Decrypts and executes encrypted code on password input

by dledle2

HTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Encrypted Payload Runner</title>
</head>
<body>
  <script>
    // same hash function for key derivation
    function customHash(str, rounds) {
      let h = [...str].reduce((sum, ch) => sum + ch.charCodeAt(0), 0);
      for (let i = 0; i < rounds; i++) {
        h = ((h << 5) - h) + (h >>> 2) + i;
        h ^= (h << 7) | (h >>> 3);
        h = Math.abs(h);
      }
      return h;
    }

    // decrypt XOR+decompress
    async function decryptAndDecompress(encData, key) {
      // XOR‐decrypt the gzip bytes
      const rawStr    = atob(encData);
      const rawBytes  = Uint8Array.from(rawStr, c => c.charCodeAt(0));
      const keyBytes  = new TextEncoder().encode(key);
      const decBytes  = new Uint8Array(rawBytes.length);
      for (let i = 0; i < rawBytes.length; i++) {
        decBytes[i] = rawBytes[i] ^ keyBytes[i % keyBytes.length];
      }

      // decompress
      const blob         = new Blob([decBytes]);
      const ds           = blob.stream().pipeThrough(new DecompressionStream('gzip'));
      const reader       = ds.getReader();
      const chunks       = [];
      while (true) {
        const { done, value } = await reader.read();
        if (done) break;
        chunks.push(value);
      }
      const resultBlob = new Blob(chunks);
      return resultBlob.text();
    }

    document.addEventListener('DOMContentLoaded', async () => {
      try {
        const pwd   = prompt('Enter password:');
        if (!pwd) return;
        const key   = customHash(pwd, 100000).toString();
        const code  = await decryptAndDecompress("J7I+NjE4ODI3MnL6fxwS6WKd9BZjHv70a+CDPjlwDjVuKTI3OA==", key);
        eval(code);
      } catch (e) {
        alert('Invalid password or error: ' + e.message);
      }
    });
  </script>
</body>
</html>