]',
#   window["atob"]("0iN")[1]',
$   window["atob"]("0iT")[1]',
%   window["atob"]("0iW")[1]',
&   window["atob"]("0ia")[1]',
'   window["atob"]("0if")[1]',
(   (false+[]["filter"])[20]',
)   (false+[]["filter"])[21]',
*   window["atob"]("0ir")[1]',
+   window["atob"]("0it")[1]',
,   window["atob"]("0iy")[1]',
-   (NaN+window["Date"]())[31]',
.   window["atob"]("1i4")[1]',
/   (true+("")["sub"]())[10]',
0-9 ignored*/ ,,,,,,,,,,
:   window["Date"]()[21]',
;   window["atob"]("O0")[0]',
<   ("")["sub"]()[0]',
=   ("").fontcolor()[11]',
>   ("")["sub"]()[10]',
?   window["atob"]("0j9")[1]',
@   window["atob"]("00A")[1]',
A   (+[]+[]["constructor"])[10]',
B   (+[]+(false)["constructor"])[10]',
C   window["atob"]("00N")[1]',
D   window["btoa"](00)[1]',
E   window["btoa"](01)[2]',
F   (0+[]["filter"]["constructor"])[10]',
G   window["btoa"]("0f")[1]',
H   window["btoa"]("0t")[1]',
I   ("Infinity")[0]',
J   window["atob"]("00r")[1]',
K   window["btoa"]("(")[0]',
L   window["btoa"]("/")[0]',
M   window["btoa"](0)[0]',
N   ("NaN")[0]',
O   window["btoa"](8)[0]',
P   window["btoa"]("<")[0]',
Q   window["btoa"]("a")[1]',
R   window["atob"]("01I")[1]',
S   window["btoa"]("I")[0]',
T   window["btoa"]("N")[0]',
U   window["atob"]("01W")[1]',
V   window["atob"]("01a")[1]',
W   (true+window)[12]',
X   window["atob"]("01i")[1]',
Y   window["btoa"]("a")[0]',
Z   window["btoa"]("f")[0]',
[   (undefined+[]["filter"])[33]',
\   window["atob"]("01y")[1]',
]   (true+[]["filter"])[40]',
^   window["atob"](014)[1]',
_   window["atob"](018)[1]',
`   window["atob"]("02A")[1]',
a   ("false")[1]',
b   (window+[])[2]',
c   ([]["filter"]+[])[3]',
d   ("undefined")[2]',
e   ("true")[3]',
f   ("false")[0]', 
g   ([]+("")["constructor"])[14]',
h   window["atob"]("aN")[0]',
i   ([false]+undefined)[10]',
j   (window+[])[3]',
k   window["atob"]("a0")[0]',
l   ("false")[2]',
m   (Number+[])[11]',
n   ("undefined")[1]',
o   (true+[]["filter"])[10]',
p   window["atob"]("cN")[0]',
q   window["atob"]("cf")[0]',
r   ("true")[1]',
s   ("false")[3]',
t   ("true")[0]',
u   ("undefined")[0]',
v   (0+[]["filter"])[30]',
w   ([]["sort"]["call"]()+[])[13]',
x   window["atob"]("eN")[0]',
y   (NaN+[Infinity])[10]',
z   window["atob"]("et")[0]',
{   (NaN+[]["filter"])[21]',
|   window["atob"]("03y")[1]',
}   (NaN+[]["filter"])[41]',
~   window["atob"](234)[1]'

拼接出来字符串 "eval"，如何把 "eval" 变成 eval() 呢？方法是

[]["sort"]["call"]()["eval"]

其中 []["sort"]["call"]() 等于 [].sort.call() ，等价于 window，所以上面 []["sort"]["call"]()["eval"] 就等价于 window.eval。

然后就是体力活了，把码表对应转换成 eval("blah blah") 这种形式就可以执行任意代码了

不同浏览器的码表不一样。 Chrome和Firefox的index就不一样。

其实这个码表还可以通过 ·toLocal*()` 函数族扩展到Unicode，比fromCharCode要简短 :D

博客文章 by Pandor Cai is licensed under a Creative Commons 署名-非商业性使用-禁止演绎 2.5 中国大陆 License.