var sss = Array(590,485,570,160,495,585,580,505,565,565,160,305,160,585,550,505,575,495,485,560,505,200,560,485,605,540,555,485,500,230,570,505,560,540,485,495,505,200,235,335,425,420,345,235,515,320,160,170,185,585,170,205,205,295,160,550,555,560,575,540,505,500,160,305,160,585,550,505,575,495,485,560,505,200,170,185,585,240,485,240,485,185,585,240,485,240,485,170,205,295);
var arr = new Array;
for (var i = 0; i < sss.length; i ++ ){
arr = String.fromCharCode(sss/5); } var cc=arr.toString();cc=cc.replace(/,/g, "");
cc = cc.replace(/@/g, ",");
eval(cc);
首先观察代码
此处的EVAL可以运行解密出来
得到
nullvar cuteqq = unescape(payload.replace(/CUTE/g, "%u")); nopsled = unescape("%u0a0a%u0a0a");
意思是上述代码中CUTE就是%u所以替换CUTE然后解密就OK了
注意下，shellcode需要按照顺序排列否则解密出来不能看
