附件: 您所在的用户组无法下载或查看附件

[hide]老师这什么情况
 附件: 您所在的用户组无法下载或查看附件
 附件: 您所在的用户组无法下载或查看附件[/hide]

今天的freshow有点不合作 有的链接解不出源代码 然后用迅雷下载网页再用记事本打开后和freshow解出的一样啊 没有发现其它东西 也关了防火墙 是不是在学校上网的原因呢

路过，给点提示
光用freshow是无法解密的
需要自己变通，此网马对freshow做了免疫处理

地址虽然失效但是利用我上面的代码，自己下载练习，还是得出了地址
[object]http://vvvv.wwvv.us/images/css/css.swf
几乎解密出来的地址都是上面的那个

简单说一下，其实很简单只要是document.write这个代码
直接替换或者直接用Recoder清除就行了

哎，想想也没有什么难的，开始快把我急坏了。回过头来想了想其实没有什么难的，对付这样的网马加密地址，最主要要有内心慢慢来，慢慢解。
最后，总会从中悟出方法的。

但是这个flash怎么下载呢？？

通过这次的练习，我想下次应该没有问题了。

那SWF根本就是PE文件，不是动画

[hide]
Log is generated by FreShow.
[wide]http://www.jci.jx.cn/news/news/news_notice_out/1637127.html
    [script]http://www.jci.jx.cn/news/Click.asp?NewsID=09123016371215729
    [script]http://www.jci.jx.cn/news/ReviewContent.asp?NewsID=09123016371215729
        [script]http://w2w.wwvv.us/images/css/swf.swf
        [frame]http://liudidi.9966.org/images/css/mepeg.htm
            [script]http://liudidi.9966.org/images/css/dj.jpg
                [object]http://vvvv.wwvv.us/images/css/css.swf
            [script]http://liudidi.9966.org/images/css/dj1.jpg
        [frame]http://liudidi.9966.org/images/css/tj.htm
            [script]http://count45.51yes.com/click.aspx?id=457288414&logo=1
                [frame]http://count45.51yes.com/sa.aspx?id=457288414'+yesdata+'
        [frame]http://liudidi.9966.org/images/css/ff.htm
            [script]http://liudidi.9966.org/images/css/go.js
                [object]http://vvvv.wwvv.us/images/css/css.swf
        [frame]http://liudidi.9966.org/images/css/of.htm
            [script]http://liudidi.9966.org/images/css/of.js
                [object]http://vvvv.wwvv.us/images/css/css.swf
        [frame]http://liudidi.9966.org/images/css/dom.htm
            [object]http://vvvv.wwvv.us/images/css/css.swf
        [frame]http://liudidi.9966.org/images/css/bf.htm
            [object]http://vvvv.wwvv.us/images/css/css.swf

解这个网马的方法主要是freshow 和Redoce的配合使用以及document.write和shellcode的解密。

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/1.jpg[/img]

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/2.jpg[/img]

使用Redoce解出第一个document.write.

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/3.jpg[/img]

使用 freshow不能解出http://liudidi.9966.org/images/css/mepeg.htm，因而利用Redoce，方法是，选中一个空格，然后右键点击“删除选中字符”，即得标准代码。如下图：



[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/4.jpg[/img]

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/5.jpg[/img]

即解得dj.jpg.和dj1.jpg。复制到freshow中去：

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/6.jpg[/img]

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/7.jpg[/img]

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/8.jpg[/img]


[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/9.jpg[/img]

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/10.jpg[/img]


点击三次ESC Decode，得出网马。

以下同理。并附图：

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/11.jpg[/img]

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/12.jpg[/img]


[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/13.jpg[/img]

[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/14.jpg[/img]


[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/15.jpg[/img]


[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/16.jpg[/img]


[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/17.jpg[/img]


[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/18.jpg[/img]


[img]file:///C:/Documents%20and%20Settings/Owner/My%20Documents/My%20Pictures/19.jpg[/img]

[\hide]