JS Recon Lab 5 - Packed Second Stage


Rat Dashboard - Telemetry

The entry file here is a loader. The real application code arrives RC4-encrypted, split across two vendor chunks, and is executed with new Function() - so it never exists as a file on disk.

Goal: recover the packed stage, then call the console route it registers. It needs a custom header, a token and a query parameter.

Hint 1

/JSRECON/js/l5.boot.js joins __vseg.a + __vseg.b + __vseg.c, base64 decodes them and RC4 decrypts with a key spelled out in hex escapes.

Hint 2

Easiest read: patch the last step. Copy the boot code into the console with new Function(_rc4(_p,_k))() replaced by console.log(_rc4(_p,_k)). The decrypted stage prints as readable JavaScript.

Hint 3

The stage registers window.__console(). Run it in the console on this page and read the response, or rebuild the request yourself: the header name is a char-code array and the token is joined from three fragments.


Back to JS Recon Labs