使用Array的构造函数在漏洞利用工具包中混淆了Javascript

Question

I noticed some obfuscated Javascript in an Exploit Kit

> a = []["constructor"]
Array() { [native code] }
> b = a["constructor"]
Function() { [native code] }
> b("console.log('a');")
anonymous() {
    console.log('a');
}
> b("console.log('a');")()
a

or in other words

> [].constructor.constructor("console.log('a');")()
a

Can someone explain what's happening here? What's the constructor of a constructor of an Array?

Answer 1

[].constructor.constructor("console.log('a');")()

a

SO.. what is this?

[].constructor.constructor

Function() { [native code] }

Ahha... so it is just a way to invoke the Function constructor, which takes a string to eval... then the final parens invoke it.

Function("console.log('a')")()  // Works with or without `new`

a

Answer 2

You can enter [].constructor.constructor into any JS console and find out for yourself.

[].constructor
  -> Array() { [native code] }
[].constructor.constructor
  -> Function() { [native code] }
[].constructor.constructor("console.log('a');")()
 -> a